The KYC Call and the ₹85,000 That Left in Four Hours
A woman teacher, 41, comes to your police station at 4:15 p.m. She says that at about 11:30 a.m. a man claiming to be from her bank's 'KYC verification cell' called and told her to install a remote-support app. She did, and within minutes received three SMS alerts: ₹35,000, ₹30,000 and ₹20,000 debited from her savings account through UPI to three different handles. She has the SMS alerts, but she has not saved the caller's number. The app is still installed and the phone is switched on. She is agitated, and says a man has already called her offering to 'recover' the money for a 10% fee if she transfers ₹8,000 in advance. She has her passbook and Aadhaar. The branch is 7 km away and closes at 5 p.m. The total loss is ₹85,000 out of a balance that was ₹1.1 lakh.
1. Set out what must be done in the next 60 minutes, in order, with the reason for each step.
Read the worked answer
1. Call 1930 and file on the national cybercrime portal immediately - before anything else. This is the golden hour. The report generates a request to the bank and to the payment network to freeze the beneficiary accounts. Every minute the money is in motion; once it is layered through mule accounts and withdrawn, recovery is largely theoretical.
2. Do not reset, format or hand over the phone, and do not let the app be uninstalled. The remote-support app is the instrument of the offence; it carries the session logs, the installed package name and timestamps. Screenshot the SMS alerts, the app details and the call log; note the IMEI, the SIM number and the handset model. If the phone must be sent for examination, seize it under a proper seizure memo and give her a receipt.
3. Move on the bank in writing. The branch closes at 5 p.m., so send a written request - under Section 91 CrPC or the standard request generated by the 1930 complaint - to the branch and to the bank's nodal officer asking for the beneficiary account details and UPI handles behind the three debits, for a lien on those accounts, and for her own account statement. Record the acknowledgement number.
4. Register the case. The information discloses a cognizable offence. If the district has a cyber police station, register and transfer; otherwise register a Zero FIR and route it to the cyber cell, and note in the case diary the reason for the transfer.
5. Warn her about the 'recovery agent'. This is a second, predictable fraud aimed at the same victim. She must not transfer ₹8,000, and that call itself should be noted and, if the number is available, investigated.
Keep her informed at each step; a victim who feels abandoned stops cooperating by the time the charge sheet is due.
2. Which penal provisions fit this conduct, and why would you choose one over another?
Read the worked answer
Core provisions:
- Cheating - Section 318 BNS (earlier Section 420 IPC). The caller induced her to install the app and to part with money by deception. Section 318(4) covers cheating and dishonestly inducing delivery of property. This is the offence that describes what actually happened to her.
- Section 66D, IT Act - cheating by personation using a computer resource. The impersonation of a bank officer was carried out through a phone and an app, which is precisely the conduct this section targets. It sits alongside the cheating provision rather than replacing it.
- Section 66C, IT Act - identity theft. Fitting where the fraudster used the bank's identity, or a customer's credentials, as a unique identifier to pass himself off.
- Section 66, IT Act - if unauthorised access to her device or account is established by the forensic examination.
- Section 505 IPC / IT Act provisions on false content only if there is a separate impersonation or fake-handle element; do not add it merely to make the FIR look heavy.
Why not pile on sections: the charge must match what the evidence can prove. At this stage the provable facts are: a call, an app installed, three UPI debits. Sections that depend on facts not yet in hand - fake SIM, forged documents, organised mule network - should be added when the bank and telecom records establish them, by way of a supplementary charge.
Evidence point: the electronic record - SMS alerts, app logs, bank statement - needs the electronic-evidence certificate (Section 65B of the Indian Evidence Act, now carried into the Bharatiya Sakshya Adhiniyam) at the time of collection, not at the time of trial. Missing certificates are the commonest reason these cases fail.
3. Advise her on liability and recovery, including what the bank is likely to say and where the law actually stands.
Read the worked answer
What she should do:
- Keep the 1930 acknowledgement number and the written complaint copy. Write to the branch the same day, with acknowledgement, stating that the transaction was unauthorised and reported within hours.
- Do not pay the 'recovery agent'. Do not reinstall anything at the instruction of an unsolicited caller, including someone claiming to be from the bank or the cyber cell.
- Keep the phone and records intact until the investigation reaches them; a factory reset destroys her own case.
Where the law stands: under the RBI's 2017 circular on limiting customer liability in unauthorised electronic banking transactions, a customer who reports within three working days has zero liability, provided the fraud was not due to her own negligence. She reported within about five hours, so she is inside that window and should demand a full credit.
What the bank will say: that she installed the app and effectively authorised the session herself - a negligence argument. That is a genuine grey area, not a formality; remote-access fraud sits awkwardly between 'unauthorised' and 'induced'. The practical reply is that she was deceived by impersonation, not careless with a credential, and that the debit was never authorised by her.
If the bank refuses: escalate in writing; if unresolved within 30 days, approach the RBI Ombudsman under the 2021 integrated scheme. The FIR is also needed as supporting material for the bank and for any insurance claim.
Be honest about recovery: if the beneficiary accounts were frozen in time, a substantial part can return; if the money has already been withdrawn, recovery may be nil or partial. Promising full refunds at the counter creates a complaint against the police later.