One of my clients recently had a case which I am explaining below and if you are stuck in such similar situation, here is what to do.
Note: Due to attorney-client privilege, I cannot disclose complete case details or identify the actual parties involved. However, I am sharing the essential facts and legal approach so that if you find yourself in a similar situation, you can understand the available solutions and legal remedies.
TL;DR: Once a WhatsApp account is compromised through OTP fraud, time is everything. Report to 1930 and the National Cyber Crime Portal immediately, direct every victim to file a complaint with their own bank, and push for rapid freezing of destination accounts through the cyber cell. Recovery odds improve dramatically when accounts are frozen within the first 24 to 48 hours, before funds are withdrawn or layered.
Rohan Kumar was riding his bike through the crowded lanes of Indore when his phone buzzed. A delivery agent claimed he was standing outside the house with a health insurance policy letter and needed an OTP to release the parcel. Distracted, Rohan read the six-digit code aloud without a second thought.
Within minutes, his WhatsApp logged out on every device. And here's the thing nobody noticed right away: every incoming call to his number was being silently forwarded to another SIM. Friends and relatives couldn't reach him.
The scammer worked fast. Messages went out from Rohan's WhatsApp to his contacts, claiming an urgent hospital bill and asking for immediate transfers. By the time anyone realised something was wrong, several relatives had already pushed through nearly ₹2.5 lakhs to accounts the scammer controlled.
A complaint was filed on the National Cyber Crime Portal and 1930 was dialled. Call forwarding was stopped on Rohan's phone. But the money was already moving through multiple bank accounts and the initial follow-up with local authorities did not move quickly.
Frustrated, the family approached the Chamber of Advocate Sudhir Rao. The office mapped every bank account that received funds, prepared a precise complaint with transaction IDs, and moved for immediate freezing of the destination accounts. That domain-specific handling finally got the bank and cyber cell moving, and the order for freezing the destination accounts was secured in the family's favour before the funds could be withdrawn further.
Key Facts of the Case
- OTP was disclosed to a fraudster posing as a courier delivery agent, leading to WhatsApp account takeover.
- Incoming call forwarding was silently activated on the victim's mobile number, blocking all warnings.
- Friends and relatives transferred approximately ₹2 to ₹3 lakhs in total to accounts controlled by the scammer.
- Complaints were filed on the National Cyber Crime Portal and through the 1930 helpline.
- Call forwarding was disabled after the fraud was detected.
- Destination bank accounts were identified and frozen through immediate follow-up and legal escalation.
The Direct Legal Answer
What is the actual success rate of recovering money through the Cyber Cell once a complaint is filed?
Recovery depends far less on the cyber cell's general efficiency and far more on how quickly the destination bank accounts are frozen. If the accounts are frozen within 24 to 48 hours, before cash is withdrawn or moved through mule accounts into crypto, recovery odds are meaningfully better. In many cases, frozen amounts are eventually returned through a court order under Section 87 BNSS or under the bank's fraud procedures, though the process can take months. Where funds have already been withdrawn as cash or converted into cryptocurrency, recovery becomes extremely difficult. The complaint has to be precise, with UTR numbers and transaction timestamps, because a vague complaint slows everything down.
What exact steps do the friends and relatives who sent the money need to take with their own banks right now?
Each person who transferred money should call their bank's fraud helpline immediately and dispute the transaction as fraud. Then they should email the bank's nodal officer with details of the transfer, the account number it went to, and the UTR number. They should specifically request a hold or freeze on the destination account through the bank's fraud reporting mechanism. RBI guidelines require banks to act on fraud reports without delay. They should also save every screenshot, SMS confirmation, and bank statement as evidence, and file their own complaint on the National Cyber Crime Portal. Each transaction is a separate fraudulent transfer and must be reported by the person who made it.
Are there any specific banking or legal escalations to pursue to get the scammer's bank accounts frozen faster?
Yes. The fastest route is usually through the bank's own fraud reporting channel, which can escalate a hold request to the destination bank. In parallel, the cyber cell can issue a direction to the bank under Section 106 BNSS to freeze the account. Where the cyber cell is slow, a criminal complaint can be filed before the Magistrate, who can direct the police to investigate and the bank to preserve funds. Advocate Sudhir Rao and his office have seen that a single, well-drafted complaint that names the destination account numbers, UTR numbers, and timelines gets results much faster than a scattered set of informal complaints.
Advice in Such Cases
Consult with Lawyer: The very basic and important step to start is talk to Lawyer / advocate. You should not hesitate in paying his consultation fee i.e. might be in range of Rs. 10,000 to 50,000 depends case to case. He is helping you in this situation to come out. He is expert in the domain and can help you explain the procedure which you might have never explored. A good lawyer can get the issues resolved much faster than you think.
Time is the enemy. Every hour that passes after the fraudulent transfer reduces the chance of recovery because funds move quickly through mule accounts. Reach the banks and the cyber cell within the first day if at all possible.
Preserve everything. Screenshots of WhatsApp messages, call logs, call forwarding settings, bank statements, UTR references, emails to banks. These records become the spine of the case later.
Do not let the victims negotiate directly with the scammer. Scammers sometimes return a small amount to build trust and then extract more. Cut all contact and route everything through the bank and police.
This category of case involves nuanced procedural and evidentiary strategies that a general practitioner may not be fully familiar with. Advocates who regularly handle cyber fraud matters understand banking escalation protocols, RBI circulars on fraudulent transfers, and how to draft complaints that prompt quick freezes. Domain-specific experience typically leads to faster and better outcomes.
Applicable Sections of Law
The legal framework for WhatsApp hacking and OTP fraud draws from two statutes:
- Section 318 BNS — Cheating: applies to inducing someone to transfer money through deception.
- Section 319 BNS — Cheating by personation: applies where the offender pretends to be someone else, as happened here with the impersonated WhatsApp account.
- Section 66C, Information Technology Act, 2000 — Identity theft: covers unauthorised use of the victim's identity through OTP and WhatsApp takeover.
- Section 66D, Information Technology Act, 2000 — Cheating by personation using a computer resource: directly addresses frauds committed through a digital platform.
- Section 43, Information Technology Act, 2000 — Unauthorised access: provides a civil remedy for compensation against the hacker.
Punishment and Penalties
- Section 318 BNS (Cheating): Imprisonment up to three years, or fine, or both. Non Non-cognizable, bailable, and compoundable.
- Section 319 BNS (Cheating by personation): Imprisonment up to five years, or fine, or both. This offence is more serious because the fraudster impersonated the victim using the compromised WhatsApp account.
- Section 66C, Information Technology Act, 2000: Imprisonment up to three years and fine up to ₹1 lakh.
- Section 66D, Information Technology Act, 2000: Imprisonment up to three years and fine up to ₹1 lakh.
- Section 43, Information Technology Act, 2000: No punishment as it is a civil remedy, but compensation and damages can be claimed by the victim for unauthorised access and loss caused.
Frequently Asked Questions
What should I do in the first hour after I realise I have been tricked by an OTP scam?
Immediately call 1930 and register the fraud on the National Cyber Crime Reporting Portal. Contact your mobile operator to disable call forwarding and regain control of your number. Then contact your bank and every bank of every person who transferred money. Ask each bank to raise a fraud hold request on the destination account. The first hour is often the difference between freezing funds and losing them for good.
How long does it usually take to recover money frozen by the cyber cell?
There is no fixed timeline. If the destination account is frozen quickly, the bank and the police will still need to verify the fraud, file a charge sheet, and then apply to the court for release of the frozen amount to the victim. This can take anywhere from three months to over a year. If the scammer contests the freezing, it may take longer. Patience and persistent follow-up with the investigating officer are necessary.
Can the police actually trace the scammer through WhatsApp and bank accounts?
Yes, but it depends on the evidence trail. Mule accounts are often opened with fake or purchased KYC documents, and scammers route money through layers before withdrawing cash or converting to cryptocurrency. The investigating agency can use IP logs, mobile tower locations, and bank records, but if the trail crosses state borders or reaches unregulated wallets, tracing becomes slower and more difficult. A precise complaint with UTR numbers and account details makes the job far easier.
Should I hire a lawyer even if the cyber cell has registered my complaint?
It is strongly advisable, especially if the amount is significant or the local cyber cell is moving slowly. A lawyer who handles cyber fraud matters can file a complaint before the Magistrate to direct the police and the banks, push for account freezing under Section 106 BNSS, and coordinate with nodal officers. This does not guarantee recovery, but it creates pressure and a paper trail that often speeds things up.
What if the bank refuses to freeze the scammer's account or says it needs police orders?
Banks are required under RBI fraud monitoring guidelines to act on reported fraudulent transactions. If the bank refuses, escalate to the bank's nodal officer in writing, then to the Banking Ombudsman. Simultaneously, ask the cyber cell to issue a written direction to the bank under Section 106 BNSS. If the cyber cell is unresponsive, move a criminal complaint before the Jurisdictional Magistrate, who can direct the bank to preserve the funds pending investigation.
This article is for general information only and is not legal advice for your specific situation.
Advocate Sudhir Rao, Supreme Court of India
Facing a similar matter? Speak to a criminal advocate in Delhi — Advocate Sudhir Rao appears in bail, trial and appellate matters before the Delhi District Courts, the Delhi High Court and the Supreme Court of India.