Cyber Crime Case in Bihar 2026: How to Report Online Fraud, Recover Money, Preserve Evidence and Defend an FIR

Direct Answer: If money has been lost through an online fraud, UPI transaction, fake investment platform, digital-arrest scam, impersonation call, remote-access application or fraudulent bank transfer, immediately call the National Cyber Crime Helpline at 1930, report the incident through the National Cyber Crime Reporting Portal, inform the concerned bank or payment service provider and preserve every transaction and communication record.

Do not delete messages, uninstall applications, reset the phone or continue communicating with the fraudster merely to recover the money privately.

If you have instead received a cyber-police notice, your bank account has been frozen, your mobile or computer has been seized, or your name appears in a cybercrime FIR, obtain the complaint, transaction trail and available police documents before giving a detailed explanation. Cybercrime cases are usually document-sensitive and may involve several victims, layered bank transfers, mule accounts, electronic devices, IP records and transactions across different States.

This guide explains the immediate steps for cybercrime victims, the complaint and money-restoration process, preservation of digital evidence, common offences and the legal preparation required when a person is accused or a bank account is linked to an online-fraud investigation.

Legal Advisory Snapshot

Subject: Online fraud, cybercrime complaint, money restoration and criminal defence in Bihar
Emergency Financial-Fraud Helpline: 1930
Official Reporting Platform: National Cyber Crime Reporting Portal
Common Laws: Information Technology Act, Bharatiya Nyaya Sanhita and Bharatiya Nagarik Suraksha Sanhita
Common Offences: Identity theft, cheating by personation, online cheating, forgery, use of forged electronic records, intimidation and unlawful access
Common Evidence: Transaction ID, bank statement, UPI ID, telephone number, email, URL, chats, screenshots, audio, device records and complaint acknowledgement
Common Defence Issues: Account ownership, beneficial receipt, transaction knowledge, account control, negligence, commission, withdrawal, device use and participation in conspiracy
Main Practical Rule: Act immediately, preserve the original evidence and maintain one consistent chronology

What Is Cyber Crime?

Cyber crime broadly refers to unlawful activity committed through or involving a computer, mobile phone, communication device, digital platform, bank account, payment application, social-media account, email service or electronic network.

In many cases, technology is used as the means of committing an ordinary offence such as cheating, impersonation, intimidation, forgery or extortion. In other cases, the offence directly concerns unauthorised access, misuse of passwords, identity theft, data theft or electronic records.

Common Cyber Crime Complaints in Bihar

UPI and QR-code fraud;
Fake customer-care fraud;
Digital-arrest and police-impersonation scams;
Investment, trading and cryptocurrency fraud;
Part-time-job and task-completion fraud;
Loan-application harassment;
Credit-card and debit-card fraud;
SIM-swap and OTP fraud;
Identity theft and misuse of Aadhaar or PAN details;
Social-media account hacking;
Fake Facebook, Instagram or WhatsApp profile;
Email-account compromise;
Business-email and invoice-manipulation fraud;
Online marketplace and e-commerce fraud;
Dating, matrimonial and romance scams;
Sextortion and online blackmail;
Cyber stalking and online harassment;
Online gaming and betting-related fraud;
Fake property, travel or hotel booking; and
Bank-account freezing due to receipt of disputed cyber-fraud funds.

What to Do in the First 30 Minutes After Online Financial Fraud

Call 1930 immediately.
Inform your bank or payment application.
Request blocking or marking of the disputed transaction.
Register the complaint on the National Cyber Crime Reporting Portal.
Preserve the complaint acknowledgement number.
Record the transaction ID, amount, date and exact time.
Save the fraudster’s mobile number, UPI ID, account number, email and URL.
Change compromised passwords from a secure device.
Block cards or internet banking if credentials were exposed.
Do not make another payment to recover the first payment.

Speed is important because fraud proceeds may move through several accounts within a short period. A complaint does not guarantee recovery, but delay can reduce the practical possibility of identifying or holding the available amount.

How to Report Cyber Financial Fraud Through Helpline 1930

Keep the following information ready before or during the call:

Your name and mobile number;
Name of your bank or payment application;
Account number or wallet details;
Transaction amount;
Date and time of transaction;
Transaction or UTR number;
Fraudulent account number or UPI ID;
Mobile number used by the fraudster;
Brief description of how the fraud occurred; and
Whether further unauthorised transactions are continuing.

Write down the acknowledgement or reference number given during the reporting process. Use the same reference consistently in later communication with the portal, police, bank and court.

How to File a Complaint on the National Cyber Crime Reporting Portal

The portal provides separate reporting options for financial fraud, other cybercrime and specified offences relating to women and children.

The complaint should clearly state:

How the fraudster first contacted the victim;
What representation or threat was made;
Why the victim trusted or acted upon it;
What money, credentials or documents were transferred;
Each transaction in chronological order;
Identifiers used by the fraudster;
Steps taken after discovering the fraud; and
The relief or action requested.

Upload legible records. Do not upload cropped screenshots that remove the date, time, sender, receiver or transaction details.

Online Complaint and FIR Are Not the Same Record

An online cybercrime complaint is an official complaint record, but it should not automatically be assumed that an FIR has already been registered.

Depending on the facts and police assessment, the matter may proceed through:

Preliminary verification;
Collection of bank and platform information;
Marking or holding of disputed funds;
Registration of an FIR;
Transfer to the appropriate police station or State;
Investigation involving several jurisdictions; or
Closure or further-information request.

The complainant should track the acknowledgement and obtain the FIR number if and when an FIR is registered.

Use of the Suspect Repository

The National Cyber Crime Reporting Portal provides a search facility through which citizens may check identifiers such as:

Mobile number;
Email address;
Bank-account number;
UPI ID;
Social-media account;
Website URL; and
Application or online-platform identifier.

The result should be treated as an alert or due-diligence input, not as a final legal finding. The repository is based on complaints and does not itself establish that a person has committed an offence.

How Cyber-Fraud Money Restoration May Work

Where a reported amount is successfully put on hold and the bank identifies an amount available for restoration, the victim may receive an SMS or email concerning the official Money Restoration Portal.

The victim may then be required to:

Enter the 14-digit NCRP acknowledgement number;
Verify the registered mobile number through OTP;
Confirm the refund-account information;
Provide PAN details;
Upload a court order where applicable;
Execute the required undertaking or indemnity; and
Preserve the separate restoration-request number.

Do not trust a private link sent through WhatsApp merely because it uses the words “cybercrime refund.” Verify that any restoration communication belongs to an official Government of India portal.

Current Money-Restoration Threshold Guidance

The official Money Restoration Portal FAQ presently explains that, under the applicable standard operating procedure, where the amount put on hold in a particular bank is below ₹50,000, restoration may proceed through police instructions without an FIR, subject to the prescribed conditions.

Where the amount put on hold in a particular bank account exceeds ₹50,000, the FAQ states that an FIR is required for restoration through that process.

This is procedural guidance and may be updated. The complainant should follow the current portal instructions and directions of the investigating officer or jurisdictional court.

What Digital Evidence Should a Victim Preserve?

Complete bank statement;
Transaction receipt and UTR number;
UPI or payment-application history;
Fraudulent QR code;
Mobile number and call log;
WhatsApp, Telegram, SMS or social-media chats;
Email with complete header where available;
Website and application URL;
Username and profile link;
Screen recording or screenshots;
Audio and video communication;
Fake appointment, investment or refund letter;
Remote-access application details;
Complaint acknowledgement;
Bank complaint and reply;
Police complaint and FIR;
Device purchase and SIM ownership records; and
A date-wise written chronology.

How to Preserve Screenshots Correctly

A screenshot should, where possible, display:

Name or identifier of the other party;
Mobile number or profile URL;
Date and time;
Full conversation context;
Transaction request or threat;
Platform name; and
Relevant message immediately before and after the disputed message.

Preserve the original device and original application data. A screenshot alone may not contain every technical detail needed for investigation or proof.

Do Not Delete or Reset the Device

After discovering fraud, victims sometimes delete chats, uninstall applications or factory-reset the device out of fear.

This may destroy useful evidence concerning:

Communication history;
Downloaded files;
Application installation;
Remote-access permissions;
Login alerts;
Browser history;
Device identifiers; and
Exact sequence of events.

Secure the device, change essential passwords through another safe device where required and preserve the original data.

UPI, QR-Code and Payment-Application Fraud

UPI fraud may involve:

Fake collect request;
QR code represented as a refund mechanism;
Screen-sharing or remote-access application;
Fake customer-care number;
OTP or UPI-PIN disclosure;
SIM replacement or account takeover;
Merchant-payment manipulation; and
Fraudulent reversal or cashback representation.

Entering a UPI PIN generally authorises a debit, not receipt of money. A person claiming that a PIN is required to receive a refund should be treated with caution.

Digital-Arrest and Police-Impersonation Fraud

In digital-arrest fraud, the victim may receive a call or video call from persons falsely claiming to be police, CBI, customs, narcotics, cybercrime, court or banking officers.

Common features include:

Claim that a parcel, SIM or bank account is linked to crime;
Threat of immediate arrest;
Direction to remain continuously on video call;
Display of fake warrant or official letter;
Demand to transfer money into a “safe account”;
Instruction not to contact family or lawyer; and
Use of uniform, emblem or fake office background.

No lawful investigation requires a citizen to transfer personal money into a private “safe account” to prove innocence.

Investment, Trading and Cryptocurrency Fraud

Fraudulent investment platforms may initially display artificial profits or permit a small withdrawal to build trust. Later, the victim may be asked to pay additional tax, commission, security deposit or unlocking charges.

Preserve:

Application and website details;
Promotional advertisements;
WhatsApp or Telegram group information;
Names of group administrators;
Bank and cryptocurrency-wallet addresses;
Trading dashboard screenshots;
Deposit and withdrawal history;
False profit statements; and
Every demand for additional payment.

Job, Task and Work-from-Home Fraud

A common pattern involves small payments for initial tasks followed by larger demands for prepaid tasks, account activation, tax, negative-balance correction or withdrawal release.

Do not assume that receiving one small commission proves that the platform is genuine.

Social-Media Hacking and Fake Profiles

If a social-media account is compromised:

Use the platform’s official recovery process.
Change the linked email and banking passwords.
Enable two-factor authentication.
Inform contacts that the account has been compromised.
Preserve profile URLs and fraudulent messages.
Report the fake or hacked profile to the platform.
File a cybercrime complaint where the account is used for fraud, impersonation or blackmail.

Sextortion and Online Blackmail

A victim may be threatened with publication of intimate images, edited videos, private chats or fabricated content.

The victim should:

Stop making payments;
Preserve the threat and account identifiers;
Block further unauthorised access;
Report the profile and content to the platform;
File a cybercrime complaint promptly;
Inform a trusted person where personal safety is affected; and
Seek immediate police protection where threats extend beyond online communication.

Repeated payment rarely guarantees deletion of the material and may lead to escalating demands.

Business Email and Invoice Fraud

Businesses may receive an altered invoice or email directing payment into a new account controlled by the fraudster.

The business should preserve:

Original and fraudulent invoices;
Complete email headers;
Domain spelling;
Previous legitimate account details;
Payment-authorisation records;
Internal approval trail;
Bank-transfer details; and
Communication with the genuine supplier.

Important Cybercrime Legal Provisions

Information Technology Act Section 66C

Section 66C concerns fraudulent or dishonest use of another person’s electronic signature, password or other unique identification feature.

Information Technology Act Section 66D

Section 66D concerns cheating by personation through a communication device or computer resource.

BNS Cheating and Personation Provisions

Depending on the facts, allegations may involve cheating, dishonest inducement to deliver property and cheating by pretending to be another person.

Forgery and False Electronic Records

Use of fabricated letters, digital records, certificates, screenshots, account documents or electronic records may attract provisions concerning making false documents, forgery and use of forged documents or electronic records.

The correct sections depend on the actual conduct, date of occurrence and evidence. A complaint should not mechanically list every possible provision.

Which Police Station Has Jurisdiction?

Cybercrime frequently involves several locations:

Place where the victim received the communication;
Place where the victim transferred the money;
Place where the fraudulent account was maintained;
Place where the accused operated the device;
Place where the money was received or withdrawn; and
Place where the electronic communication originated.

BNSS contains specific jurisdictional provisions for offences involving electronic communications and cheating. In multi-State cases, police units may coordinate or transfer records according to the information available.

What If Your Bank Account Is Frozen in a Cybercrime Case?

A person may discover that the account is frozen because it directly or indirectly received money connected with a cybercrime complaint.

Immediate steps include:

Obtain the bank’s written freeze or lien information.
Identify the police station, complaint or FIR reference.
Obtain the disputed transaction details.
Prepare the lawful source and purpose of the transaction.
Identify whether the amount came from a customer, employer, buyer, friend, platform or intermediary.
Preserve invoices, chats, delivery proof, contracts and tax records.
Do not transfer or withdraw funds in violation of the hold.
Submit a transaction-specific representation before the investigating authority.
Consider limited or complete de-freezing relief before the competent court where necessary.

A general statement that the account holder is innocent may not be enough. The explanation should match each disputed credit and subsequent debit.

What Is a Mule Bank Account?

A mule account is commonly understood as an account used to receive, layer, transfer or withdraw fraud proceeds for another person.

An account holder may face investigation where:

The account was sold, rented or shared;
ATM card, SIM or internet-banking access was handed over;
Commission was received for moving money;
Large credits were immediately withdrawn;
Multiple unrelated victims transferred funds;
False business records were created; or
The account holder cannot explain the transactions.

Claiming that the account was merely lent to another person does not automatically eliminate criminal exposure. Knowledge, intention, control, benefit and conduct must be examined.

What to Do After Receiving a Cyber-Police Notice

Verify the police station, officer and case reference.
Read whether appearance, documents or device production is required.
Identify the transaction or account under inquiry.
Prepare a date-wise chronology.
Collect bank, business and communication records.
Do not delete or alter electronic evidence.
Do not give speculative answers.
Disclose earlier statements or notices to your lawyer.
Assess arrest risk and bail requirements.
Seek a written adjournment with proof if attendance is genuinely impossible.

Can Police Seize a Mobile Phone or Computer?

During investigation, police may seek or seize devices believed to contain relevant evidence, subject to applicable law and procedure.

The person should preserve:

Seizure list or memo;
Device make, model and serial number;
SIM and memory-card details;
Date and time of seizure;
Condition of the device;
Copies of essential business data where lawfully available; and
Applications filed for return or access where necessary.

Do not remotely wipe, lock or alter a seized device.

Cyber Crime Bail and Arrest Protection

The appropriate bail remedy depends on:

Sections invoked;
Amount and number of victims;
Specific role of the applicant;
Control over bank account or device;
Receipt of commission or benefit;
Withdrawal or transfer of funds;
Recovery requirements;
Criminal antecedent;
Cooperation with investigation; and
Risk of evidence tampering or absconding.

Anticipatory bail may be considered before arrest where legally maintainable. Regular bail is sought after arrest or surrender.

Can a Cybercrime FIR Be Quashed?

Quashing may be examined where:

The allegations do not disclose the necessary offence;
The accused has no specific role;
The account or transaction was linked through an identifiable lawful transaction;
The proceeding is based on an apparent identity error;
A predominantly private dispute has been lawfully settled;
A legal or jurisdictional bar exists; or
Continuation would amount to abuse of court process.

Quashing is exceptional. Disputed questions concerning knowledge, conspiracy, device control or transaction benefit may require investigation or trial.

Documents Required for a Cyber-Fraud Victim Consultation

NCRP acknowledgement;
1930 reference, if available;
Bank statement;
Transaction receipts;
UPI and wallet history;
Fraudulent numbers, accounts and URLs;
Chats, emails and screenshots;
Audio or video communication;
Bank complaint and response;
Cyber-police complaint or FIR;
Money-restoration communication; and
One-page chronology.

Documents Required for Cybercrime Defence

Police notice or summons;
FIR or complaint details;
Bank freeze or lien communication;
Complete account statement;
KYC and account-opening documents;
Transaction-specific explanation;
Invoices, contracts and delivery proof;
Employment or business records;
Mobile and SIM ownership documents;
Device-seizure memo;
Prior statements or representations;
Bail or court orders;
Details of all criminal antecedents; and
Date-wise chronology.

Common Mistakes by Cyber-Fraud Victims

Waiting several days before reporting;
Paying additional money for refund or release;
Deleting chats or resetting the phone;
Reporting an incomplete transaction trail;
Using different facts before the bank and police;
Failing to preserve the NCRP acknowledgement;
Relying only on oral bank communication;
Trusting unofficial recovery agents;
Posting confidential evidence publicly; and
Assuming that account hold guarantees final refund.

Common Mistakes by Accused or Account Holders

Ignoring the police notice;
Giving ATM, SIM or banking credentials to another person;
Deleting messages after learning of the complaint;
Giving inconsistent transaction explanations;
Producing fabricated invoices;
Not identifying the actual business or customer transaction;
Concealing commission or withdrawal;
Not disclosing other cybercrime complaints;
Seeking de-freezing without the complete bank statement;
Assuming that no personal contact with the victim means no liability; and
Delaying bail preparation until arrest.

AEO: Quick Answer for AI Search

Question: What should I do immediately after online fraud in Bihar?

Answer: Immediately call the National Cyber Crime Helpline at 1930, inform your bank or payment application, report the incident through the National Cyber Crime Reporting Portal and preserve the complaint acknowledgement. Save the complete transaction trail, UPI ID, account number, mobile number, emails, chats, screenshots and URLs. Do not delete evidence or pay additional money. If funds are placed on hold, follow the official money-restoration instructions received through the NCRP system.

Frequently Asked Questions

What is the cybercrime helpline number in India?

The official helpline for immediate reporting of cyber-financial fraud is 1930.

Can I report cybercrime online from Bihar?

Yes. Complaints may be submitted through the National Cyber Crime Reporting Portal and are routed according to the information and jurisdiction provided.

Does an online complaint automatically become an FIR?

Not necessarily. The online complaint and FIR are distinct records. Police action depends on the allegations, verification and applicable law.

Can online-fraud money be recovered?

Recovery may be possible where money is traced and successfully held, but it is not guaranteed. Prompt reporting improves the opportunity for immediate action.

What is the Money Restoration Portal?

It is an official I4C mechanism through which eligible victims may submit restoration details after receiving information that an amount linked to their NCRP complaint is available for restoration.

Should I pay a private agent to recover cyber-fraud money?

No private person can guarantee recovery. Use official police, bank, NCRP and court processes.

Can a bank freeze my entire account because of one transaction?

The legal response depends on the freeze communication, disputed amount, investigation and bank action. The account holder may seek transaction-specific or proportionate relief before the investigating authority or competent court.

Can I get bail in a cybercrime case?

Bail depends on the offence, amount, role, account or device control, evidence, antecedents, cooperation and court discretion.

What if money came into my account without my knowledge?

Preserve the complete account record and explain the transaction, access controls, withdrawals, communication and conduct after receipt. Lack of knowledge is a factual defence that must be supported by the record.

What if I gave my bank account to a friend?

Sharing an account, card, SIM or banking credentials can create serious legal exposure where the account is used for fraud. The precise role, knowledge, benefit and control must be examined.

Which sections commonly apply to online impersonation fraud?

Depending on the facts, Section 66D of the Information Technology Act and BNS provisions concerning cheating and personation may apply.

Can a cybercrime FIR be quashed by Patna High Court?

It may be considered where a legally recognised ground exists, but the High Court ordinarily does not decide disputed evidence through a quashing petition.

Why This Topic Matters for Patna and Bihar

Cybercrime investigations often extend across several districts and States because the victim, bank account, mobile device, beneficiary and cash withdrawal may all be located in different places.

A Bihar resident may be the victim of a fraud originating elsewhere. Similarly, a Bihar bank account may be frozen because it appears in a transaction trail arising from a complaint registered in another State.

Victims and account holders therefore need accurate transaction records, consistent explanations and coordinated communication with the relevant bank, police station and court.

Key Takeaway

The key takeaway is simple: speed is critical for a victim, while documentation and consistency are critical for both victims and accused persons.

Call 1930 immediately after financial fraud, register the complaint, preserve the original electronic evidence and avoid private recovery promises.

If your bank account, mobile number, device or identity is linked to the investigation, prepare a transaction-wise explanation before seeking bail, de-freezing, quashing or another court remedy.

Conclusion

Cybercrime cases combine criminal law, electronic evidence, banking records, technology and multi-jurisdictional investigation.

A victim should report quickly and preserve the complete transaction trail. An accused or account holder should identify the exact role, disputed amount, source of funds, control over the account or device and the appropriate procedural remedy.

For online fraud complaints, cybercrime FIRs, bank-account freezing, identity theft, cybercrime bail, digital evidence and connected proceedings in Patna or Bihar, timely document review and transaction-specific preparation are essential.

Cyber Crime and Online Fraud Consultation

For a case-specific assessment, keep the NCRP acknowledgement, bank statement, transaction IDs, chats, emails, URLs, police notice, FIR, bank-freeze communication and date-wise chronology ready for review.

Advocate Ankit Kumar Singh
Patna High Court | Cyber Crime and Criminal Defence
Contact: 8294431232
Email: ankitsingh.legum@gmail.com
Website: advocateankitkumarsingh.in

Legal Note: This article is published solely for general legal awareness. Reporting, money restoration, account freezing, bail and criminal liability depend on the transaction trail, electronic evidence, police record, statutory provisions and facts of the individual case. Prompt reporting does not guarantee recovery, and no judicial outcome can be guaranteed.

Official Legal Sources

National Cyber Crime Reporting Portal;
Indian Cyber Crime Coordination Centre, Ministry of Home Affairs;
Official Money Restoration Portal and current public FAQs;
Information Technology Act, 2000 — Sections 66C and 66D;
Bharatiya Nyaya Sanhita, 2023;
Bharatiya Nagarik Suraksha Sanhita, 2023 — electronic-communication jurisdiction provisions; and
Applicable electronic-evidence and banking procedures.