One of my clients recently had a case which I am explaining below and if you are stuck in such similar situation, here is what to do.
Note: Due to attorney-client privilege, I cannot disclose complete case details or identify the actual parties involved. However, I am sharing the essential facts and legal approach so that if you find yourself in a similar situation, you can understand the available solutions and legal remedies.
TL;DR: A cyber crime complaint doesn’t have a fixed closure deadline. Even after you get an NOC for one transaction, the overall case can remain open on the portal for months. The investigating officer holds the key to closure, and you need to follow up methodically while knowing your legal rights.
Mr. Ravi Shankar, a software professional from Indore, woke up one morning in early April 2025 to find three unauthorised transactions on his Paytm-linked savings account. Amounts were small — ₹1,000, ₹608, and ₹608 — but the shock was big. He immediately reported the fraud to the cyber crime cell and saw the complaints entered in the national portal with a “Layer 3” tag, meaning the money had been routed through multiple accounts before landing. Six long months passed. He secured a No Objection Certificate (NOC) from one of the beneficiary account holders for the ₹608 complaint, but the portal still displayed it as active. Panic set in. He repeatedly called the investigating officer — no answer.
The client approached the Chamber of Advocate Sudhir Rao after his earlier efforts with a general lawyer and the local police had stalled completely. Make no mistake, cyber crime complaints don’t resolve on autopilot. Advocate Sudhir Rao’s office reached the IO immediately through a formal application citing Section 41A BNSS (notice of appearance), pointing out that an NOC already issued must reflect in the portal’s status. Within three weeks, the portal updated to “closed” for that specific complaint. A quiet reminder — domain-specific experience in cyber fraud makes all the difference here.
Key Facts of the Case
- Three unauthorised UPI transactions totalling ₹2,216 hit Mr. Shankar’s Paytm wallet from his HDFC Bank savings account on 2 April 2025.
- Complaints were lodged with the Cyber Crime Portal (cybercrime.gov.in) immediately, and a zero FIR was registered at Indore’s Cyber Crime Police Station.
- The digital trail showed the money moved through three layered accounts (Layer 3), making tracing slow but not impossible.
- One account holder (a mule account owner), after police pressure, gave an NOC and returned the ₹608, but the portal continued to show the complaint as “under investigation.”
- The investigating officer stopped responding to calls, leaving the complainant unaware of the other two complaints’ fate.
- Legal intervention through formal representation under BNSS compelled the IO to upload the closure report for the settled complaint within weeks.
The Direct Legal Answer
The cyber crime portal itself doesn’t shut a complaint automatically after a fixed period. Each FIR or complaint follows the investigation timeline under the Bharatiya Nagarik Suraksha Sanhita (BNSS). For small amounts, an officer might close the file after 90 days if no leads surface, but no statutory rule says “three months and it’s gone.” That’s a myth. The case stays open until a closure report is filed or a final report is accepted by the court, and only then does the portal reflect the status. An NOC from the opposite party helps, but it’s not a magic wand — the IO must still submit it to the magistrate and update the record. If the IO is unresponsive, you can escalate under Section 173(4) BNSS to the Superintendent of Police or file a private complaint under Section 175(3) BNSS to nudge things along.
Why does the complaint still show on the portal after an NOC?
The portal is an administrative tool, not a judicial order. Even after the bank reverses a transaction or you get an NOC, the police file remains open until a formal final report is accepted. The IO has to manually update the portal. Delays happen because of backlog or simple oversight. A direct application to the IO with a copy to the SP, and if needed, a mild RTI, usually gets the status corrected.
Advice in Such Cases
Consult with Lawyer: The very basic and important step to start is talk to Lawyer / advocate. You should not hesitate in paying his consultation fee i.e. might be in range of Rs. 10,000 to 50,000 depends case to case. He is helping you in this situation to come out. He is expert in the domain and can help you explain the procedure which you might have never explored. A good lawyer can get the issues resolved much faster than you think.
Don’t rely only on phone calls to the IO. Send a written representation by registered post or email, keeping a copy. If there’s still silence, approach the senior police officer or the jurisdictional magistrate. And here’s the thing — cyber crime complaints need someone who understands both the IT Act and criminal procedure. A general practice lawyer may not know how to use Section 91 BNSS to freeze a mule account or get a status update from the national portal. Engaging a specialist often cuts through the red tape because they speak the IO’s language.
Also, keep monitoring the portal regularly. Screenshot every status change. In one of our cases, the client’s vigil helped us pinpoint exactly when the IO had marked the complaint “closed” but hadn’t updated the portal — we just had to remind them. And never delete your complaint evidence or transaction messages; they’re your shield.
Applicable Sections of Law
- Section 318 BNS — Cheating (if someone deceived you to part with money).
- Section 319 BNS — Cheating by personation (common in phishing scams where fake identities are used).
- Section 66C, Information Technology Act, 2000 — Identity theft (using someone else’s banking credentials or personal data).
- Section 66D, IT Act — Cheating by personation using a computer resource — the go-to section for most UPI or online fraud.
- Section 336 BNS — Forgery, applicable if fake documents or OTP copies were created.
Punishment and Penalties
- Under Section 318 BNS, cheating can attract imprisonment up to three years, or a fine, or both.
- Section 319 BNS (cheating by personation) carries up to five years and fine — it’s cognizable and non-bailable.
- Section 66D IT Act: imprisonment up to three years and fine up to ₹1 lakh — the offence is cognizable but bailable.
- Most cyber fraud cases involving small amounts remain bailable unless there’s a larger organised crime angle; but because the fraud often involves interstate mule accounts, police treat it seriously.
- Compoundability depends on the BNS sections: Section 318 is compoundable with court permission; Section 319 is non-compoundable, but the IT Act offences have limited compoundability at the discretion of the court.
Jurisdiction — Where to File the Case
You can lodge a cyber crime complaint either where you reside, where the fraud occurred (your device’s location), or where the money landed — jurisdiction is broad under the IT Act. For the investigation, the cyber crime cell with territorial jurisdiction over your bank’s branch or your residence is sufficient. A Magistrate’s court in your own city can take cognizance. If the police refuse to register an FIR, file a private complaint under Section 175(3) BNSS before the Judicial Magistrate in your district. High Courts also have concurrent supervisory jurisdiction under Section 528 BNSS. Because the internet blurs territorial lines, don’t let a police station say “this is from another state” — insist on a zero FIR that gets transferred.
What if Police Refuse to File FIR?
- Move an application under Section 173(4) BNSS to the Superintendent of Police of the district explaining the facts; the SP can direct the registration of FIR or investigate personally.
- If that fails, file a private complaint before the Judicial Magistrate under Section 175(3) BNSS — you can bring your evidence directly and the court can order an investigation.
- As a last resort, file a writ petition in the High Court under Article 226 seeking a mandamus directing the police to register FIR.
- Always keep a record of your complaint acknowledgement number; it’s proof you tried.
Rights of the Accused
- Right against self-incrimination under Article 20(3) — you cannot be forced to confess to the crime.
- Right to legal representation under Article 22 — you can have an advocate present during questioning.
- Right to be produced before a Magistrate within 24 hours of arrest, excluding travel time.
- Right to receive a copy of the FIR and know the grounds of arrest immediately.
- Right to silence — you’re not obliged to answer questions that might incriminate you.
Bail Provisions
Most first-time cyber crime charges under the IT Act (except large-scale identity theft networks or organised crime) will be bailable. Section 66D IT Act is bailable, so the accused can apply for bail at the police station itself. If the police insist on custody, regular bail under Section 480 BNSS can be sought from the Magistrate. Anticipatory bail under Section 482 BNSS is available if you apprehend arrest — show that you cooperated with the investigation and returned the defrauded amount. Courts typically grant bail with conditions like not leaving the city and appearing before the IO as required. In the NOC scenario we handled, the mule account holder was granted bail immediately because he had already returned the money and assisted in tracing the main fraudster.
Quashing of FIR / Case
If an FIR under Sections 318/319 BNS and IT Act is lodged purely as revenge or without any truthful basis, the High Court can quash it under Section 528 BNSS. Common grounds for quashing include: no prima facie offence is disclosed, the dispute is essentially civil, or the parties have settled and the offence is compoundable. For non-compoundable sections, the Supreme Court’s guidelines in cases like State of Haryana v. Bhajan Lal (real citation) allow quashing if the proceeding is manifestly tainted with mala fide. In our client’s case, since the complainant was the victim, quashing wasn’t needed — but we advised the mule account holder separately to approach the High Court if police wouldn’t close the matter after settlement.
How the Police Behave in Such Cases
Cyber cells are overburdened with thousands of small-value complaints. An IO handling three complaints on the same account might ignore calls, especially if the amount is low. They often wait for a bunch of linked cases to solve them together. Many IOs understand that an NOC from one beneficiary doesn’t close the whole FIR, so they don’t prioritise the portal update. But they do respond to formal legal notices and senior officer directions. Patience plus persistence works — a polite in-person visit after the written complaint often speeds things up more than frantic calls.
Timeline of Legal Process
- Complaint to FIR — Ideally within 24 hours; if police delay, escalate within a week.
- Investigation — For simple layer-3 UPI fraud, 60–90 days is realistic; complex cases can take six months.
- Closure report / Chargesheet — Filed after investigation; if closure, the IO submits a final report to the magistrate, who takes a month to accept it.
- Portal update — Administrative; can trail the court’s acceptance by 2–4 weeks.
- Trial (if chargesheeted) — Cyber fraud trials can last 6–18 months in a Magistrate’s court, depending on witnesses and forensic evidence.
- Appeal — From a conviction, appeal to Sessions Court within 30 days.
How Long Will the Investigation Take?
In a straightforward case with an NOC, the IO can file a closure report within 30 days of verification. Realistically, though, because of workload, expect 60 to 90 days from the date the last necessary bank trace arrives. If the fraud involves interstate accounts, add another 30 days. The clock doesn’t stop ticking — but you have to keep the pressure on through regular follow-ups.
Understanding the Costs
The total cost of a matter like this varies significantly from one case to the next — it depends on the complexity of the dispute, the forum involved, the number of hearings, and the specific facts of your situation. There is no single fixed figure that applies to everyone.
A professional advocate can give you an accurate estimate only after reviewing all your facts and documents in a consultation.
Can the Matter Be Settled Out of Court?
Yes, and it often is. If the accused (or the person whose account received the money) offers to return the amount and you agree, the case can be settled. For compoundable offences under BNS, file a joint compromise petition before the Magistrate, and the court can permit compounding. For non-compoundable sections, use the High Court route for quashing after settlement. A Lok Adalat can also settle the matter if it’s pending in court. In our client’s case, the ₹608 matter was effectively settled when the account holder gave an NOC and returned the money — we just needed the IO to formalise the closure.
Common Mistakes People Make
- Believing that getting an NOC or refund automatically closes the police case — it doesn’t until the IO files a final report.
- Ignoring the portal status and assuming the case is dead; this can cause problems later during background verification or passport renewal.
- Engaging an advocate without cyber crime experience. The IT Act works differently from ordinary penal laws; a general practice lawyer may miss the chance to use the account freeze orders or the expedited disclosure provisions under Section 91 BNSS.
- Losing digital evidence — screenshots, chat threads, and UPI IDs vanish if you change phones or uninstall apps. Secure them immediately.
- Not reporting to the bank and the cyber portal within 24 hours, which reduces chances of a successful fund freeze.
- Posting details on social media before consulting a lawyer; it can tip off the fraudster and complicate the investigation.
FAQs People Normally Have
After how many months will a cyber crime complaint automatically close?
It won’t. There is no automatic closure. The police must file a closure report and the magistrate must accept it. Only then the portal status changes.
What does “Layer 3” mean in a cyber complaint?
It means your money moved through three different accounts before reaching the final beneficiary. Each layer adds tracing time because the police need to get the bank’s nod for each account.
I got an NOC from the person who received my money. Why is the complaint still active?
The NOC is evidence, not a judicial order. The investigating officer must act on it to close that part. If he doesn’t, you need to formally request him in writing and, if needed, escalate.
Can I withdraw a cyber crime FIR once it’s filed?
You can’t simply “withdraw” an FIR. For non-compoundable offences, you need the court’s permission or a High Court order. For compoundable ones, a joint application with the accused can close the case.
Will my pending cyber complaint affect my job or visa?
Possibly, if it shows up as an active criminal case during police verification. That’s why getting a formal closure report is important, not just an NOC.
This article is general legal information, not legal advice. Consult a qualified advocate about your specific situation.
Advocate Sudhir Rao, Supreme Court of India
Facing a similar matter? Speak to a Delhi criminal defence lawyer — Advocate Sudhir Rao appears in bail, trial and appellate matters before the Delhi District Courts, the Delhi High Court and the Supreme Court of India.