19:20 at the cyber desk: four UPI debits and a son who wants the app deleted

1. Start the clock now, in writing. Note the time she entered and the four transaction times. Everything below is time-stamped against this.
2. Get the money stopped before anything else. Call the 1930 national cyber-fraud helpline / file on the citizen portal immediately, and separately call the bank's 24-hour fraud line to report unauthorised transactions and ask for the account to be frozen or a lien put on the recipient accounts. Record the complaint or acknowledgement numbers - an unacknowledged call counts for nothing later.
3. Then take the complaint. Prepare the written complaint with the four amounts, the UPI reference numbers, the beneficiary handles, the caller's number and the app name; register the FIR for cheating (BNS, 2023, the provision replacing IPC 420) read with S.66C and 66D of the IT Act, since identity was misused and impersonation was used to cheat.
4. Do not format or wipe the phone. Seize it under a seizure memo with her consent, or take a forensic image and return it; issue her a written acknowledgement.
5. Inform the bank in writing and advise her to check the account daily from another device. Order matters because the money leaves in layers within minutes.

Uninstalling the app destroys the single most valuable link in the case: the installed package connects her device to the remote session, and the app's registration details can lead to the infrastructure the fraudster used. Deleting the chat destroys the only copy of the lure link and the sender's number. There is no server-side copy the police can pull once it is gone, so 'to be safe' produces the opposite result.

Each item carries distinct value: the WhatsApp chat gives the sender's number, the link, and timestamps; the remote-support app gives the package name, version, login/registration data and session logs; SMS alerts give OTP receipt times, which can be matched against the debit times to prove unauthorised access; the call log gives the caller's number and call duration; the UPI reference numbers in the bank statement are what the bank and NPCI use to trace the beneficiary. Preserve by taking screenshots with visible timestamps, noting the IMEI and model, and recording a hash or at least a signed inventory before the device leaves her hands. If she needs the phone back, image it and return it under acknowledgement.

Answer both honestly, without promises. On the bank: an unauthorised electronic transaction is governed by the RBI's customer-protection framework on limited liability, under which reporting promptly - broadly, within three working days - generally gives the customer zero liability when the deficiency is not his own, while delay can shift part of the loss to the customer. Here she both disclosed OTPs and installed the app, so her case is not the textbook zero-liability case; the bank will decide, and the outcome depends on the exact transaction type, the reporting time and the bank's investigation. The constable's job is to record the exact time she reported and to forward the complaint, not to assure recovery.

On the agent: refuse and warn her. Recovery agents who call fraud victims are usually a second fraud, using the details from the first; no legitimate agency charges an advance fee to reverse a UPI transaction, and no one other than the bank or the police has any power to trace or freeze the money. Tell her the only numbers to deal with are 1930, the bank's published fraud line and the investigating officer, and record this warning in the complaint so the follow-up fraud, if it happens, is documented.