Online Gaming Fraud Money Recovery: The Minute-by-Minute Playbook

The 50-second answer

You lost money to a gaming fraud, and now one thing matters: speed. Call 1930 and file at cybercrime.gov.in inside the golden hour so I4C’s CFCFRMS can lien the beneficiary account before the cash is mule-layered away. Report an unauthorised debit within 3 working days for RBI zero liability; for card fraud, a 120-day chargeback. The full ladder is on the refund-dispute hub.

Read this first if your heart is pounding. This is the action page. If you’re still unsure whether you were actually scammed or your payout is merely slow, stop here and run the scam vs delay red-flag check first — because a wrong diagnosis wastes the one resource recovery depends on, which is time. But if you already know it was fraud — a fake “care number” drained your account, an app demanded a deposit “to unlock” your withdrawal, a remote-access app emptied your UPI, or a Telegram “manager” took your money and vanished — then you are in the right place, and the clock started the moment the money left. The rest of this page is the minute-by-minute, then hour-by-hour, then day-by-day recovery playbook, with the exact phone numbers, portals, claim wording, and the honest odds at each step. Work it top to bottom. Don’t read the whole thing first if money just left — jump to “The first 60 minutes” and start dialling.

2026 reality you must hold in your head. The legal ground shifted under everyone. The Promotion and Regulation of Online Gaming Act, 2025 (PROGA) received Presidential assent on 22 August 2025, and its operating Rules came into force on 1 May 2026, prohibiting all online money games — skill or chance. That reset created a fraud feeding-frenzy: stranded balances, panicked players, and a wave of fake “recovery agents” charging fees to “release” money that a real operator returns for free. So two things are true at once in 2026. One: a new deposit into a money game is now illegal, which means any “deposit ₹X to withdraw” demand is both a scam and an illegal ask — never do it. Two: recovering money you already lost to fraud runs through exactly the same RBI, NPCI, I4C, and police machinery it always did, and that machinery still works if you reach it fast. This page is about case two: you’ve been hit, and you want it back.

What “recovery” actually means — and what it can’t mean

Before the steps, one honest framing, because it decides everything about your expectations. “Recovery” in Indian cyber-fraud is not a refund button. It is a race to freeze money that is still sitting somewhere reachable before the fraudster moves it beyond reach. That single sentence explains why speed matters more than anything else on this page, and why two people who lost the same ₹50,000 can have completely different outcomes based purely on how fast they called 1930.

There are really three kinds of “lost money,” and your odds differ sharply by kind:

• Rail money still parked in a beneficiary account. You sent a UPI/IMPS transfer to a fraudster (a “fee,” a “deposit,” a “tax”), and the money is still sitting in that first account or one mule account down the chain. This is the recoverable kind. The golden-hour lien is built precisely for it. If you’re fast, the bank freezes the account and the money can be returned.
• Rail money already layered away. Same transfer, but hours have passed, and the scammer has split and forwarded it through several mule accounts. This is hard to recover — not impossible, because investigation can sometimes trace and freeze downstream, but the easy win is gone. The lesson is brutal and simple: the difference between this row and the one above is usually minutes.
• A fictional on-screen “balance” inside a fake app. The app showed you ₹2 lakh “winnings,” but you never actually received that as a bank credit — it was a display string designed to make you deposit more. This money was never real and there is almost nothing to recover, because it never existed as a credit in any account. What you can recover is the real money you deposited into the fraud, treated as rail money under the two rows above.

So the entire recovery game is: figure out which of your money is real rail money, then freeze it before it’s layered. The fictional balance is a sunk loss you stop chasing; the real deposits are what you fight for. Keep that split in your head through every step below — it stops you from wasting the golden hour mourning a number that was always pixels. The deeper version of this triage, with the document trail for each, is on the refund-dispute hub.

The one number that frames your realistic odds

Be clear-eyed about the national picture. India’s I4C reporting system has saved over ₹7,130 crore across more than 23.02 lakh complaints as of late 2025 — a genuinely large, genuinely working machine. But measured against the ₹22,845 crore Indians lost to cyber fraud in 2024 alone, the saved/blocked figure is roughly a third of losses, and the amount actually returned to victims is a smaller fraction still, because “saved” includes funds blocked in transit and held under lien that haven’t yet been released back. So the honest odds are: good if you’re inside the golden hour, poor if you’re days late, near-zero for a fictional in-app balance. That asymmetry is not a reason to despair — it’s a reason to put the phone in your hand right now.

The first 60 minutes — the golden hour, step by step

This is the most important section on the page. Everything else is follow-through. India’s fraud-recovery system is engineered around a golden hour, and what you do in the first sixty minutes decides most outcomes. Do these steps in this order, and don’t let document-gathering delay the first call — you can add evidence later, but you cannot get back a head start you wasted.

Minute 0–5 — Call 1930 immediately

Dial 1930. The National Cyber Crime Helpline, run by the Indian Cybercrime Coordination Centre (I4C) under the Ministry of Home Affairs, is the single fastest path to freezing a fraudster’s account. Call it the moment you realise it was fraud — before you finish gathering screenshots, before you draft anything, before you even fully calm down.

When the 1930 control room takes your call, it logs the transaction into the Citizen Financial Cyber Fraud Reporting and Management System (CFCFRMS) — an in-house I4C platform that wires together law-enforcement agencies, banks, and payment intermediaries on one back-end. The system then sends a lien request to the bank that received your money. If the funds are still parked in that beneficiary account, the bank places a temporary hold (an “intermediate lien”) on the account — typically lasting up to 7 working days — which stops the fraudster from cashing out while the case is verified.

Have these ready to read out, but don’t delay the call to perfect them: your mobile number, the amount, the date and time of the transfer, the UTR / transaction reference, and the UPI ID / phone number / account the money went to. The faster the lien lands on a still-funded account, the higher your odds — this is the whole ballgame.

Minute 5–20 — File on the NCRP portal (cybercrime.gov.in)

While the 1930 report is in motion, file a formal complaint at cybercrime.gov.in, the National Cyber Crime Reporting Portal (NCRP). This formalises the helpline call and generates your acknowledgement number (a 14-digit reference you must save and use to track the case).

Choose the “Report Financial Fraud” flow. Attach everything you have: screenshots of the app, the chat, the “balance,” the payment confirmations; the UTR(s); the fraudster’s UPI ID, phone number, and bank account number; and any call logs. The NCRP complaint is what carries your case forward into investigation after the immediate lien, so completeness here pays off for weeks. One nuance worth knowing in 2026: under the I4C e-Zero FIR initiative launched in May 2025, a financial-fraud complaint to NCRP/1930 involving a loss above ₹10 lakh now automatically triggers registration of a Zero FIR (initially with Delhi’s e-Crime Police Station), which means large losses get a police case opened without you separately running to a station first.

Minute 20–40 — Call your own bank’s fraud desk

In parallel, call your own bank’s 24×7 fraud / cards helpline (the number on the back of your card or in your banking app) and tell them, in plain words, that you are a fraud victim and the transaction was unauthorised (or fraudulently induced). Quote the UTR / RRN, the amount, and the time. Ask them explicitly to:

1. Flag the transaction as fraud and attempt a recall of the funds.
2. Lien / block the beneficiary if it’s an internal transfer they can reach.
3. Register the unauthorised-transaction complaint and give you a complaint reference number — this starts the RBI zero-liability clock that the next major section is built on.

Your bank is also the nodal contact the I4C alert routes through, so the 1930 report and your bank call reinforce each other. Two doors, same goal: freeze the money downstream.

Minute 40–60 — Lock down your own exposure

If the fraud involved you sharing an OTP, a UPI PIN, or granting a remote-access (AnyDesk/TeamViewer/screen-share) session, treat your whole account as compromised, because the scammer may still have a live window into it:

• Change your UPI PIN and your net-banking / mobile-banking password immediately.
• Uninstall any remote-access or “support” app the scammer had you install.
• Call the bank to block or relimit the card/account and disable any beneficiary the scammer may have added.
• Disable UPI auto-pay mandates you don’t recognise.

Do this even if no further debit has appeared yet — a compromised session can fire a second transfer minutes later. This step doesn’t recover the first loss; it prevents the second, third, and fourth. For the broader “what door for what loss” map, the refund-dispute hub lays out every channel.

The 60-minute order, memorised: 1930 first (fastest freeze), cybercrime.gov.in second (formal record + acknowledgement number), your bank’s fraud desk third (recall + zero-liability clock), lock your exposure fourth (stop the next debit). Don’t reorder these to “gather evidence first” — evidence can be added to an open complaint, but a lien placed 40 minutes late often catches an empty account. The single biggest predictor of getting money back is how fast you completed minute 0–5.

The golden hour, explained — why minutes literally decide outcomes

You’ll work the steps harder if you understand why the clock is so brutal, so here is the mechanism in plain terms. It comes down to how the fraudster’s money actually moves after you send it.

When you transfer money to a scammer — a “fee,” a “deposit to unlock,” a “tax” — it rarely lands in some traceable company account. It lands in a mule account: a real bank account rented, bought, or coerced from a third party, often a student, a gig worker, or someone themselves scammed into “renting” their account. The fraudster then layers the money — splitting it and forwarding it through a chain of mule accounts within minutes — specifically to break the trail before anyone can react. Indian police have dismantled networks running crores through exactly this mule-account infrastructure, and it is the backbone of the Telegram trading-scam and fake-gaming-app families.

Now lay the recovery system over that. When you call 1930, the CFCFRMS back-end fires a lien request to the first beneficiary bank. If the money is still in that first account, it gets frozen — caught. If layering already moved it two or three hops down, the alert is chasing a moving target, and the easy freeze is gone. So the race is literally: your call versus the fraudster’s transfer button. Both are measured in minutes. That’s why “golden hour” isn’t a marketing slogan — it’s the real, narrow window in which your money is still sitting in a place a single lien can reach.

The scale tells you it works when you win the race. Across the I4C system, more than ₹7,130 crore has been blocked or saved across 23.02 lakh-plus complaints. The recoveries are overwhelmingly golden-hour recoveries — the people who got money back are, with few exceptions, the people who called fast. The corollary is the warning: every hour you wait reading instead of dialling moves you from the “saved” column toward the “lost” column. Police guidance puts the practical outer edge at roughly four hours, with the genuine sweet spot in the first 30–60 minutes. If you are mid-fraud or just-defrauded as you read this, the correct action is to stop reading and call 1930 — you can come back for the follow-through.

Know which fraud you’re recovering from — five patterns, one playbook

The recovery playbook is the same regardless of how you were hit, but recognising your pattern helps you describe it accurately to 1930, your bank, and the NCRP portal — which speeds the freeze. Here are the five gaming-adjacent fraud patterns this page covers, each with the one detail investigators most want from you. These are descriptions of documented Indian fraud types, not anyone’s personal story.

Pattern 1 — The fake “customer care number” drain

You couldn’t reach the app’s support, Googled a “care number,” reached a confident “agent,” and from there it was a scripted robbery — they extracted an OTP, a PIN, or talked you into a remote-access session, and your account was drained. What investigators want: the fake number you called, the time of the call, and the UTR of every debit that followed. This pattern is so common because most legal RMG apps have no public helpline at all, leaving a vacuum scammers fill in search results. The app itself may be perfectly legitimate — the fraud was the contact. For the safe way to reach real support next time, see customer-care-escalation.

Pattern 2 — The deposit-to-withdraw trap

The app showed a fat withdrawable balance, then — the instant you tried to cash out — demanded a fresh “recharge,” “unlock fee,” “tax,” or “margin top-up” before it would release the money. You paid, and either the withdrawal still failed or it demanded the next fee. What investigators want: the UTR of the “fee” you paid and the account/UPI it went to — because that is the real money you can fight for. The on-screen “balance” was the bait; the fee you paid is the loss. No legal app ever requires a deposit to process a withdrawal, and post-PROGA a fresh deposit is illegal anyway.

Pattern 3 — The OTP / AnyDesk / screen-share takeover

A “support agent” manufactured urgency (“your account will be blocked / your withdrawal is frozen”), had you install AnyDesk, TeamViewer, or a “verification app,” then read out the 9-digit code that handed them live control of your phone. They watched you open your UPI app, captured your OTP and PIN, and executed transfers while you watched. What investigators want: the remote-access app name, the time control was granted, and every unauthorised UTR. This is the most catastrophic pattern because it doesn’t take one payout — it empties everything the phone can reach. The RBI has explicitly warned about AnyDesk-based fraud.

Pattern 4 — The Telegram prediction / investment “manager”

You joined a Telegram or WhatsApp group (“prediction tips,” “color trading,” “VIP earning,” “₹3,500/day for simple tasks”), got paid small real amounts early to build trust, watched a dashboard show your “balance” compounding, deposited escalating sums, then hit a “withdrawal tax / unlock fee / margin top-up” wall and the money was gone. What investigators want: the group/handle, the “manager’s” contact, and the UTRs of every deposit you actually made. India lost roughly ₹6,000 crore to this scam family in 2024. The “profit” was fictional; your deposits were real.

Pattern 5 — The vanished fake operator

A fake gaming app took real deposits, showed winnings, and then went dark on everyone at once — app gone, pending withdrawals silent, “support” unreachable. What investigators want: the app name / APK source, your deposit UTRs, and proof of the dead support channel. Distinguish this carefully from a legitimate PROGA wind-down, where a real operator stopped cash games but still processes withdrawals of existing balances through a working KYC’d flow — that’s a slow payout to pursue via the ladder, not a fraud to report. If KYC and a recovery flow still function, see the withdrawal recovery mechanics instead.

The pattern-to-action link: whichever pattern hit you, the first 60 minutes are identical — 1930, NCRP, bank, lock-down. The pattern only changes the story you tell and the evidence you lead with. And if you’re reading these five and realising you might be mid-scam rather than post-scam — a “fee” was just demanded but you haven’t paid — then the move is the opposite of recovery: don’t pay, screenshot, and walk away, because the cheapest recovery is the loss you never take. The full anatomy of how these scams unfold is on the red-flag detection page.

The bank fraud-dispute claim — RBI zero liability, step by step

The golden-hour call freezes money downstream. The bank dispute is the parallel track that protects you on the upstream side — the debit that left your account — and for unauthorised transactions it is genuinely powerful, because RBI rules can make your liability zero. This section is the one to get exactly right, because the timing tiers are unforgiving.

The rule that protects you: RBI’s limited-liability circular

The governing rule is RBI’s “Customer Protection – Limiting Liability of Customers in Unauthorised Electronic Banking Transactions,” circular DBR.No.Leg.BC.78/09.07.005/2017-18, dated 6 July 2017. It sets a sliding scale of customer liability that turns almost entirely on how fast you report an unauthorised debit after the bank’s communication about it. The tiers:

• Report within 3 working days → ZERO liability. If the unauthorised transaction was a third-party breach (neither your fault nor the bank’s — i.e. the loss sits “elsewhere in the system”) and you notify the bank within 3 working days of receiving its communication, your liability is nil. The bank must make you whole.
• Report within 4–7 working days → LIMITED liability. Notify in this window and your liability is capped at the transaction value or a per-RBI ceiling, whichever is lower — commonly ₹5,000 for basic/small accounts, ₹10,000 for typical savings accounts and credit cards, and up to ₹25,000 for larger current accounts (per the circular’s Table 1).
• Report after 7 working days → liability is determined by the bank’s board-approved policy.

Two more bank obligations make this concrete and worth quoting back at them:

• Provisional credit within 10 working days. Once you notify the bank of an unauthorised transaction, it must credit the disputed amount to your account within 10 working days of notification, without waiting for any insurance claim to settle. You don’t sit moneyless while they investigate.
• Resolution within 90 days. The bank must close the complaint and establish liability within its board-approved timeline, and in no case more than 90 days from receipt.

So the headline for a fraud where money was pulled from your account without your authorisation: report it to your bank within 3 working days, in writing, and you are positioned for zero liability and a 10-day provisional credit. That is why minute 20–40 of the golden hour — calling the bank — is not optional.

The important honesty: “unauthorised” vs “you were tricked into paying”

Here is the nuance that decides whether zero-liability applies cleanly, and most guides skip it. RBI’s zero-liability protection is strongest for a genuinely unauthorised transaction — one executed without your involvement, such as an AnyDesk takeover that moved money while you watched, or a card cloned and used remotely. In those cases, you didn’t authorise it; a third party did, and the circular’s zero-liability tier fits.

It is murkier when you were socially engineered into authorising the payment yourself — you entered your own PIN to send a “fee,” or you approved the transfer believing the scammer’s story. Banks sometimes argue these are “customer-authorised” and resist zero-liability. You should still file the unauthorised-transaction dispute (the line between “tricked into authorising” and “unauthorised” is contested and evolving, and many such cases are still resolved in the customer’s favour, especially via the Ombudsman), but set your expectation honestly: the cleanest zero-liability wins are the truly unauthorised takeovers, while the deposit-to-fraudster cases lean more on the golden-hour freeze and police investigation than on the bank refunding you. Pursue both tracks regardless — the freeze and the dispute — because you don’t know in advance which one lands.

How to actually file it

Don’t rely on a phone call alone — put the dispute in writing so the 3-working-day clock is provable:

1. Call the fraud helpline first (golden-hour step), get a complaint reference, and note the agent and time.
2. Follow up in writing the same day — the bank’s app dispute form, the registered email, or a written letter to the branch — stating clearly that the transaction was unauthorised, the date/time/amount/UTR, and that you are reporting within 3 working days and claim zero liability under RBI circular DBR.No.Leg.BC.78 dated 6 July 2017, plus provisional credit within 10 working days.
3. Keep the acknowledgement. Every reference number, every email timestamp. If the bank later stalls, this paper trail is what the RBI Ombudsman acts on.

There’s a copy-paste version of this in the templates section below. The deeper, rung-by-rung escalation if the bank drags its feet — formal complaint, then the RBI Integrated Ombudsman (RB-IOS 2021) after 30 days — lives on the refund-dispute hub.

The card chargeback route — for card-funded fraud

If the money reached the fraudster via a debit or credit card (you “deposited” with a card, or a card was charged without authorisation), you have a second, independent weapon that exists outside the UPI/bank-transfer world: the card chargeback. It is run by the card networks (Visa, Mastercard, RuPay), and for card fraud it is often the cleanest path to a refund.

How the chargeback works and the deadline that matters

A chargeback is a forced reversal of a card payment, initiated through your card-issuing bank, which then claims the money back from the merchant’s bank via the network’s dispute rails. The decisive number: under the card networks’ rules, you generally have up to 120 days from the transaction date to raise a dispute for categories including fraud, unauthorised transaction, non-receipt of goods/services, and duplicate charges. But beware — banks often impose much shorter internal deadlines than the network’s 120 days, so the practical rule is dispute the moment you discover it, not “I have four months.”

The process and realistic timeline:

• Raise the dispute through your card-issuer’s app/website/helpline, selecting the fraud / unauthorised reason.
• The issuer typically issues a temporary/provisional credit, then formally charges the transaction back to the merchant.
• The merchant has a window (around 45 days) to defend the charge with evidence (this is “representment”).
• You usually see a final credit in roughly 60–90 days, though it can range from 30 to 120 days depending on bank and network.

Where chargeback fits in your recovery stack

Think of chargeback as layering on top of the other tracks, not replacing them:

• For a card-funded deposit to a fraud app, file the chargeback and the 1930/NCRP report and the bank unauthorised-transaction dispute — they attack the loss from three angles.
• A chargeback is strongest where the transaction was genuinely unauthorised or where you can show non-delivery (you paid for “winnings release” that never materialised). It’s weaker where you knowingly authorised the card payment and the dispute hinges on “I was deceived,” which the merchant may contest.
• If the card charge itself was fraudulent/unauthorised (cloned card, MOTO fraud), this also folds into the RBI zero-liability protection above — so you cite both the chargeback rights and the 3-working-day RBI rule.

If the issuer rejects a clearly valid chargeback or sits on it, escalate to the bank’s grievance officer, then the RBI Ombudsman, exactly as you would a UPI dispute. The chargeback is a strong tool, but it is a bank process — and banks respond to documented, deadline-aware complaints, which is what the templates below give you.

The police / FIR track — when and how

The 1930 + NCRP report is your fast, system-level freeze. The police FIR is the slower, heavier track that opens a formal criminal investigation — and for larger losses, or where the bank/lien route stalls, it’s essential. Here’s how it fits, without duplicating the cyber-portal steps above.

NCRP already is your police complaint — but know the FIR layer

Filing on cybercrime.gov.in (NCRP) is lodging a complaint with the police cyber-crime apparatus; your complaint is routed to the relevant jurisdiction for action. For many cases, the NCRP complaint plus the 1930 lien is the operative police involvement. But two situations call for a formal FIR:

• Large losses. Under the I4C e-Zero FIR initiative (live since May 2025), a financial cyber-fraud complaint above ₹10 lakh filed via NCRP/1930 now auto-converts into a Zero FIR, opening a criminal case without you needing to separately push for one. A Zero FIR can be registered at any police station regardless of where the crime occurred, then transferred to the right jurisdiction — which removes the classic “not our area” runaround.
• Stalled recovery / a named, traceable culprit. If the bank or lien route isn’t delivering and there’s a person, account, or entity to pursue, a registered FIR gives investigators the legal teeth (account-freeze orders, summons, recovery proceedings) that a portal complaint alone may not.

How to escalate to an FIR if you need one

1. Take your NCRP acknowledgement number and the full evidence pack (UTRs, screenshots, fraudster details, bank complaint references) to the local cyber-crime police station or the nearest police station.
2. Insist on a Zero FIR if the station claims the crime is “outside its jurisdiction” — by law they must register it and transfer it; jurisdiction is not a valid refusal for a cognisable offence.
3. Get the FIR copy (your right) and its number — it becomes the anchor for any account-freeze application, bank follow-up, or later legal recovery.

The FIR track is slower and won’t beat the golden-hour lien for speed, but it’s what carries a serious case the distance — especially for losses big enough that you’re not writing them off. Run it after the golden-hour steps, not instead of them.

Trace your own money — the evidence that wins a recovery

A freeze is only as good as the transaction detail you hand the system, and a bank dispute is only as strong as what you can prove. So before the deadlines run, spend twenty minutes building a clean evidence pack — it’s the difference between a case officers can act on and one that stalls for lack of detail. Most people lose recoverable money not because the system failed but because they couldn’t show where the money went or that they reported in time.

The UTR is the thread — find it and never lose it

Every UPI, IMPS, or NEFT transfer carries a UTR (Unique Transaction Reference, also shown as RRN — a 12-digit number). It is the single thread that ties your debit to the fraudster’s credit, and the entire freeze depends on it. Capture it on day zero, because once a transaction ages out of your app’s quick view, digging it back out is far harder — and the bank cannot trace a credit you can’t name. Where to look, fast:

• In your UPI app (PhonePe, Google Pay, Paytm, BHIM): open the transaction in History/Activity; the reference is labelled “UPI Reference No.,” “Bank Reference ID,” “UPI transaction ID,” or “Transaction ID” depending on the app — they all mean the same UTR.
• In your bank SMS for the debit — the UTR/RRN is usually printed in the alert.
• In your bank statement / passbook against the debit line.

For a fraud with multiple payments (the classic “pay fee after fee” bleed), capture every UTR, each with its amount, time, and the beneficiary it went to. A chain of UTRs lets investigators map the layering path and place liens further down it.

Build the evidence pack the bank and police actually want

Assemble these into one folder (screenshots and a short typed summary) so you can attach them to the NCRP form, hand them at a police station, and quote them in a bank dispute without re-hunting:

• Every UTR/RRN, with amount, date, time, and the beneficiary UPI ID / phone / account number for each.
• Screenshots of the app’s “balance,” the withdrawal screen, the “fee” demand, the chat with the “agent”/“manager,” and each payment confirmation.
• The fraudster’s identifiers: the fake care number you called, the Telegram/WhatsApp handle, the APK source/link, the app name and version.
• Your own reference numbers as they accrue: the 1930 complaint ref, the NCRP acknowledgement, the bank complaint ref, the FIR number.
• Timestamps that prove you reported fast — the call log to 1930, the time you submitted NCRP, the email timestamp of your written bank dispute. These are what establish the 3-working-day and golden-hour windows.

Why the timestamps matter as much as the UTRs

Two clocks decide two different outcomes, and both are proven by timestamps you control. The golden-hour clock (minutes) decides whether the lien catches the money — proven by your 1930 call time. The 3-working-day clock decides whether you get RBI zero liability — proven by your written bank report’s timestamp. A bank that wants to deny zero-liability will check whether you reported inside the window, so a dated email or app-form submission is worth more than a phone call you can’t prove. The habit that protects you is boring but decisive: report in writing, the same day, and keep the acknowledgement. That single discipline is what the Ombudsman acts on if the bank later stalls, and it’s spelled out further on the refund-dispute hub.

The realistic recovery-odds table

Set expectations honestly by case, so you fight hardest where you can actually win and don’t burn weeks chasing a fictional number. These bands reflect the documented behaviour of the Indian recovery system, not a guarantee for any individual case.

The two rows to tattoo on your brain: the top row (report in the first hour) is where almost all real recovery happens — so the entire game is getting there. And the last row is the cruel sequel — after a fraud, “recovery agents” hunt victims, charging fees to “release” money, which is simply a second fraud stacked on the first. Real recovery through 1930/NCRP/your bank costs you nothing. Anyone who asks you to pay to get your money back is, by definition, scamming you again — a point the red-flag guide hammers because it catches so many people at their most vulnerable.

The complete timeline — hour by hour, then day by day

You’ve seen the golden hour. Here is the full recovery clock, from the first minute through the long tail, so you always know what the next move is and which clock you’re racing. Climb it in order; don’t skip the early rungs (you’ll lose the easy freeze) and don’t jump to the Ombudsman on day one (they’ll bounce you back to the bank).

Hour 0–1 — Freeze (the golden hour)

• 1930 call → CFCFRMS lien request to the beneficiary bank.
• cybercrime.gov.in complaint → acknowledgement number saved.
• Your bank’s fraud desk → recall attempt + unauthorised-transaction complaint lodged (starts the 3-working-day RBI clock).
• Lock your exposure → change PIN/passwords, kill remote-access apps, block the card if compromised.

Hour 1–24 — Reinforce and document

• Get every reference number in writing — the 1930 case, the NCRP acknowledgement, the bank complaint number.
• Assemble the evidence pack: screenshots of the app/chat/balance, all UTRs, the fraudster’s UPI/phone/account, the fake care number if used, call logs, and the remote-access app name if relevant.
• Send the written bank dispute (email/app form) the same day, citing the RBI circular and claiming zero liability + 10-day provisional credit.
• If card-funded, raise the chargeback with your card issuer.
• Do not delete the app, chat, SMS, or call log — it’s evidence. Do not pay any “fee” to “release” funds.

Day 1–3 — Claim your rights in writing

• Confirm the bank registered the unauthorised-transaction complaint within 3 working days (this is the zero-liability gate — make sure it’s on record inside the window).
• Push for the 10-working-day provisional credit once you’ve notified — quote it explicitly.
• Track your NCRP complaint status with the acknowledgement number; respond fast to any officer’s request for more detail.

Day 3–10 — Provisional credit and chargeback motion

• Expect the provisional credit to land by day 10 for a valid unauthorised-transaction claim; if it doesn’t, send a written reminder citing the 10-working-day rule.
• The chargeback (if card-funded) is now in the merchant-representment window.
• If the lien caught funds, the bank/police process for releasing them back begins — stay reachable and responsive.

Day 10–30 — Formal escalation if stalled

• If the bank denies zero-liability wrongly, disputes the provisional credit, or goes silent, escalate to the bank’s grievance/nodal officer in writing with all your references.
• Consider the FIR track now if the loss is large or there’s a traceable culprit and recovery has stalled.
• Keep the NCRP case alive; add any new information.

Day 30–90 — Ombudsman and resolution

• After 30 days without resolution from the bank/payment-system participant, file free with the RBI Integrated Ombudsman Scheme 2021 (RB-IOS) at cms.rbi.org.in — it covers banks, NBFCs, and Payment System Participants.
• The bank must, in any case, resolve and establish liability within 90 days of your complaint — hold them to it.
• The criminal investigation (FIR route) runs on its own, longer timeline; the recovery of frozen funds is processed through the legal/police channel.

The clock in one line: the first hour is for freezing (1930 → NCRP → bank), the first 3 working days are for claiming zero liability in writing, the first 10 days are for the provisional credit, the 30-day mark opens the Ombudsman, and 90 days is the hard resolution ceiling. Every rung maps to a real rule with a real deadline — miss a deadline and you lose that rung’s leverage. The fully-templated version of the bank-and-beyond ladder is on the refund-dispute hub.

Copy-paste templates for every recovery channel

Fill the bracketed parts. Keep every message factual, dated, and reference-stamped — emotion doesn’t move a recovery, a UTR and a cited rule do. There are six here, one per channel.

Template A — The 1930 call script (read this, don’t freeze)

I am reporting a financial cyber fraud and need an urgent lien on the
beneficiary account.

- My name: [NAME]
- My registered mobile: [NUMBER]
- Amount lost: ₹[AMOUNT]
- Date and time of transaction: [DATE, TIME]
- My UTR / transaction reference: [UTR]
- Money was sent to (UPI ID / phone / account no.): [FRAUDSTER DETAILS]
- How it happened (one line): [e.g. "fake customer care number asked
  for OTP" / "app demanded deposit to release withdrawal" /
  "AnyDesk remote-access takeover" / "Telegram investment manager"]

Please log this in CFCFRMS and send a lien request to the beneficiary
bank now. Please give me the complaint reference.

Template B — NCRP portal complaint (cybercrime.gov.in)

Category: Financial Fraud — [Fraud Call/Vishing / UPI Fraud /
Fraudulent App / Investment Scam]

Incident: On [DATE, TIME] I lost ₹[AMOUNT] to a [gaming app / fake
customer-care / Telegram investment] fraud. [One paragraph: what was
shown, what I was asked to do, what I paid, in order.]

Transaction details:
- Amount: ₹[AMOUNT]
- UTR / reference(s): [UTR(s)]
- My UPI ID / account: [HANDLE / A/C]
- Beneficiary (fraudster) UPI / phone / account: [DETAILS]
- App / group / number involved: [NAME / HANDLE / FAKE CARE NUMBER]

Attached: screenshots of the app/chat/balance, payment confirmations,
call logs. Requesting urgent action and a lien on the beneficiary
account. [Acknowledgement number generated on submission.]

Template C — Bank unauthorised-transaction dispute (within 3 working days)

Subject: URGENT — Unauthorised transaction — UTR [UTR] — Zero-liability
claim under RBI circular DBR.No.Leg.BC.78 (06 Jul 2017)

I am reporting an UNAUTHORISED electronic transaction on my account and
claiming zero liability.

- Account / card: [A/C or CARD last 4]
- Amount: ₹[AMOUNT]
- Date/time: [DATE, TIME]
- UTR / RRN: [UTR]
- Beneficiary: [FRAUDSTER UPI / ACCOUNT]
- 1930 complaint ref: [REF]   NCRP acknowledgement: [NO.]

I am notifying you WITHIN 3 WORKING DAYS of becoming aware. Per RBI's
"Limiting Liability of Customers in Unauthorised Electronic Banking
Transactions" (DBR.No.Leg.BC.78/09.07.005/2017-18, 06 Jul 2017), my
liability is ZERO for a third-party-breach transaction reported in this
window. Please (1) register this dispute and give me a reference number,
(2) provide PROVISIONAL CREDIT within 10 working days, and (3) attempt
recall of the funds. Please confirm in writing.

Template D — Card chargeback request (card-funded fraud)

Subject: Chargeback request — fraudulent/unauthorised card transaction —
[CARD last 4]

I am disputing the following card transaction as fraudulent /
unauthorised and requesting a chargeback.

- Card (last 4): [XXXX]
- Merchant / descriptor: [AS SHOWN ON STATEMENT]
- Amount: ₹[AMOUNT]
- Transaction date: [DATE]
- Reason: [Fraud — unauthorised / Services not rendered —
  "withdrawal release" never delivered]

This is within the 120-day dispute window under the card-network rules.
Please raise the chargeback, issue provisional credit, and share the
dispute reference. Supporting evidence (screenshots, 1930/NCRP
references) attached.

Template E — FIR / Zero FIR request at the police station

To the Station House Officer / Cyber Crime Cell,

I am a victim of online financial fraud and request registration of an
FIR (Zero FIR if jurisdiction is questioned).

- Date/time of offence: [DATE, TIME]
- Amount defrauded: ₹[AMOUNT]
- Method: [gaming app fraud / vishing via fake care number / remote-
  access takeover / investment-group scam]
- Fraudster details: [UPI / phone / account / app / Telegram handle]
- NCRP acknowledgement: [NO.]   1930 ref: [REF]   Bank complaint: [REF]

This is a cognisable offence; I request a Zero FIR be registered and
transferred to the appropriate jurisdiction, and a copy of the FIR with
its number. Evidence pack attached.

Template F — RBI Ombudsman complaint (after 30 days, if the bank stalls)

Nature of complaint: Deficiency in service — failure to refund an
unauthorised electronic transaction / wrongful denial of zero liability.

- Bank / payment-system participant: [NAME]
- My account / card: [DETAILS]
- Amount: ₹[AMOUNT]   UTR: [UTR]   Date: [DATE]
- Bank complaint ref & date: [REF, DATE]   Days elapsed: [N]
- 1930 ref: [REF]   NCRP acknowledgement: [NO.]

I reported this unauthorised transaction within 3 working days and
claimed zero liability under RBI circular DBR.No.Leg.BC.78 (06 Jul 2017).
The bank has neither provided the 10-working-day provisional credit nor
resolved the complaint within the required timeline. I request directions
for refund with applicable compensation. Filed via cms.rbi.org.in.

The “do not” list — the moves that destroy a recovery

Half of recovery is doing the right things fast; the other half is not doing the things that hand the fraudster a clean getaway or set you up for a second loss. Each of these is a documented way people sabotage their own case.

• Do not pay any “fee,” “tax,” “deposit,” or “unlock charge” to release your money. This is the core fraud mechanic. A real refund — a UPI auto-reversal, a chargeback, a bank credit, a frozen-fund release — costs you ₹0 and is processed by the rail or the system, never by a person asking for a transfer. Every rupee of “fee” you pay is a fresh loss with no recovery.
• Do not hire a paid “recovery agent” or “ethical hacker.” The post-fraud “recovery service” charging an upfront fee is a second scam that specifically hunts fresh victims. Official recovery (1930/NCRP/bank/Ombudsman) is free.
• Do not delete the app, the chat, the SMS, or the call log. It’s evidence. Screenshot the in-app “balance” before it vanishes; preserve the fraudster’s messages and numbers. Investigators and your bank act on what you can show.
• Do not keep “playing to win it back” or deposit again. Post-PROGA a fresh deposit into a money game is illegal, and on a fraud app it simply feeds the scammer more. Throwing money at the hole never recovers the hole.
• Do not share any new OTP or UPI PIN — not even with “the recovery team.” No legitimate recovery process ever needs your OTP or PIN. The “we’ll reverse it if you confirm the OTP” line is the same scam wearing a refund mask.
• Do not wait to “gather everything” before calling 1930. Partial information now beats complete information in an hour. You can supplement an open complaint; you cannot un-lose the golden hour.
• Do not assume a 30%-lighter payout is fraud. If you did receive money but it was smaller than expected, that’s almost certainly TDS on net winnings, not theft — check before you file, because mis-filing tax as fraud burns the days a real case needs. The tax math is on the withdrawal page.

The single rule under all of them: after a fraud, the only people who will ask you for more money, an OTP, or a PIN are scammers — including the scammer who already hit you, now wearing a “refund” or “recovery” costume. Real recovery flows toward you and costs you nothing. The instant a “release” requires a payment from you, you’ve identified a second fraud — report that to 1930 too.

After the freeze — what the long tail looks like

Most pages stop at “call 1930.” But recovery has a long tail, and knowing its shape keeps you from giving up too early or expecting too much too soon. Here’s what realistically happens over the weeks after the golden hour.

If the lien caught the money. The funds sit frozen in the beneficiary account under the temporary hold (around 7 working days initially). Releasing them back to you is not automatic — it runs through the legal/police process, because the bank can’t just hand a frozen balance to a claimant without due process. This is where your FIR and NCRP case do their work: they provide the legal basis for the funds to be returned to the rightful owner. It can take weeks, sometimes longer, and you may need to respond to the investigating officer or even a court order directing release. Frustrating, but this is recovery actually working — the money exists and is held; the process is releasing it. Stay reachable and keep your reference numbers handy.

If the bank dispute lands. For a clean unauthorised-transaction claim filed within 3 working days, the provisional credit by day 10 often becomes permanent once the bank’s investigation confirms the transaction was unauthorised, within the 90-day window. If the bank wrongly denies it, the Ombudsman is your free escalation, and these cases are frequently decided in the customer’s favour when the timeline and documentation are clean — which is exactly why the written paper trail mattered so much on day one.

If the money was layered or fictional. Be honest with yourself here. A balance that was never a real credit, or rail money already mule-layered beyond reach, may simply not come back. The NCRP/FIR case stays open and can yield recovery if investigators dismantle the network and trace funds (it happens), but you should not organise your life around it or, worse, pay a “recovery agent” promising to retrieve it. Treat anything that does come back as a bonus, and put your energy into the parts of the loss that are genuinely reachable.

Across all cases — the durable fix. The thing that actually protects your money going forward is changing how you handle “support” and “winnings”: only ever use in-app support (never a Googled number), never install remote-access apps, never pay to be paid, never share OTP/PIN, and stay out of discontinued money games entirely post-PROGA. The recovery system is good but partial; the fraudsters race it and often win. Your real edge is never being slow on the rare occasion you’re hit — and ideally never being in the structure at all. The safe way to reach genuine support is mapped on customer-care-escalation.

Why the money is hard to claw back — the mule-account economy

It helps to understand the machine you’re racing, because it explains both why speed wins and why patience after the freeze is normal rather than a sign of failure. The reason a fraud loss is hard to reverse isn’t that nobody’s trying — it’s that the money moves through an industrialised laundering layer built to outrun exactly the recovery system chasing it.

Where your “deposit” actually lands

When you pay a fraudster, the money almost never goes to a company account you could sue. It lands in a mule account — a real, KYC’d bank account that belongs to a third party who has rented, sold, or been tricked into lending it. Mule recruiters target students, gig workers, and the financially desperate with “earn ₹10,000 to let us use your account” offers; some mules are themselves scam victims who never realise their account became a laundering node. The fraudster then layers: within minutes, the first mule splits your money and forwards it through a chain of further mule accounts, often across different banks, sometimes converting to cash or crypto at the end. Each hop is designed to break the audit trail by one more link.

This is precisely why the golden-hour lien matters and why it has a hard edge. The CFCFRMS alert reaches the first mule’s bank. If your money is still there, it freezes — caught before layering completes. If it’s already two hops down, the single lien is chasing a target that has split and scattered, and now recovery depends on investigation dismantling the whole network rather than one fast freeze. Indian police have arrested operators running crore-scale frauds purely on mule-account infrastructure, which is the plumbing behind the Telegram trading scams and fake-gaming-app drains alike. The arrests happen; they just happen on investigation time, not golden-hour time.

Why “deposit to withdraw” can never be legitimate — the mechanical proof

Hold onto this, because understanding it as mechanically impossible (not merely “suspicious”) makes it far easier to refuse under pressure. A real withdrawal is the operator pushing money to you over the rail; it costs the operator nothing from you to do it. There is no mechanism in UPI, IMPS, or NEFT where a recipient must pay in order to receive a credit — a credit just lands. So a demand that you deposit before you can withdraw is not a fee for a service; it’s a second deposit wearing a costume, because the only thing the scammer can actually extract is more of your money. There is no version of reality in which a legitimate payout requires you to pay first. That clarity is your armour: when the “30% withdrawal tax” or “margin top-up” appears, you’re not weighing a judgement call — you’re looking at a logically impossible request, which means a scam, every time.

The second-scam epidemic: “recovery agents”

The cruellest part of the mule economy is its sequel. Once you’ve been defrauded and have publicly searched for help — posted in a complaints group, Googled “how to recover scammed money,” left a review — you become a marked target for a second wave: the “recovery agent,” “ethical hacker,” or “refund officer” who promises to retrieve your lost money for an upfront fee. It is the same fraud, re-aimed at the same wound, and it works because a desperate victim wants to believe recovery is one payment away.

The defence is a single, absolute rule: legitimate recovery is free. Every real channel — 1930, NCRP, your bank, the chargeback rails, the RBI Ombudsman — costs you ₹0 and never asks for an OTP or PIN. So the test is trivial: anyone who asks you to pay to get your money back is scamming you again. Report that offer to 1930 as its own fraud. The fact that the recovery-agent scam exists at all is the strongest reason to run the official, free channels yourself and trust no paid intermediary — a warning the red-flag guide drives home because it catches people precisely when they’re most vulnerable.

The mule-economy takeaway in one line: your money is hard to recover because it’s engineered to vanish through rented accounts within minutes, which is why the golden-hour freeze is your one real shot at the easy win and why everything after it runs on slower investigation time. Understand that the “fee to withdraw” is mechanically impossible to be real, refuse every “recovery agent,” and put your speed where it counts — the first phone call.

Reporting and recovery contact reference

Keep this handy — these are the only doors you need, and every one of them is free.

The order in one line: a fraud runs 1930 → cybercrime.gov.in → your bank’s fraud desk in the first hour, then bank dispute (3 working days) → chargeback (if card) → FIR (if large/stalled) → Ombudsman (after 30 days). Note there are only two phone numbers you should ever trust here — 1930 (cybercrime) and 1915 (consumer) — plus your own bank’s official number. Any other “helpline” or “recovery” number is a scam, full stop, which is the whole warning of the red-flag page.

FAQ

1. How fast do I have to act to recover money from a gaming fraud? Inside the golden hour — ideally the first 30–60 minutes, with a practical outer edge around 4 hours. The I4C CFCFRMS system places a lien on the beneficiary account via 1930, but only if the money is still parked there. Fraudsters mule-layer funds within minutes, so a lien placed 40 minutes late often hits an empty account. India’s system has saved over ₹7,130 crore across 23 lakh-plus complaints, almost all of it golden-hour recovery. Call 1930 before doing anything else.

2. What’s the very first thing I do after realising I was scammed? Call 1930. Not gather screenshots, not email the app — dial 1930 so the lien request reaches the beneficiary bank while the money may still be there. Then, in order: file at cybercrime.gov.in for your acknowledgement number, call your bank’s fraud desk to start the 3-working-day unauthorised-transaction clock, and lock your exposure (change PIN/passwords, kill any remote-access app). Four steps, one hour, that order.

3. Will RBI’s zero-liability rule get my money back? For a genuinely unauthorised debit (an AnyDesk takeover or cloned card), yes — report within 3 working days and your liability is zero under RBI circular DBR.No.Leg.BC.78 (6 July 2017), with provisional credit within 10 working days and resolution within 90 days. It’s murkier if you were tricked into authorising the payment yourself (entering your own PIN for a “fee”); banks may contest that, so lean on the golden-hour freeze there. File the dispute either way — many tricked-authorisation cases still win, especially at the Ombudsman.

4. The app shows a big balance but won’t pay unless I deposit a “fee” — can I recover the balance? The on-screen balance was almost certainly never real money — it’s a display string to make you deposit more, so there’s nothing there to recover. What you can fight for is the real money you paid as the “fee/deposit”: treat each such payment as a fraud loss, capture its UTR, and run the golden-hour report. Never pay the “fee” — no legal app requires a deposit to withdraw, and post-PROGA a fresh deposit is illegal.

5. A fake “customer care” number drained my account — what now? Run the standard golden-hour sequence (1930 → NCRP → bank), and lead your report with the fake number you called, the call time, and every UTR that followed. Because most legal RMG apps have no public helpline, scammers plant fake numbers in search results — so the app may be legitimate while the contact was the fraud. If you shared an OTP/PIN or granted remote access, also change your PIN/passwords and uninstall the app immediately. Find real support safely via customer-care-escalation.

6. I deposited with my credit/debit card — is a chargeback worth it? Yes — run it as a second track. You generally have 120 days from the transaction to raise a chargeback through your card issuer for fraud/unauthorised/non-delivery, though banks set shorter internal deadlines, so dispute immediately. Expect provisional credit, a ~45-day merchant-defence window, and a final outcome in roughly 60–90 days. File the chargeback alongside the 1930/NCRP report and the bank dispute — three angles on the same loss.

7. Should I file a police FIR, and how? For large losses or stalled recovery, yes. Filing on cybercrime.gov.in already engages the cyber-police, and under the e-Zero FIR initiative (live since May 2025), a fraud above ₹10 lakh auto-registers a Zero FIR. Otherwise, take your NCRP acknowledgement and evidence to a cyber-crime cell or any station and insist on a Zero FIR if they question jurisdiction — by law they must register and transfer it. Get the FIR copy and number; it anchors any fund-release order.

8. What are my realistic chances of getting the money back? Good in the first hour, poor after a day, near-zero for a fictional balance. Rail money still in the first beneficiary account is the recoverable kind; once it’s mule-layered, the easy freeze is gone. Nationally, the system has blocked/saved ~₹8,000 crore out of ₹22,845 crore lost in 2024 — roughly a third blocked, and less actually returned to victims. So odds hinge almost entirely on speed. Fight hardest for real rail money; don’t organise your hopes around a fake on-screen number.

9. Someone offered to recover my money for an upfront fee — legit? No — it’s a second scam. Real recovery through 1930, NCRP, your bank, and the Ombudsman is free. “Recovery agents,” “ethical hackers,” and “refund officers” who charge a fee to “release” your funds are hunting fresh victims at their lowest moment. You never pay anyone to get your own money back. Report that offer to 1930 as well — it’s a fraud in its own right.

10. How long until I actually see money returned? It varies by track. A clean unauthorised-transaction claim should bring provisional credit by day 10 and final resolution within 90 days. A chargeback runs roughly 60–90 days. Frozen (lien’d) funds are released through the legal/police process, which can take weeks or longer, because a bank can’t hand over a frozen balance without due process. Stay reachable, keep your reference numbers, and respond fast to any officer or bank request.

11. I shared an OTP / UPI PIN / AnyDesk code — is everything gone? Not necessarily, but act as if the account is compromised. Immediately change your UPI PIN and net-banking password, uninstall the remote-access app, and call your bank to block/relimit the account — this stops the next debit even if the first already fired. Then run the golden-hour report for whatever left. The RBI has explicitly warned about AnyDesk-style takeovers; a genuinely unauthorised takeover transfer is also your strongest zero-liability case under the 3-working-day rule.

12. A Telegram “manager” took my deposits for “guaranteed returns” — what do I report? This is an investment fraud in a gaming costume — report it the same way, leading with the group/handle, the “manager’s” contact, and the UTRs of every real deposit you made (the “profit” on screen was fictional). India lost roughly ₹6,000 crore to this scam family in 2024. Run 1930 → NCRP → bank, and if the loss is large, push for a Zero FIR. The “withdrawal tax / unlock fee” they demanded is the tell — never pay it.

13. My money went to a random person’s account, not a company — can it still be traced? Yes — that “random person” is almost always a mule account, a real account rented or coerced for laundering, and the CFCFRMS lien targets exactly that first account. If you’re fast, it’s frozen before the fraudster layers it onward. Give 1930 and the NCRP form the beneficiary UPI/phone/account precisely — that detail is what the lien and the investigation act on. Speed is everything because layering happens in minutes.

14. The fraud app vanished and my withdrawals went silent — is recovery possible? For the real deposits you made (rail money), run the golden-hour report and pursue the bank/chargeback tracks; for the on-screen “balance,” assume it was never a real credit. First, though, rule out a legitimate PROGA wind-down — a real operator that stopped cash games but still processes withdrawals through a working KYC’d flow is a slow payout, not a vanish, and you’d pursue it via the withdrawal recovery page. A fraud vanish goes dark on everyone at once with no accountable entity — that one you report to 1930/NCRP.

15. When should I NOT use 1930 / the fraud route? When it’s a delay, not a fraud — a real operator with KYC/TDS that simply hasn’t paid yet. Calling 1930 for a normal stuck payout wastes a helpline meant for crime, and the right tool is the escalation ladder (app → bank/UPI dispute → NPCI → RBI Ombudsman) on the refund-dispute hub. If you’re unsure which you’re in, run the scam vs delay check first — a wrong diagnosis wastes the exact time recovery depends on.

Sources & method. The recovery mechanics and legal points on this page are built from primary and reported sources, not personal experience. Key references: India’s I4C / CFCFRMS fraud-recovery system and the 1930 cybercrime helpline (over ₹7,130 crore blocked/saved across 23.02 lakh+ complaints to late 2025) against ₹22,845 crore lost to cyber fraud in 2024; the National Cyber Crime Reporting Portal (cybercrime.gov.in) and its 14-digit acknowledgement; the I4C e-Zero FIR initiative (live May 2025, auto-FIR above ₹10 lakh); the golden-hour lien mechanism (CFCFRMS lien request to the beneficiary bank, ~7-working-day hold) and the mule-account layering it races; RBI’s “Limiting Liability of Customers in Unauthorised Electronic Banking Transactions,” circular DBR.No.Leg.BC.78/09.07.005/2017-18 (6 July 2017) — zero liability if reported within 3 working days, limited liability for 4–7 working days, 10-working-day provisional credit, 90-day resolution; the card-network chargeback rules (120-day dispute window) and the RBI Integrated Ombudsman Scheme 2021 (RB-IOS) at cms.rbi.org.in; and the Promotion and Regulation of Online Gaming Act, 2025 with Rules effective 1 May 2026. This page is information, not legal or financial advice — verify each step against your bank’s fraud policy and the live guidance at cybercrime.gov.in before acting.