Phishing Email Complaint: What to Do and Where

A phishing email is a message that pretends to be from your bank, a courier, a tax office or a colleague, and pushes you to click a link, open an attachment or pay money. If you have not acted yet, do not click. If you have clicked or paid, stop, secure the account, and report to the bank, the cyber cell and the platform, in that order.

When this matters

This applies to anyone who receives a mail asking for KYC, a refund, an invoice or a small verification payment, and to businesses whose executives, accounts staff or customers are targeted. Phishing arrives by email, SMS and WhatsApp; the complaint route and the evidence are broadly the same. Where credentials are stolen, the fallout quickly becomes cyber fraud, and speed decides how much can be recovered.

How to read a phishing mail

• The sender domain. Look at the full address after the @ symbol, not the display name. A bank writes from its own domain; a fraudster uses a free mail service or a look-alike domain.
• The link. Hover over the link and read the real destination before clicking. Look-alike domains swap letters, add a hyphen, or add a second word to a genuine name.
• Urgency. Phrases such as your account will be blocked in 24 hours, or a final reminder, are designed to stop you checking.
• The payment demand. A small verification or customs clearance fee, a QR code, or a UPI ID printed in the mail, is a strong sign of fraud.
• The attachment. An unexpected .html, .zip or macro-enabled document is a delivery mechanism, not a document.
• The greeting. Dear customer instead of your name, and a reply-to address that differs from the sender, are common tells.

If you clicked or paid: what to do immediately

• Change the password of the account you entered, from a clean device, and sign out all sessions.
• If you typed card details, call the bank and block the card.
• If you made a payment, call the bank and the 1930 helpline at once and report the transaction ID; the earlier the report, the better the chance the beneficiary account is stopped.
• Raise a dispute with the bank, referring to the RBI circular that limits a customer's liability in unauthorised electronic banking transactions where the delay is not the customer's fault.
• If a work account was compromised, tell your IT team so they can revoke sessions and reset credentials.

The complaint routes

• The bank or payment provider for a failed or fraudulent transaction, in writing, with the reference number.
• The cyber cell through an FIR under Section 173 BNSS 2023 (formerly Section 154 CrPC) at the local station or cyber cell, and a report on the National Cyber Crime Reporting Portal with the 1930 helpline.
• The platform to report the mail to the provider so the sender is flagged, and to report the fake domain to its registrar and host.
• The magistrate where the police do not act, through an application under Section 175(3) BNSS 2023 (formerly Section 156(3) CrPC).

The offences that may apply

Depending on the conduct, the offences can include identity theft under Section 66C of the Information Technology Act 2000, cheating by personation using a computer resource under Section 66D, and computer-related offences under Sections 43 and 66. On the criminal side, cheating is punishable under Section 318 of the Bharatiya Nyaya Sanhita 2023 (formerly Sections 415 and 420 of the Indian Penal Code 1860), and cheating by personation under Section 319 BNS 2023 (formerly Sections 416 and 419 IPC). Our cyber law practice handles the complaint and the bank dispute together.

Evidence to preserve

• The full mail with headers, not just a screenshot, exported as a file. Headers carry the sender's real routing and are what a cyber cell examines.
• The transaction record: the bank statement entry, UPI reference or card message, with the amount, date and beneficiary.
• The link, copied without clicking again, and the page it opened.
• The acknowledgement and reference numbers from the bank, the portal and the platform.
• Any follow-up calls or messages from the fraudster.

Internal controls for a business

• Turn on multi-factor authentication for email, banking and cloud accounts.
• Publish SPF, DKIM and DMARC records so outsiders cannot easily spoof your domain.
• Require a call-back on a known number before any change to supplier bank details.
• Use dual authorisation for payments above a threshold.
• Train staff to report a suspicious mail internally, and name one person responsible for following it up.

A business response has both a technical and a legal side; speak to the office before you reply to the fraudster or negotiate.

Common questions

Can I get my money back after paying a phishing link?

Sometimes. If you report on the 1930 helpline and to the bank within hours, the beneficiary account can be frozen before the money is withdrawn. Recovery depends on speed and on whether the funds are still traceable.

Is clicking a link a crime on my part?

No. Being deceived is not an offence. What matters is that you report promptly, because a delayed report can reduce what the bank is obliged to refund in an unauthorised transaction.

Do I need an FIR or is the portal report enough?

The portal report and the 1930 call start the recovery process. An FIR under Section 173 BNSS 2023 is what gives the investigation legal footing, and it is needed if the matter later goes to court or if the bank asks for a police record.

How do I prove the mail was phishing?

The mail with full headers, the look-alike sender domain, the link destination and the transaction record together establish it. Keep the original mail in your mailbox and do not delete it, because its headers are the evidence.

Never negotiate with the fraudster; the bank, the portal and the police are the only routes that work. FileX Advocates & Legal Consultants, Kolkata, drafts and files these matters before the Calcutta High Court, City Civil and Sessions courts, magistrate, family, consumer and tribunal forums. Call +91 7439811422 or WhatsApp us for a free first consultation.