Lost money to a UPI scam or facing online harassment? Here is how to navigate the portal, file an FIR, and escalate to the SP Cyber if the police do not act.
You wake up to a message saying ₹50,000 was debited from your account for a purchase you never made. Or maybe a friend DMs you a screenshot of a fake profile using your face to solicit money from your followers. You do what everyone suggests: you call the helpline and log onto the National Cyber Crime Reporting Portal. But then... silence. Most people stop there, thinking the system is broken. But the law has a specific ladder for these situations. If the local station is "investigating" for weeks with zero updates, it is time to move up the chain to the SP Cyber. Here is how to make the system move.
Cybercrime in India is governed by two main sets of laws: the Information Technology (IT) Act, 2000 and the Bharatiya Nyaya Sanhita (BNS), 2023 (which replaced the IPC). When you report a crime, you aren't just "giving a tip"; you are initiating a legal process under Section 173 of the Bharatiya Nagarik Suraksha Sanhita (BNSS), which deals with the registration of FIRs.
For financial frauds, the Ministry of Home Affairs (MHA) operates the Citizen Financial Cyber Fraud Reporting and Management System. The logic is simple: speed. If you report within the "Golden Hour" (the first 2 hours), the system can trigger a "freeze" across the banking ecosystem to stop the fraudster from withdrawing your money.
However, the biggest hurdle is often getting a "complaint" converted into an "FIR." Many local police stations might accept your paper and give you a stamp, but they won't officially register it in their books. This is where Section 173(4) of the BNSS (formerly Section 154(3) of the CrPC) comes in. It states that if an officer in charge of a police station refuses to record your information, you have the legal right to send the substance of that information, in writing and by post, to the Superintendent of Police (SP).
If the SP is satisfied that the information discloses a cognizable offence (a serious crime where they can arrest without a warrant), they must either investigate it themselves or direct a subordinate to do so. In the context of cybercrime, every state now has a dedicated SP Cyber or a DCP Cyber whose job is specifically to oversee these technical investigations.
While the law doesn't explicitly state a daily countdown for every step, the MHA guidelines and various judicial precedents suggest that a preliminary inquiry should ideally be completed within 14 days. If your case is stuck in "Pending" status on the Cyber Crime reporting portal for longer than that, the law considers it a failure of duty.
If you have lost money to a digital scam, every minute counts. The fraudster is likely moving the money through a chain of "mule" accounts.
Go to the official Cyber Crime reporting portal at cybercrime.gov.in.
An online acknowledgement is a record, but it is not an FIR.
Once your complaint is lodged, it is assigned to an Investigating Officer (IO).
This is the formal legal move when the local station is unresponsive.
If you still aren't getting a clear answer on why your case is stalled, use the Right to Information Act.
If even the SP Cyber fails to provide a resolution after 30 days of your letter.
The system looks great on paper, but in reality, your complaint can get stuck in several "black holes." Here is how to spot them and push through:
The "Entry in Diary" Trap: When you go to the local station, the officer might give you a stamped copy of your complaint and say, "Ho gaya" (It's done). This is often just an entry in the General Diary (GD), not an FIR. An FIR (First Information Report) is a legal mandate to investigate; a GD entry is often just a record that you showed up.
The Jurisdiction Ping-Pong: Cops might tell you, "The transaction happened in Bengaluru, go file there," or "This is a technical matter, go to the District HQ."
The "Pending" Portal Status: You filed on cybercrime.gov.in, but the status hasn't moved from "Pending" for 3 weeks.
Evidence Disappearance: If you don't save the URL of a fake profile or the "header" of a phishing email, the police might claim they can't "trace" it.
Copy, fill in the [highlighted] bits, and send.
"Hello, I am calling to report a financial cyber fraud that happened [Number of minutes/hours] ago. My name is [Name] and ₹[Amount] was debited from my [Bank Name] account ending in [Last 4 digits]. The transaction ID is [Transaction ID]. The money was sent to [UPI ID/Account Number of the fraudster]. Please initiate a 'freeze' on the recipient's account through the CFCFRMS portal immediately. My acknowledgement number for the portal is [if already filed]."
Use this if the local station hasn't filed an FIR within 14 days. Send this via Registered Post AD (Acknowledge Due)—the postal receipt is your legal proof of escalation.
To, The Superintendent of Police (Cyber Cell), [District Name], [State]
Date: [Today's Date]
Subject: Complaint regarding [Type of crime, e.g., Financial Fraud/Identity Theft] and failure of local station to register FIR.
Respected Sir/Ma'am,
I am writing to bring to your notice a cybercrime committed against me on [Date]. I filed a complaint on the National Cyber Crime Reporting Portal (Acknowledgement No: [Number]) on [Date].
Despite visiting the [Local Police Station Name] on [Date], no FIR has been registered under Section 173 of the BNSS. As per Section 173(4) of the BNSS, I am hereby submitting the substance of the information regarding this cognizable offence to your office.
Details of the incident:
I request you to kindly direct the registration of an FIR and initiate an investigation into this matter.
Yours faithfully, [Your Name] [Your Phone Number] [Your Address]
If the SP's office also stays silent for 30 days, file an RTI on rtionline.gov.in to the "Public Information Officer (PIO) - [Your District] Police."
Text for RTI: "Regarding my cybercrime complaint dated [Date] (Ref No: [Portal Ack No]) and my subsequent letter to the SP Cyber dated [Date of Registered Post], please provide the following information:
No. Filing a complaint on the portal or an FIR at a police station is absolutely free. If any official asks for a "processing fee" or "investigation charges," they are asking for a bribe. You can report this to the Anti-Corruption Bureau (ACB) of your state.
On the cybercrime.gov.in portal, you can report "Women/Child related crime" anonymously. However, for financial frauds or other crimes, you must provide your details so the police can contact you for evidence and the bank can process refunds.
A mule account is a bank account belonging to an innocent person (often students or low-income individuals) that criminals use to "wash" stolen money. If you report quickly (the Golden Hour), the police can freeze the money in the mule account before the criminal withdraws it in cash.
No. While sharing an OTP makes you vulnerable, it does not make the theft legal. The act of stealing money through deception is still a crime under **Section 318 (Cheating) of the BNS** and **Section 66D of the IT Act**. The police are legally bound to investigate the person who received the money.
If it is a financial fraud, you should follow up every 48 hours. For non-financial crimes (harassment, identity theft), if there is no "Action Taken" update on the portal or no FIR copy provided within 14 days, escalate to the SP Cyber immediately.
Yes. You should still file the report in India. Indian agencies work with Interpol and international service providers (like Meta or Google) through Mutual Legal Assistance Treaties (MLATs) to get data, though this process is slower.
RTI templates, FIR scripts, real escalation ladders — the same kind of thing you just read. Sundays only. No spam.
We don't share your email. Unsubscribe any time.
Learn how pink autos and women-only transport schemes work in India, how to verify safe rides, and what to do if the safety features fail.
Getting harassed by recovery agents? Learn how to report illegal loan apps to the RBI and Cyber Cell under the BNS and RBI Digital Lending Guidelines.
Someone sharing your photos without consent? Learn how to use the IT Rules 2021 to force platforms like Instagram or X to take down harmful content within 24 hours.
Is your sibling's school bus a rickety death trap? Learn the mandatory Supreme Court safety rules and how to force your school to follow them.