Short answer: If money has already left your account, call 1930 now and file at cybercrime.gov.in. The first hour is when a receiving bank can still freeze the funds. If no money has moved, report the number through Chakshu on sancharsaathi.gov.in. And no matter what the caller claims, no Indian agency conducts arrests, investigations, or verifications over a phone or video call. That single fact ends most of these scams before they start.

Everything below is the longer version: what the current scams look like, why they work on careful people, and what actually happens after you report.

How big is the problem, in numbers

Ministry of Home Affairs figures placed before Parliament put India's cyber fraud losses at ₹22,845 crore in 2024, up from ₹7,465 crore in 2023. That's a 206% jump in a single year. Complaints on the National Cyber Crime Reporting Portal went from 24 lakh to 36 lakh over the same period. [Source: Ministry of Home Affairs, reply in Parliament, July 2025, reported by Deccan Herald]

2025 held roughly flat on money and rose on volume: about ₹22,495 crore lost, with complaints up around 24%. Investment and trading frauds account for the bulk of the money, roughly three quarters of it. Digital arrest scams sit at 8 to 9% of total losses, which sounds small until you convert it: that's close to ₹2,000 crore a year taken from people over the phone by someone pretending to be a police officer. [Source: ThePrint, February 2026, citing MHA data]

The enforcement side has scaled too. I4C's suspect registry, built with banks, has taken in over 18 lakh suspect identifiers and 24 lakh mule account records, and has helped block fraudulent transactions worth ₹8,031 crore. The Citizen Financial Cyber Fraud Reporting and Management System, which is what 1930 plugs into, has saved ₹7,130 crore across 23 lakh complaints. India now has 459 dedicated cybercrime police stations, up from 169 in 2020. [Source: Ministry of Home Affairs, Lok Sabha reply, via ThePrint]

Read those two sets of numbers together and the conclusion is uncomfortable but useful: the system does recover money, but only for people who report fast.

The scams currently running

Digital arrest

A caller says they're from the police, the CBI, customs, the Narcotics Control Bureau, or the Enforcement Directorate. Your Aadhaar, your bank account, or a parcel in your name has been linked to a crime. They move you onto a video call, sometimes from a set built to look like a police station, with uniforms. You are told you are under "digital arrest" and must stay on camera and speak to nobody until the matter is cleared. Clearing it means transferring money for "verification."

Digital arrest is not a thing. It has no basis in any Indian law. The Indian Cyber Crime Coordination Centre has issued a public advisory saying plainly that police, CBI, customs, ED and judges do not arrest anyone over a video call. Anyone using the phrase is a criminal, and the phrase itself is the giveaway. [Source: I4C public advisory, reported by Deccan Herald]

The victims are not who you'd assume. A 78-year-old retired banker in South Delhi lost close to ₹23 crore over five weeks. A doctor in Maharashtra lost ₹7 crore. Retired defence personnel, professors, IT professionals. [Source: Deccan Herald] The scam is not a test of intelligence. It's a test of what happens to anyone's judgement after four hours of sustained fear.

The fake courier

Usually the opening act for the above. A call claiming to be from FedEx, DHL, BlueDart or India Post says a parcel booked in your name has been intercepted, containing drugs, fake passports, or expired currency. You're then "connected" to the police, and the digital arrest script takes over. In Mangaluru alone, courier and customs-themed digital arrest cases accounted for ₹7.1 crore of reported losses across 25 cases in one year. [Source: Mangaluru Police Commissionerate, via Deccan Herald]

KYC and account expiry

Your bank account, wallet, or SIM will be suspended today unless you verify. Sometimes it comes with a link, sometimes with an instruction to install an app so they can "help you complete it." The app is always a screen-sharing or remote access tool. Once it's running, they watch you type your PIN.

Banks do send KYC reminders. They do not threaten same-day suspension by phone, and no bank in India will ever ask you to install a remote access app.

Utility disconnection

Electricity or gas will be cut this evening unless you pay a small reconnection fee or call a number. The amount is deliberately trivial, a few hundred rupees, because the point is not the payment. The point is getting your card details or getting you onto a payment app they're watching.

The relative in trouble

A call saying your son, daughter, or parent has been in an accident, detained, or hospitalised, and money is needed immediately. This one has changed character in the last eighteen months, because the voice on the line now often sounds exactly like the relative.

Current consumer-grade cloning tools need only a few seconds of clean audio, which is available in any Instagram reel, wedding video, or forwarded voice note. Reporting in August 2026 put the figure at 83% of people in India who encountered an AI voice scam going on to suffer a financial loss. [Source: Media India, August 2026] The technology is cheap, the audio is public, and there is no app setting that fixes this.

Why these work on careful people

Every one of these scripts is built on the same three-part machinery, and recognising the machinery is more durable than memorising the scripts, because the scripts change every few months.

The first part is manufactured authority. A uniform, a badge number, an FIR number, a case reference, a call that appears to be transferred to a senior officer. None of it is verifiable in the moment, and it isn't meant to be. It's meant to move you into a compliant posture within the first ninety seconds.

The second part is time compression. You have until 5pm. The account will be frozen tonight. The arrest warrant is being issued now. Real institutions run on days and written notices. Fraud runs on minutes, because a person who has fifteen minutes to think will make a phone call to someone else and the whole thing collapses.

The third is enforced isolation. Do not tell your family, this is a confidential investigation. Do not hang up, we are recording. Stay on video. This is the single clearest marker, and it's worth teaching to parents as a standalone rule: any caller who tells you not to talk to anyone else is running a fraud. There are no exceptions to this.

The tells, in order of reliability

Nobody legitimate demands silence. If a caller instructs you not to consult your family, your bank, or a lawyer, the call is fraudulent. This is the most reliable single test available.

Money never moves toward an investigator. There is no legal process in India where you transfer money to a "safe account" to demonstrate innocence. Not bail, not verification, not a security deposit. If a payment is being requested by someone claiming enforcement authority, it's a crime in progress.

Check the number series. Since 2025, TRAI has required RBI, SEBI, IRDAI and PFRDA regulated entities, and government departments, to use numbers beginning with 1600 for service and transactional calls. RBI's circular of 17 January 2025 made this binding on regulated lenders. Promotional calls from registered telemarketers use the 140 series. [Source: TRAI clarification, July 2026; RBI circular dated 17 January 2025 on prevention of financial frauds using voice calls and SMS] A call claiming to be from your bank's fraud team, arriving from an ordinary 10-digit mobile number, is out of policy for a real bank. This test isn't perfect, since compliance is still uneven and some entities still call from regular numbers, but a 1600-series number is a genuine positive signal in a way that a mobile number is not.

Wrong channel. Indian law enforcement does not run proceedings on WhatsApp, Skype, or any video conferencing app. Banks do not ask for OTPs, CVVs, PINs or passwords by phone, a point RBI has repeated for years. Government departments do not ask for AnyDesk.

International origin, with a caveat. DoT has warned about calls from numbers that don't begin with +91 claiming to be Indian authorities, and its International Incoming Spoofed Calls Prevention System blocked around 1.35 crore spoofed calls in its first 24 hours of operation in October 2024. [Source: Department of Telecommunications, via News on AIR] That system worked well enough that the pattern shifted: much of this traffic now arrives over WhatsApp or from genuine Indian SIMs bought through mule networks. So a foreign number is still a red flag, but a +91 number is no longer reassurance.

The voice knows you, but the caller doesn't. For voice-clone calls, ask something the clone can't answer. Not a fact from social media. Something from a shared memory that was never posted anywhere.

What to do while the call is happening

Hang up. That's the entire instruction.

You do not need to argue, confirm, gather evidence, or be polite about it. There is no downside to disconnecting on a genuine official, because a genuine official has an address, a written process, and a follow-up mechanism. There is a very large downside to staying on the line, because every additional minute is the scammer's working environment.

Then verify independently, using a number you find yourself. Your bank's number is printed on your card and on its website. Your relative's number is in your contacts. The courier company publishes customer care numbers. Never call back on a number the caller supplied, and never continue the conversation on a number they suggest you save.

For the relative-in-distress version, set up a family code word before you ever need it. One word, agreed at dinner, never written down or sent over WhatsApp. Any caller claiming to be family in an emergency must produce it. This takes two minutes and defeats voice cloning outright, which is more than any technology currently on the market can claim.

If you have elderly parents, have this conversation with them directly, and be specific: tell them that if anyone from the police calls, the correct response is to hang up and call you. Give them permission to be rude. A lot of people lose money because they were raised not to hang up on authority.

What to do if money has already moved

The sequence matters, and so does the clock.

1. Call 1930 immediately. This is the 24x7 national cybercrime financial fraud helpline, run under I4C. The operator logs your complaint into the Citizen Financial Cyber Fraud Reporting and Management System, which alerts the receiving bank and every downstream bank in the money trail to freeze the funds where they currently sit.

This is the golden hour, and the term is not marketing. Stolen money sits briefly in a mule account before being layered onward or withdrawn. Mumbai Police's 1930 centre handled 8.7 lakh calls in 2025 and blocked or recovered about ₹202 crore, and its officers attribute the outcomes directly to how fast people called. [Source: Mumbai Police Crime Branch, via The420.in, January 2026] Complaints filed days later recover very little, because by then the money has been split across accounts and cashed out.

Have ready: your number, the amount, the transaction ID or UTR, the date and time, and which bank or wallet was used.

2. File the written complaint at cybercrime.gov.in. Within 24 hours, using the acknowledgement number you receive by SMS. This is the only government-authorised portal for this, and the acknowledgement supports later FIR registration.

3. Tell your bank in writing the same day. Call the fraud helpline first to block the card or UPI, then put it in writing. This matters for a specific legal reason. Under RBI's circular of 6 July 2017 on limiting customer liability in unauthorised electronic transactions, a customer who reports a third-party fraud within three working days of receiving the bank's communication has zero liability. Report on days four to seven and your liability is capped, currently ₹5,000 for basic savings accounts, ₹10,000 for other savings accounts and prepaid instruments, and ₹25,000 for credit cards with limits above ₹5 lakh. Beyond seven working days, it falls to the bank's own board-approved policy, which is a much weaker position. [Source: RBI circular dated 6 July 2017, Customer Protection: Limiting Liability of Customers in Unauthorised Electronic Banking Transactions]

Once notified, the bank is required to shadow-credit the disputed amount within 10 working days.

Note the clock starts from the bank's alert, not from when you personally noticed. That distinction has cost people their protection.

4. Preserve everything. The calling number, screenshots, SMS, transaction references, and any call recording. Do not delete the WhatsApp thread because you're embarrassed.

5. Report the number through Chakshu. On sancharsaathi.gov.in, this is DoT's facility for reporting suspected fraud communication, covering bank account, wallet, SIM, gas, electricity, and KYC scams, along with impersonation of government officials or relatives. [Source: Department of Telecommunications, via Deccan Herald] This is also the right route when no money was lost but you want the number acted on. Reported numbers feed into disconnection actions: over 1.6 million SIMs and more than 577,000 handsets have been blocked in connection with cybercrime. [Source: parliamentary reply, 2026, via Media India]

One honest caveat about recovery. Freezing is not the same as getting your money back. In Bengaluru, of ₹1,242 crore lost in eight months, banks froze ₹513 crore but only ₹111 crore reached victims, because releasing frozen funds usually requires a court order and the same mule accounts often sit across multiple cases. [Source: Deccan Herald] Report fast anyway. Frozen money can eventually come back. Withdrawn money cannot.

What's changing on the infrastructure side

Two things are worth knowing because they'll alter what a suspicious call looks like over the next year.

CNAP, or Calling Name Presentation, is the network-level verified caller ID that TRAI approved in October 2025. Instead of crowd-sourced names from an app, it pulls the caller's name from the originating operator's KYC records and displays it on your screen. DoT settled on default-on with an opt-out, and operators started a phased rollout in late 2025 beginning with 4G and 5G, spreading through 2026. [Source: TRAI and DoT decision of 28 October 2025] When it's fully in place, impersonating a bank from a random SIM gets meaningfully harder.

It won't fix everything. CNAP shows a verified name, which tells you who owns the SIM. It doesn't tell you why they're calling, whether the SIM was bought with forged documents, or whether the person on the line is who the name says. Names are also being fought over: TRAI has said apps can't tag or block 1600 and 140 series calls, while Truecaller has argued that users ignore about 79% of 1600-series calls anyway. [Source: Business Standard, July 2026] Verified identity helps. It's not the same as knowing what a call is about.

Where Robin fits

Everything above assumes the call reached you. That assumption is the scammer's entire operating advantage: a live human, caught off guard, pushed into fear and time pressure in real time. Every technique in the script needs a person on the line who can be worked on.

Robin is an AI phone assistant. When an unknown number calls, Robin answers, talks to the caller, works out what the call is actually about, and reports back to you with a summary. A delivery partner who can't find your building gets directions. A clinic confirming an appointment gets handled. A caller running a fear script gets a calm, patient assistant that doesn't panic, doesn't have a bank account, and doesn't respond to urgency.

You read what happened afterwards, in text, on your own time. Which happens to be the exact condition under which none of these scams work.

Download hiRobin for Android.

Frequently asked questions

Is digital arrest real? No. There is no provision under Indian law for arrest, custody, or investigation conducted over a video or phone call. The Indian Cyber Crime Coordination Centre has issued a public advisory stating that police, CBI, customs, ED and judges do not arrest people over video calls. [Source: I4C advisory] Anyone using the term is committing fraud.

What number do I call after a scam call in India? 1930, the national cybercrime helpline, available 24x7. Call it first if money has moved, then file the written complaint at cybercrime.gov.in within 24 hours.

How quickly do I need to report to get my money back? Call 1930 within the hour for the best chance of the receiving bank freezing the funds. Separately, notify your bank within three working days of its transaction alert to retain zero liability under RBI's 2017 customer protection circular.

How do I know a call is really from my bank? Banks and other RBI, SEBI, IRDAI and PFRDA regulated entities are required to use the 1600 number series for service and transactional calls. No bank will ask for an OTP, PIN, CVV or password, and none will ask you to install a screen-sharing app. When unsure, hang up and call the number printed on your card.

Can scammers fake my family member's voice? Yes. Current cloning tools need only a few seconds of audio, which is easy to source from social media. Agree a family code word in advance and require it during any emergency call asking for money.

Where do I report a scam number if I didn't lose money? Chakshu, on the Sanchar Saathi portal at sancharsaathi.gov.in. It covers fraud calls about bank accounts, wallets, SIMs, gas and electricity connections, KYC, and impersonation of government officials or relatives.