If an Online Scam Takes Your Money, What Should You Do in the First 30 Minutes?

Discovering an unexpected payment or a convincing fake customer-service call can leave anyone confused. The first objective is not to identify the criminal or recover the money on your own. It is to stop further transfers, tell the bank what happened and preserve the information investigators may need. In India, victims of cyber financial fraud can call 1930 and use the National Cyber Crime Reporting Portal. Acting quickly can help, but no response time guarantees recovery.

Minute zero: stop the contact

End the call or message exchange with the suspected scammer. Do not follow another payment link, share a one-time password or install a screen-sharing app. If you are uncertain whether a genuine bank employee is speaking, hang up and contact the bank through the number on your card or its official app. Do not call the number sent in a suspicious message. Even a caller who knows your address, employer or partial account details has not proved their identity.

The next few minutes: secure your accounts

Open your banking app from a trusted device and examine the transaction amount, recipient, time and reference number. If an unknown transfer has happened, use the bank’s fraud-reporting channel immediately. Ask whether an account, card or payment instrument should be blocked and follow its guidance. If a phone or remote-access app may be compromised, stop using that device for banking until it is secured. Change important passwords from a device you trust and protect your email account because it can be used for password resets.

Report the payment, not just the suspicious conversation

When reporting, describe the actual transfer and the method used. A fake investment scheme, marketplace refund, job offer and impersonated police call may look different, but the bank needs the transaction trail. Note the date, approximate time, amount, bank or wallet, and payment reference. The emergency financial-fraud helpline in India is 1930; the national portal also provides reporting and tracking. Treat any complaint acknowledgment as a record to keep, not proof that money has been returned.

Preserve evidence without forwarding the scam

Save screenshots of payment details, phone numbers, chat histories, emails, QR codes and any website address. Keep original messages when practical, because timestamps and sender details can help reconstruct events. Make a simple timeline: what you saw, whom you contacted, which information you shared and when money moved. Avoid posting your entire bank statement or identification documents on social media while asking for help. Protect your personal data even while seeking advice.

What if you only shared information?

A suspected scam does not always involve an immediate debit. If you entered a password on a fake site, change it on the genuine site and review active sessions. If you shared card information, ask your card issuer whether replacement or blocking is appropriate. If you shared a one-time password or approved a collect request, report that precisely. Do not assume that deleting the fake application has reversed any permissions it previously received. Review device settings and connected accounts.

How to avoid the second scam

People who have already lost money are sometimes targeted again by strangers promising recovery for an advance fee. Be wary of messages claiming to represent an investigator, regulator or specialist recovery agency. Do not pay a processing charge or tax simply because someone claims to have located your funds. Use a verified case number and the institution’s official channels for updates. Scammers may copy official names, seals or photographs; an impressive-looking document does not establish authenticity.

What the official figures really say

A July 2026 Ministry of Home Affairs response said the financial cyber-fraud response system had helped save over Rs 11,158 crore across more than 32.8 lakh complaints by June 30, 2026. This is a system-wide reported figure, not an individual recovery probability. It also cannot tell you whether your particular transfer can be traced or stopped. The useful lesson is that official reporting channels exist and can coordinate with financial institutions. Every case still depends on its facts and timing.

A short checklist for families

Write down the bank’s official fraud number before an emergency and show older relatives how to find it. Explain that receiving money does not require entering a UPI PIN. Practice recognising unsolicited remote-support requests and urgent demands to keep a conversation secret. Keep transaction alerts enabled. A family member who feels embarrassed may delay telling anyone; a calm, practical response makes it easier to collect accurate details and report quickly.

The bottom line

The safest first-half-hour plan is simple: disconnect from the scammer, secure the payment account, contact the bank, report through 1930 or the official portal and save evidence. Do not let the scammer set the pace of your response. Focus on verified channels rather than miracle recovery promises. Once the immediate risk is controlled, document the case and keep copies of each response. Fast action may improve the chance of intervention, but it is never a guarantee.

Questions readers often ask

Can a bank promise a refund?

No blanket refund can be promised from the fact that a complaint was filed. Ask the bank for its dispute and complaint process, save the reference, and follow up using that number.

Should I confront the recipient?

Avoid threats or direct confrontation. Report the payment reference through official channels so investigators and payment institutions can examine the trail.

A practical example

Consider a person who buys a used phone through a marketplace listing. The seller claims that a courier requires an extra deposit, and the buyer approves a payment request. The buyer notices the recipient name does not match the seller. Rather than sending more money to secure delivery, the buyer should contact the bank, report the suspect transaction and preserve the listing, the chat and the payment reference. The example illustrates why the transaction details matter more than the scammer’s explanation.

Is a screenshot enough?

A screenshot helps, but the bank reference, date, amount and original messages make the record more useful.

After the immediate response

Continue monitoring alerts for follow-on charges or suspicious account changes. Make notes after each contact with the bank or reporting portal, including who answered and what reference they provided. If the incident involved stolen credentials, check other accounts where the same password was reused. Consider warning people in your household about impersonation attempts, but avoid circulating the attacker’s message as if it were a genuine notice. The records you save should make it easier to explain the timeline clearly without reconstructing it from memory weeks later.