For years, one of the cruellest aspects of cyber fraud in India was not just losing money, but discovering that even when police successfully traced and froze it, getting it back could take months of paperwork, court visits and bureaucratic follow-up. The Indian Cyber Crime Coordination Centre has now introduced a system designed to close that gap. The Money Restoration Module, launched in June 2026 under the Union Ministry of Home Affairs, allows victims to apply directly for the return of funds once they have been traced and held in a fraudster’s account.
The launch came during a review of the national cybercrime helpline 1930, chaired by Union Home Minister Amit Shah, alongside a companion mechanism called the Grievance Redressal Mechanism for account holders whose bank accounts are wrongly frozen during investigations. Together, the two portals mark an attempt to modernise a recovery process that officials had long acknowledged was too slow to keep pace with fast-moving fraud networks.
From Manual Chase to Digital Claim
Under the earlier system, a victim whose money had been frozen midway through an investigation typically had to visit police stations and bank branches repeatedly, often producing the same documents multiple times before any refund moved forward. The Money Restoration Module replaces much of that manual chase with an online claim process built directly into the National Cyber Crime Reporting Portal.
Once investigators successfully place a hold on fraud proceeds sitting in an accused or beneficiary account, the victim receives an automated notification containing a secure link to begin the restoration request. The claim is then checked against the original complaint, and the victim may be asked to verify their complaint number and bank account details before a request number is generated for tracking.
Crucially, a frozen amount is not automatically returned. The concerned bank, the investigating police station and other verifying authorities must confirm the records and the claim before restoration proceeds. Officials reviewing cybercrime cases in Uttar Pradesh have said that once banks upload the relevant details, victims receive an SMS with the restoration link, and the refund moves ahead only after police verification is complete.
The Threshold That Decides an FIR
One detail victims are advised to note carefully concerns the amount involved. According to officials, restoration of sums below ₹50,000 does not require an FIR or a court order, allowing smaller claims to move through a lighter process. Amounts above ₹50,000, however, require a formal FIR to be registered before restoration can proceed, reflecting the greater scrutiny larger sums attract.
This distinction matters because it shapes how quickly a victim should act after realising they have been defrauded. Since fraudulent funds are frequently layered across a chain of mule accounts within hours, the window in which police can successfully freeze money before it disappears further remains narrow. Cyberabad Police in Telangana, drawing on the same MRM framework, restored more than ₹25 crore to cybercrime victims between January and July 2026, an outcome officials attributed directly to faster tracing enabled by the new digital process.
Reporting Speed Remains the Real Safeguard
Cybercrime experts continue to stress that the restoration module only works once fraud has already been reported and funds have been frozen, making the initial act of reporting still the single most decisive step for any victim. Calling the 1930 helpline or filing a complaint on the National Cyber Crime Reporting Portal immediately after discovering a fraud gives investigators the best chance of stopping money before it moves beyond reach.
Victims are also being cautioned about a secondary risk emerging alongside the new system. Officials have warned against sharing OTPs, PINs or banking passwords with anyone claiming to assist with a restoration claim, and against paying any additional sum in the name of releasing frozen money, since such approaches themselves carry the hallmarks of fraud. Preserving transaction identifiers, bank statements, suspicious phone numbers and chat records remains essential, both for the original investigation and for supporting any restoration request that follows.
