The Fork in the Road at 2 AM
It is past midnight. Someone has cleaned out forty thousand rupees from your account through a fake delivery link. Your phone is buzzing with bank alerts. You open Google and the search results yell two different things at you: "File at cybercrime.gov.in." "Go straight to the police station." Some blogs say dial 1930. Some say only an FIR will work. You feel like every minute you waste reading is a minute the money slips further away — and you are right. The frustrating part is that nobody tells you these are not alternatives. They are layers of the same system.
This guide is for the person standing exactly there. We will explain what a cyber complaint is, what an FIR is, when one is enough, when both are needed, and what the law — both the Information Technology Act, 2000 (IT Act) and the new Bharatiya Nagarik Suraksha Sanhita, 2023 (BNSS) which replaced the Code of Criminal Procedure, 1973 (CrPC) from 1 July 2024 — actually requires.
What Each Tool Actually Is
Cybercrime.gov.in and the 1930 helpline
The National Cybercrime Reporting Portal — cybercrime.gov.in — is run by the Indian Cyber Crime Coordination Centre (I4C), an arm of the Ministry of Home Affairs. The associated helpline number is 1930. Together they form a single national reporting and rapid-response system. The portal feeds your complaint to the cyber cell of the state in which the offence is reported, and the helpline has a real-time link with banks and payment aggregators to flag and freeze suspicious accounts.
What the portal is not is a court. It cannot, by itself, summon the accused, issue warrants, or direct trial. For that, you need an FIR.
The FIR under BNSS Section 173
The First Information Report is the formal record of a cognizable offence registered at a police station. The provision is now BNSS Section 173 — the section that replaced Section 154 of the CrPC — and it reads, in substance:
Every information relating to the commission of a cognizable offence... shall be reduced to writing by [the officer in charge of a police station] or under his direction... and a copy thereof shall be given forthwith, free of cost, to the informant.
The FIR is the trigger that legally starts the criminal investigation. Without it, no formal investigation can take place, no arrest can be made on most cyber offences, and no chargesheet can be filed.
The Magistrate complaint
The third tool, often forgotten, is a private complaint to the jurisdictional Magistrate under BNSS Section 223 (old Section 200 CrPC). This is the bypass route when the police refuse to act. The Magistrate can either take cognizance directly or order an investigation under BNSS Section 175(3) (old Section 156(3) CrPC).
Which One Should I Pick First?
The honest answer depends on what kind of cyber crime has happened to you. The two flowcharts below capture the practical reality.
Flowchart 1: Money has left your account
UPI fraud, fake delivery scam, OTP theft, fake job registration fee, investment fraud, courier-package KYC scam — anything where a transfer has happened.
- 1930 first. Within minutes if possible. The helpline can flag the recipient bank account and freeze the funds.
- Cybercrime.gov.in second. Upload screenshots and the bank statement. The portal generates an acknowledgement number.
- FIR third. Visit the police station the same day or next morning, carrying the portal acknowledgement. Insist on FIR registration under BNSS Section 173.
The reason for the order is purely speed-of-money. Banks will not freeze on a complaint sent by the police; they freeze on a 1930 alert.
Flowchart 2: Identity, harassment or content offence
Fake profile, identity theft, online stalking, obscene messages, leaked photographs, blackmail through messaging apps. No money has left your account.
- FIR first. The police investigation, the platform takedown notice, and the criminal trial all flow from the FIR. Walk into the police station with your screenshots.
- Cybercrime.gov.in second. File the same complaint at the portal as a backup — many state cyber cells coordinate platform takedowns through this portal.
- Magistrate complaint third, only if the police refuse the FIR.
When the Police Must Register an FIR
The single most important judgment for a cyber-crime victim to know is Lalita Kumari v Government of UP (2014). A Constitution Bench of the Supreme Court held that:
Registration of FIR is mandatory under Section 154 of the Code, if the information discloses commission of a cognizable offence and no preliminary inquiry is permissible in such a situation.
In other words, once your complaint discloses a cognizable offence — Section 420 of the Indian Penal Code, 1860 (IPC) for cheating, Section 66C or 66D of the IT Act for identity theft and personation, Section 67 of the IT Act for obscenity — the SHO has no discretion. He must register the FIR. He cannot first "verify" or "ask the accused for his version".
The court did carve out a narrow exception: in matrimonial, commercial, medical-negligence and corruption matters, a brief preliminary inquiry of seven days may be permitted. None of those exceptions apply to ordinary cyber-fraud or impersonation cases.
If the Police Refuse to Register Your FIR
Refusal is illegal in cognizable cases — but it happens. The law gives you a layered escalation.
Step 1: SP under BNSS Section 173(4)
Send the same complaint, by registered post, to the Superintendent of Police of the district. BNSS Section 173(4) — old Section 154(3) CrPC — provides that on receipt, if the SP is satisfied that the information discloses a cognizable offence, he shall either investigate the case himself or direct an investigation by a subordinate.
Step 2: Magistrate complaint with 175(3) prayer
If the SP also fails, file a private complaint before the jurisdictional Magistrate under BNSS Section 223 (old Section 200 CrPC). Include a prayer for an order under BNSS Section 175(3) (old Section 156(3) CrPC) directing the police to register and investigate.
The Supreme Court in Sakiri Vasu v State of UP (2008) held that a Magistrate has wide incidental power under this provision to direct registration of an FIR and to monitor a fair investigation. The court said the power is not just to direct an investigation but to ensure the investigation proceeds on right lines. Suresh Chand Jain v State of MP (2001) confirms that the Magistrate, when ordering investigation under Section 156(3), is acting at a pre-cognizance stage — meaning he need not first record the complainant's statement on oath.
Step 3: Quashing or writ if even the Magistrate is unhelpful
If the Magistrate, too, declines without reasons, the High Court can be moved under its writ jurisdiction. This is rare but available. Most cyber-fraud refusals are resolved at Step 1 or Step 2. For a fuller treatment of FIR problems and refusals, see our dedicated cluster.
Zero FIR and e-FIR Explained
Zero FIR
BNSS Section 173 (like the old Section 154 CrPC) imposes the duty to register an FIR irrespective of where the offence was committed. Practically: if a Bengaluru-based scammer cheats a Delhi resident through a Mumbai bank account, the Delhi SHO is bound to register the FIR, label it "Zero FIR" — meaning no station serial number yet — and transfer it to the police station with territorial jurisdiction. This is critical in cyber crime, where the elements of the offence are almost always spread across states.
e-FIR
BNSS Section 173 specifically allows information about an offence to be given by electronic means. Most state police now run online FIR portals; for cyber-fraud, the federal cybercrime.gov.in is treated as the unified entry point. For serious offences, the e-FIR usually requires a physical signature within three days of registration to be confirmed — without it the FIR can be deemed not maintained.
Running Both Tracks in Parallel
The cyber complaint and the FIR are not rivals. They are designed to feed each other:
- Cybercrime.gov.in handles bank-account freeze, platform takedown coordination and complaint tracking.
- The FIR drives the criminal investigation, IP-log requests to platforms, arrest and chargesheet under BNSS Section 193 (old Section 173 CrPC).
- The Adjudicating Officer under Section 46 of the IT Act handles compensation up to five crore rupees for damages caused by acts that contravene the IT Act.
- A civil suit, where amounts exceed five crore or where the cyber angle is incidental, runs as the fourth parallel track.
Most working lawyers run all four where the facts justify it. If you would like a confidential walkthrough of which tracks fit your facts, the team at Pinaka Legal — Advocates & Solicitors, Delhi — handles cyber-fraud and online new-age scam matters every week.
What Should I Actually Do Now?
- Identify your category. Money lost: 1930 first. Identity or harassment: FIR first.
- Take screenshots before anything else. URLs, chats, transaction proof, sender's number, timestamp. Save originals on the phone.
- Call 1930 immediately if money has moved. Speak to the operator, give bank account or UPI ID, get the reference number.
- File at cybercrime.gov.in. Upload all screenshots. The portal is multilingual and works on a phone.
- Walk into the police station with a printed complaint. Insist on FIR registration under BNSS Section 173 read with the appropriate sections of the IPC and IT Act.
- If the SHO refuses, escalate. Send a registered-post complaint to the SP under BNSS Section 173(4). Keep the postal receipt.
- If the SP also fails, move the Magistrate. File a Section 223 complaint with a prayer under Section 175(3). For FIR refusal problems, our dedicated guide explains the format.
- Inform your bank in writing. Use the unauthorised-transaction form. Banks have their own time-bound grievance procedures.
- Maintain a chronology document. Date, action, reference number, person spoken to. This becomes your case spine.
- Do not negotiate with the offender. Anything you say can be twisted later. Let the police do the talking.
The Quiet Relief of Knowing the System
The internet feels lawless, but the law is actually quite well laid out for cyber-fraud victims. The Lalita Kumari ruling, the BNSS provisions on zero FIR and e-FIR, the Sakiri Vasu protections at the magistrate stage, the IT Act's Section 46 compensation route — all of it adds up to a system where someone who knows the steps has real options. The trick is to use cybercrime.gov.in and the FIR together rather than treating them as competitors. One stops the bleeding; the other catches the offender.
One night of clear thinking, four phone calls, three printouts and one police station visit will usually put you on the right track. Keep your screenshots, keep your acknowledgement numbers, and do not let anyone tell you that "small" cyber-fraud does not deserve an FIR. Under BNSS Section 173 read with Lalita Kumari, every cognizable cyber offence does.
Frequently Asked Questions
What is the basic difference between a cyber complaint and an FIR?
A cyber complaint at cybercrime.gov.in or 1930 is essentially information given to the police through an online channel and the national helpline. An FIR is the formal First Information Report registered under BNSS Section 173 (old Section 154 CrPC) at a police station, which legally starts the criminal investigation. A cyber complaint of a cognizable offence is required by law to be converted into an FIR; in practice, the conversion is automatic for fraud and impersonation matters but may need a follow-up visit for harassment-only cases.
Should I file a cyber complaint first or an FIR first?
For online financial fraud — UPI scam, fake job, OTP theft — call 1930 first, within minutes if possible, then file at cybercrime.gov.in. The reason is speed: the helpline can freeze the recipient bank account in real time. The FIR is filed in parallel or shortly after. For harassment, identity theft and content takedown, going directly to the police station for an FIR is usually faster, with the cyber portal as a back-up.
Is a cybercrime.gov.in complaint legally equal to an FIR?
Not automatically. The portal is a complaint-receipt system. Once your complaint discloses a cognizable offence, the law mandates registration of an FIR under BNSS Section 173, and the Supreme Court in Lalita Kumari v Government of UP held that registration in such cases is compulsory. In financial-fraud matters most state police automatically convert the portal complaint into an FIR; for other matters you may need to visit the cyber police station and ensure conversion happens.
What if my local police station refuses to register an FIR for a cyber crime?
You have a layered remedy. First, write to the Superintendent of Police under BNSS Section 173(4) (old Section 154(3) CrPC) asking the SP to direct registration. Second, file a private complaint before the Magistrate under BNSS Section 223 (old Section 200 CrPC) and pray for an order under BNSS Section 175(3) (old Section 156(3) CrPC) directing the police to register and investigate. The Supreme Court in Sakiri Vasu held that this Magisterial power is wide and includes monitoring a fair investigation. See our FIR problems guide.
Can I file an FIR online for a cyber crime?
Yes, in many states. BNSS Section 173 specifically allows information about an offence to be given electronically. For cyber-fraud, cybercrime.gov.in functions as the unified federal portal; in states like Delhi, Haryana, Maharashtra and Karnataka the police's own portals support full e-FIR for specific categories. For more serious offences, after the e-FIR you will be required to visit the police station within a few days to sign the formal FIR document.
What is a zero FIR and when does it apply to cyber crime?
A zero FIR is an FIR registered at any police station regardless of where the offence was actually committed. BNSS Section 173 (old Section 154 CrPC) makes registration of an FIR mandatory irrespective of territorial jurisdiction; the receiving station then transfers the FIR to the station having jurisdiction. This is critical in cyber crime because the offender's IP address, the victim, and the bank account into which money was paid are usually in three different states.
Is every cyber crime cognizable?
Most are, but not all. Section 66C and Section 66D of the IT Act, with three-year sentences, are cognizable and bailable. Section 67 (obscene content) is cognizable. Section 66E (privacy violation) is cognizable. Section 420 of the IPC (cheating) is cognizable and non-bailable. Where the offence is not cognizable — for example, certain pure defamation matters under the IPC — the police cannot register an FIR straight away; they take a non-cognizable report and you go to the Magistrate.
Can I withdraw a cyber crime complaint or FIR if the matter is settled?
A cyber complaint at cybercrime.gov.in can simply be marked closed by the cyber cell. An FIR is harder. Where the offence is compoundable under the BNSS schedule, the parties can compromise and ask the trial court to record it. Where it is non-compoundable, the only route is quashing under the inherent power of the High Court (old Section 482 CrPC, now BNSS Section 528). The Supreme Court has accepted quashing on settlement for many fraud-only matters.
How do I prove a cyber crime complaint or FIR — what evidence is needed?
Screenshots of chats, emails, websites and transactions are your core evidence. Under the Bharatiya Sakshya Adhiniyam, 2023 (old Indian Evidence Act, 1872), electronic records are admissible only with a certificate identifying the device and the manner of capture. Bank statements, IP logs from the platform and call records are obtained by the police through formal requests. Preserve the originals — never delete the source from your phone or computer until the trial is over.
Do I need to physically appear at a cyber police station?
For initial complaint, no — 1930 and cybercrime.gov.in are designed to be remote channels. For FIR confirmation, in most states yes — at least one visit is required to sign the formal complaint and to depose. At trial, the complainant has to appear before the Magistrate under BNSS Chapter 21 or Chapter 19 to identify documents and screenshots. Many cyber matters are now tried in summary trial where appearances are minimal.
Is an FIR public — will my name appear online?
FIRs of most non-sensitive matters are uploaded to state police websites within a few days of registration, in compliance with the Youth Bar Association of India v Union of India (2016) Supreme Court order. The complainant's name appears on the FIR copy, but redacted versions are common for sensitive cases. If your concern is privacy, mention it at the time of FIR registration and ask for the public copy to be redacted.
Will both a cyber complaint and an FIR run at the same time?
Yes, and they are designed to. The cyber complaint at the portal is the takedown and bank-freeze instrument; the FIR is the criminal-investigation instrument; the Adjudicating Officer claim under Section 46 of the IT Act is the compensation instrument; and where amounts are large, a civil suit can also run in parallel. The four tracks do not contradict each other and most lawyers run them together.
For more articles on Indian law, visit the Pinaka Legal Blog.