Paid an online seller who vanished? How to complain and recover your money

What the law says

Online seller fraud sits across two systems: the criminal law that punishes the fraudster, and the banking rules that decide who bears the loss.

The criminal side. Cheating someone by impersonation using a computer or communication device is an offence under Section 66D of the Information Technology Act, 2000. Fraudulently using another person's password, electronic signature, or unique identity feature is identity theft under Section 66C of the Information Technology Act, 2000. And cheating that dishonestly induces you to part with money is punishable under Section 420 of the Indian Penal Code, 1860. Importantly, the police cannot turn you away for a small loss. Courts have held that cyber crime cells must register online fraud complaints regardless of the amount involved, rejecting any minimum threshold.

Fraud is not the same as a failed sale. There is a line between a criminal fraud and an ordinary consumer dispute. If a genuine seller simply failed to deliver after taking payment, courts treat that as a civil or consumer matter, not criminal cheating, unless there was dishonest intent from the very start of the transaction. So a fake website or an impersonator who never meant to deliver is criminal cheating, while a real seller who defaulted is a deficiency-of-service dispute for the consumer forum. How you frame your complaint should match which one you are dealing with.

Who bears the money loss. The Reserve Bank of India's framework on unauthorised electronic transactions is the key to recovery. Where an unauthorised transaction results from a third-party breach, and you notify your bank within three working days, your liability is zero, and the bank must restore the money. Courts have held that the burden of proving customer negligence lies entirely on the bank, and that it cannot escape by simply pointing to an OTP. The important caveat: if you voluntarily shared sensitive credentials like your OTP, PIN, or MPIN, or installed a malicious app that authorised the transfer, the loss can shift to you once the bank cogently establishes that negligence.

Getting the money back. Fast reporting matters because tracing and freezing the funds early is what makes recovery possible. Where siphoned money is traced and put on hold in the fraudster's account, courts have allowed the victim to apply directly for the release and recredit of the frozen amount.

What you can do

1. Report immediately on the National Cyber Crime Reporting Portal or call the helpline 1930. Speed is decisive, because early reporting is what can get the money put on hold in the receiving account before it is withdrawn.
2. Notify your bank in writing at once. Under the Reserve Bank of India's rules on unauthorised electronic transactions, reporting a third-party-breach transaction within three working days gives you zero liability, and the burden of proving any negligence is on the bank.
3. Lodge a police complaint with the cyber crime cell and insist on registration. The police must register a cyber fraud complaint regardless of the amount lost, so a small sum is not a valid reason to refuse.
4. Preserve every piece of evidence: the transaction and UPI or bank transfer records, the seller's messages, the website address, order confirmations, and screenshots. This is what proves the fraud and the trail of money.
5. If your money is traced and put on hold in the fraudster's account, you can move an application before the court for the release and recredit of the frozen amount.
6. Match your remedy to the facts. If a genuine seller merely failed to deliver, that is a consumer dispute over deficiency of service, while a fake seller or impersonator who never intended to deliver is criminal cheating. Pursue the right forum for your situation.

Cases that matter

Megala Boominathan v. The Commissioner of Police, High Court of Madras (2024). After losing over two lakh rupees, the complainant was told the police only register cases for frauds above five lakh rupees. The court rejected that outright, holding that cyber crime cells must register all online fraud complaints on the National Cyber Crime Reporting Portal regardless of the sum, because prompt registration is what enables the money to be traced in time.

Dadha Pharma LLP v. Reserve Bank of India, High Court of Madras (2025). Funds were siphoned from a current account, and a police investigation confirmed the fraud, but the bank did not restore the money. The court held that in a disputed cyber transaction the bank cannot recover the loss from the customer unless it proves the customer's negligence, that the Reserve Bank of India's rules presume the customer's innocence in a third-party breach, and that the bank's remedy is to restore the funds and pursue the actual fraudster.

Jai Pal v. State of NCT of Delhi, High Court of Delhi (2024). The victim of a fraudulent online trading scheme saw the siphoned money traced and put on hold in the account used to receive it. The court noted that where cheated funds are frozen in the suspect's account, the victim can move an application for the release and restoration of those amounts. It shows the practical payoff of reporting fast enough to freeze the money.

Lalitkumar v. State of Maharashtra, High Court of Bombay (2025). A buyer paid for goods that were never delivered and filed criminal cheating charges. The court quashed them, holding that a mere failure to deliver after payment does not amount to criminal cheating under Section 420 of the Indian Penal Code, 1860 or personation under Section 66D of the Information Technology Act, 2000 without proof of dishonest intent from the outset. It marks the line between a criminal fraud and a civil dispute.