Finding out that you’ve had your bank account hacked can be extremely nerve-racking when you see inexplicable withdrawals, UPI transactions, credit card payments, or even online transfers. Hacking may happen as a consequence of email phishing, stolen identity, malware programs, SIM swapping, compromised passwords, or hacked devices. The first 24 hours are vital for people who are victims of hacking, they should contact their bank, block access to their accounts, report the crime, make sure that their accounts are secure, and collect all necessary evidence.
Why the First 24 Hours Are Critical
When unauthorized activity is detected, each and every minute can matter.
Fraudsters may attempt to:
- Transfer additional money;
- Make repeated UPI payments;
- Withdraw cash;
- Use debit or credit cards;
- Change banking credentials;
- Modify registered mobile numbers or email addresses;
- Misuse internet banking;
- Open or access other financial accounts; or
- Use the stolen personal information for any further fraud.
Taking action right away can prevent more financial losses and provide proof that the accountholder responded quickly after noticing an unauthorized activity.
So, the containment must come first, not the investigation. The victim should first stop further access and then gather evidence and pursue recovery.
Identify What Has Been Compromised
Before taking further action, identify what appears to have been affected. Check:
- Bank account statements;
- SMS and email alerts;
- UPI transaction history;
- Debit and credit card transactions;
- Internet banking activity;
- ATM withdrawals;
- Unfamiliar beneficiaries;
- Changes to contact details;
- Suspicious login alerts; and
- Transactions that you did not authorize.
The unauthorized activity should be recorded carefully.
For each suspicious transaction, note:
- Date and time;
- Amount;
- Transaction reference number;
- Transaction method;
- Beneficiary details, where available;
- Bank or wallet involved; and
- Any SMS, email, or notification received.
Do not delete the messages or transaction alerts, even if they appear suspicious.
Immediately Contact Your Bank
In order to do this, the first step that is required is to reach out to the bank using its official customer care phone number, mobile banking application, or other approved communication channels.
Notify the bank that the account has encountered unauthorized activity that seems suspicious and request immediate preventive measures.
Depending on circumstances, ask the bank to:
- Block the debit card;
- Disable internet banking;
- Disable or restrict UPI transactions;
- Freeze or restrict the affected account where appropriate;
- Block unauthorized beneficiaries;
- Stop pending transactions, if possible;
- Reset banking credentials; and
- Register the complaint as an unauthorized transaction or fraud complaint.
Obtain the complaint/reference number from the bank.
It is important to communicate with the bank through official channels rather than responding to an unknown caller who claims to be a bank representative.
Block Cards and Digital Banking Access
In the event of any potential compromise regarding your debit or credit card, you should block the card in question without delay. Likewise, if you believe that your online banking credentials have been compromised, you should also change your password via your bank’s official site or app right away.
If UPI credentials or access appear compromised, take immediate steps to disable or secure UPI services through the bank or relevant application.
Where a mobile phone itself has been compromised, simply changing the banking password may not be sufficient. The device should be secured before sensitive accounts are accessed again.
If at all you suspect that your SIM has been compromised or suddenly stopped working without explanation, contact all your telecom service provider immediately and then investigate the possibility of the unauthorized SIM activity.
Report Unauthorized Transactions Immediately
Do not wait for the bank to automatically reverse transactions.
Report each and every unauthorized transaction to the bank as soon as it is discovered.
- The complaint needs to clearly state:
- That the transaction was not authorized by you;
- When you first discovered it;
- The amount involved;
- The transaction reference number;
- Whether your card, phone, UPI, or internet banking credentials were compromised; and
- What immediate steps you have already taken.
Keep all the copies of emails, complaint forms, screenshots, transaction statements, as well as the acknowledgment messages.
The timing of the report can be particularly important when the bank assesses the circumstances surrounding the unauthorized electronic transaction.
Call the Cybercrime Helpline and File a Complaint
Victims of money loss due to cyber fraud in India should report the event immediately via the 1930 National Cyber Crime Helpline and the cyber crime reporting procedures followed by authorities.
The objective behind the prompt reporting is to inform concerned officials and banks of the fraudulent transaction.
A cybercrime complaint should contain accurate information such as:
- Victim’s details;
- Bank account information;
- Transaction details;
- Amount lost;
- Date and time of fraud;
- UPI ID, account number, mobile number, or other available beneficiary details;
- Screenshots;
- Bank complaint/reference number; and
- Details of communication with the suspected fraudster.
The victim should preserve the complaint acknowledgment for future follow-up.
If the circumstances warrant, a complaint may also be made before the appropriate police or cybercrime authorities.
Secure Your Mobile, Email and Online Banking Accounts
A compromised bank account may be connected to a larger security problem.
If at all the fraudster obtained access to your email, phone, or any other online accounts, then the banking credentials may not be only information at risk.
Immediately consider securing the:
- Primary email account;
- Banking applications;
- UPI applications;
- Payment wallets;
- Social media accounts;
- Cloud accounts; and
- Other accounts containing financial or identity information.
Make use of powerful and unparalleled passwords and activate multi-factor authentication if it is accessible.
Do not apply the same password more than once in transactions involving banking, email, and any other significant accounts.
If you may think that there is malware or remote access software on your computer or phone, refrain from entering any banking information using the device until it is completely secured and safe to use.
Preserve Evidence of the Cyber Fraud
Evidence can become extremely important when seeking recovery of money or pursuing legal action. Preserve:
- Bank statements;
- SMS alerts;
- Emails;
- UPI transaction records;
- Screenshots;
- Transaction IDs;
- Call logs;
- WhatsApp or other chat conversations;
- Suspicious links;
- Emails containing phishing links;
- Details of phone numbers used by fraudsters;
- Recordings or other communications where lawfully available; and
- Copies of complaints submitted to the bank and cybercrime authorities.
Do not edit screenshots or alter digital evidence.
It is also advisable to maintain a chronological record of what happened—from the first suspicious activity to the bank complaint and cybercrime report.
What Should You Not Do After Your Bank Account Is Hacked?
Victims frequently make mistakes because of panic. You should avoid:
- Waiting several days before reporting the transaction;
- Transferring additional money at the request of an unknown caller;
- Sharing OTPs, PINs, CVV, passwords, or UPI PINs;
- Clicking suspicious links;
- Deleting evidence;
- Negotiating privately with suspected fraudsters;
- Paying a person who promises guaranteed recovery of the stolen money; or
- Using unofficial customer-care numbers found through random internet searches.
The fraudsters may also contact the victims after the original fraud and claim that they can recover money for a fee. Such kind of communications should be treated with extreme caution.
Legal Rights and Bank Liability in Unauthorized Transactions
Bank customers may have protection under applicable banking and regulatory frameworks concerning unauthorized electronic banking transactions.
- The circumstances can vary depending upon factors such as:
- Whether the transaction was genuinely unauthorized;
- How quickly the customer informed the bank;
- Whether the customer shared credentials;
- Whether negligence contributed to the transaction;
- Whether the fraud resulted from a system or security failure; and
- The applicable banking and regulatory rules.
Therefore, there is no universal rule that every hacked-account loss will automatically be refunded.
Customers should promptly notify the bank and cooperate with its investigation.
The bank should also provide appropriate information regarding the complaint and the steps available for grievance redressal.
What If the Bank Refuses to Help?
If the bank fails to respond to the complaint appropriately, the customer should first confirm that they have lodged a formal complaint and received the necessary reference number. The customer can then seek the bank’s internal grievance redress mechanism.
Depending on the facts and the response received, further remedies may be available through the appropriate regulatory or legal forum.
A lawyer can assist in examining:
- Bank correspondence;
- Transaction records;
- Customer authentication details;
- Complaint history;
- Applicable banking regulations;
- Evidence of negligence or unauthorized access; and
- Possible recovery proceedings.
The most appropriate remedy will mostly depend on facts of each and every individual case.
Practical Steps to Prevent Further Financial Loss
After securing the account, take preventive measures to reduce the possibility of another incident. These include:
- Regularly checking bank statements;
- Enabling transaction alerts;
- Using strong and unique passwords;
- Enabling multi-factor authentication;
- Keeping banking applications updated;
- Avoiding public or unsecured networks for sensitive transactions;
- Never sharing OTPs or UPI PINs;
- Verifying payment requests before approving them;
- Avoiding unknown links and attachments;
- Keeping your mobile operating system updated;
- Installing applications only from trusted sources; and
- Immediately reporting suspicious transactions.
Remember that the banks, payment companies, as well as the government authorities generally do not require the customers to disclose the confidential authentication credentials such as the OTPs, PINs, passwords, or the CVV numbers over unsolicited calls.
How Lead India Can Help?
Lead India can assist victims of bank fraud and cybercrime by:
- Providing legal guidance regarding unauthorized bank transactions;
- Helping understand the appropriate complaint and recovery process;
- Assisting with documentation and legal notices;
- Examining correspondence exchanged with the bank;
- Assisting with disputes concerning unauthorized transactions;
- Guiding victims regarding available legal and grievance-redressal remedies; and
- Helping protect the victim’s legal and financial interests.
In case of massive financial loss, taking professional legal counsel as soon as possible is important for gauging the options available.
When the bank account has been hacked, it is crucial to act immediately. During the first 24 hours, one should halt any further transaction, contact the bank, block banking services that have been hacked, file a report on the fraud, secure linked accounts, and collect legal proofs. Avoid having any dealings with fraudsters or giving them the One-time Passwords (OTP), Personal Identification Numbers (PIN), passwords, or anything else related to banking activities.
One can talk to lawyer from Lead India for any kind of legal support. In India, free legal advice online can be obtained at Lead India. Along with receiving free legal advice online, one can also ask questions to the experts online free through Lead India.
FAQs
1. What should I do first if at all my bank account is hacked?
Immediately you can contact your bank through the official channel, report the unauthorized transaction, as well as request for appropriate blocking or security measures. Then report the cyber fraud through the appropriate cybercrime reporting mechanism.
2. Can I recover money stolen from my bank account?
Recovery may be possible depending on the circumstances, including the nature of the transaction, how quickly it was reported, applicable banking rules, and the findings of the bank and investigating authorities. Recovery cannot be guaranteed in every case.
3. Should I report fraud to the bank even if the amount is small?
Yes. Each and every unauthorized transaction should be reported promptly so that the bank can investigate the transaction and take the appropriate security measures.
4. What is the 1930 cybercrime helpline?
1930 is India’s National Cyber Crime Helpline for reporting financial cyber fraud and seeking prompt assistance in such cases.
5. What evidence should I preserve after a bank fraud?
Keep the records of transactions intact like bank statements, messages, emails, screenshot images, identifying codes, dubious phone numbers and links, dialogues, phone calls, and copies of grievances to banks and cybercrime organizations.
Talk to a Lawyer