Cybercrime Complaint vs FIR in India 2026: 1930, NCRP, Zero FIR, e-FIR, Police Refusal, Magistrate Remedy & Electronic Evidence

By Adv. Govind Bali | Updated: 21 August 2026

Reporting a cybercrime through the National Cyber Crime Reporting Portal (NCRP) or the financial-cyber-fraud helpline 1930 is often the correct first step, but a portal complaint, helpline acknowledgement, diary entry and First Information Report are not necessarily the same legal document. This distinction becomes critical when the victim needs coercive police investigation, preservation of digital records, bank tracing, arrest, search, seizure, production orders or a formal criminal case.

Under the Bharatiya Nagarik Suraksha Sanhita, 2023 (BNSS), information relating to a cognizable offence is governed principally by Section 173. The provision expressly allows information to be given irrespective of the area where the offence was committed and permits it to be given electronically. If the information is sent electronically, however, it must be signed by the informant within three days for the statutory process contemplated by Section 173(1).

This article explains how 1930 and NCRP fit into the criminal-process framework, when a cyber complaint should result in an FIR, what “Zero FIR” means after BNSS, the difference between an electronic complaint and an e-FIR, what to do when police decline registration, how Sections 173(4) and 175(3) operate, and how victims should preserve electronic evidence under the Bharatiya Sakshya Adhiniyam, 2023.

Quick answer: Is an NCRP complaint the same as an FIR?

No, not automatically. An NCRP complaint is an official cybercrime report lodged through the Government’s cybercrime-reporting ecosystem. It can trigger verification, financial-fraud containment, inter-bank communication, cyber-police action and ultimately registration of an FIR. But whether an FIR has actually been registered must be verified from the police record and FIR number.

Recent Delhi High Court matters illustrate this distinction in practice. Courts have recorded cases where a victim first lodged a complaint on NCRP or called 1930 and a formal FIR was registered thereafter. The complaint and the FIR were therefore sequential stages, not interchangeable labels.

Document / action	What it usually means	Does it automatically mean an FIR exists?
1930 call	Rapid reporting of financial cyber fraud through the national helpline	No
NCRP complaint	Online cybercrime complaint / reporting record	No
Police diary / acknowledgement	Receipt or preliminary recording of complaint	No
Zero FIR	FIR registered despite the offence occurring outside the local police station’s territorial area	Yes
FIR under Section 173 BNSS	Formal first information record concerning a cognizable offence	Yes
Non-cognizable entry under Section 174	Police record of a non-cognizable complaint, ordinarily requiring Magistrate order for investigation	No cognizable FIR merely by that entry

1930: what the cyber financial fraud helpline does

The Ministry of Home Affairs’ cybercrime ecosystem directs victims of financial cyber fraud to 1930. The objective is speed. In online fraud, money can move through multiple accounts within minutes, so the immediate priority is often to create a transaction trail and attempt to place a hold on funds before they are dissipated.

Calling 1930 should therefore be viewed as an emergency financial-fraud reporting step. It is especially important for UPI fraud, investment scams, digital-arrest fraud, impersonation, fake trading platforms, task scams, OTP fraud, phishing and other cases involving rapid electronic transfers.

For the victim-side recovery process after a complaint is lodged, see our detailed guide on cyber financial fraud recovery through 1930, NCRP, CFCFRMS and the Money Restoration Module.

NCRP: what the National Cyber Crime Reporting Portal does

The National Cyber Crime Reporting Portal is the Government’s nationwide online reporting interface for cybercrime. Depending on the complaint category and State/UT police workflow, the complaint may be routed to the appropriate cybercrime unit for scrutiny, enquiry, investigation or FIR registration.

The portal is extremely important, but the complainant should preserve the complaint number, acknowledgement, date and time of filing, screenshots, uploaded documents and any subsequent police communication. Those records become important if the complainant later needs to demonstrate that the police were approached before invoking Section 173(4) or Section 175(3) BNSS.

Official portal: National Cyber Crime Reporting Portal. Financial-fraud grievance systems also continue to direct victims to 1930 and the cybercrime portal.

Complaint, enquiry and FIR are different procedural stages

A cybercrime matter may pass through several stages:

victim reports the incident through 1930, NCRP, email or police station;
complaint receives an acknowledgement or portal number;
police or cyber unit examines the complaint;
financial trail may be circulated through the cyber-fraud response system;
a preliminary enquiry may be conducted where Section 173(3) permits it;
if a cognizable offence is disclosed and the statutory conditions are met, an FIR is registered;
formal investigation proceeds under BNSS.

Victims should therefore ask a precise question: “Has an FIR been registered? If yes, what is the FIR number, date, police station and sections invoked?” A portal reference number should not be mistaken for an FIR number unless the police record confirms that position.

Section 173 BNSS: FIR registration for cognizable offences

Section 173 BNSS is the central provision governing information relating to cognizable offences. It provides that information may be given orally or by electronic communication to the officer in charge of a police station.

Three features are especially important for cybercrime:

territorial flexibility: information may be given irrespective of the area where the offence was committed;
electronic communication: information may be sent electronically;
three-day signature: electronic information is taken on record on being signed by the informant within three days.

This makes the BNSS framework especially suitable for offences that cross city, State and national boundaries through digital infrastructure.

Zero FIR after BNSS: territorial jurisdiction is not a reason to refuse information

The expression “Zero FIR” is commonly used for an FIR registered at a police station even though the offence occurred outside that police station’s ordinary territorial jurisdiction, after which the case can be transferred to the police station having jurisdiction.

Section 173(1) now expressly states that information relating to a cognizable offence may be given irrespective of the area where the offence is committed. In cybercrime this is crucial because the victim, bank account, mobile number, accused, server, intermediary and beneficiary account may all be located in different places.

A victim of a cognizable cyber offence should therefore not be turned away merely with the statement: “The beneficiary account is in another State,” or “The accused is outside our district.” Questions of eventual investigative or trial jurisdiction can be addressed separately from the initial recording of cognizable information.

What is an e-FIR under BNSS?

The term e-FIR is widely used in police portals and public discussion, but it should be used carefully. Section 173 does not say that every online message or portal complaint automatically becomes an FIR. What it clearly does is recognise information by electronic communication and require signature within three days.

Some States and police organisations operate dedicated e-FIR or online-FIR systems for specified categories. Their local workflow may differ. Nationwide, however, the safer legal proposition is this:

Electronic reporting is statutorily recognised; whether that electronic report has actually been registered as an FIR must be verified from the police record.

Why the three-day signature requirement matters

If cognizable information is sent by electronic communication under Section 173(1)(ii), the informant should comply with the requirement of signing it within three days. This reduces later disputes about authenticity and satisfies the statutory condition for electronically communicated information to be taken on record in the manner contemplated by the provision.

A prudent complainant should therefore preserve:

the original electronic complaint;
proof of transmission;
acknowledgement or delivery receipt;
signed copy supplied within three days;
proof of delivery of the signed version;
all subsequent communications from police.

Cognizable vs non-cognizable cyber offences

Not every complaint labelled “cybercrime” necessarily contains a cognizable offence. The police must examine the actual statutory ingredients and the classification of the offence.

Under Section 174 BNSS, where information concerns a non-cognizable offence, the police officer records the substance of the information, refers the informant to the Magistrate and forwards the prescribed diary report. Police cannot ordinarily investigate a non-cognizable case without the Magistrate’s order. If a case involves two or more offences and at least one is cognizable, the case is treated as cognizable.

Common cyber prosecutions may involve provisions of the Bharatiya Nyaya Sanhita, 2023 together with Sections 66C, 66D or other provisions of the Information Technology Act, 2000, depending on the facts. The correct classification must be made offence by offence.

Section 173(3): when police may conduct a preliminary enquiry

BNSS introduced an important statutory preliminary-enquiry mechanism. Where the information relates to a cognizable offence punishable with imprisonment of three years or more but less than seven years, the officer in charge may, considering the nature and gravity of the offence and with prior permission from an officer not below the rank of Deputy Superintendent of Police:

conduct a preliminary enquiry to determine whether a prima facie case exists, to be completed within fourteen days; or
proceed with investigation where a prima facie case exists.

In Imran Pratapgadhi v. State of Gujarat, 2025 INSC 410, the Supreme Court explained that Section 173(3) is a significant departure from the old Section 154 CrPC scheme. If the preliminary enquiry establishes a prima facie case, an FIR should be registered and investigation should proceed; if no prima facie case is found, the complainant should be informed so that the remedy under Section 173(4) can be invoked.

The fourteen-day mechanism is not a licence for an indefinite “enquiry pending” status.

What if the cyber police refuse to register the FIR?

The BNSS now contains a structured escalation mechanism. A complainant should ordinarily document each stage rather than immediately jumping to the High Court.

Step 1: approach the officer in charge under Section 173(1)

Submit the complaint in a form that identifies the cognizable ingredients, accused or unknown persons, transaction trail, digital identifiers, loss and evidence. Obtain acknowledgment where possible.

Step 2: Superintendent of Police under Section 173(4)

If the officer in charge refuses to record the information, Section 173(4) allows the aggrieved person to send the substance of the information in writing and by post to the Superintendent of Police concerned. If the SP is satisfied that a cognizable offence is disclosed, the SP may investigate personally or direct a subordinate officer to investigate.

The SP representation should enclose the original complaint, proof of delivery to the police station, NCRP acknowledgement, 1930 reference where relevant, bank records, screenshots and an offence-wise explanation of why cognizable ingredients are disclosed.

Step 3: Magistrate under Section 175(3)

If the statutory police remedy fails, an application may be made to the competent Magistrate under Section 175(3) BNSS.

The provision is not merely a renumbered Section 156(3) CrPC. It requires the Magistrate to consider the application supported by an affidavit made under Section 173(4), conduct such inquiry as considered necessary and consider the police officer’s submissions before ordering investigation.

Om Prakash Ambadkar: the Magistrate is not a post office

In Om Prakash Ambadkar v. State of Maharashtra, 2025 INSC 139, the Supreme Court explained the changes introduced by Section 175(3). It identified three important safeguards:

the earlier application to the SP under Section 173(4) is mandatory before the Magistrate route;
the Section 175(3) application must be supported by an affidavit;
the Magistrate may conduct inquiry and must consider the police officer’s submissions before directing investigation.

The Court emphasised that a Magistrate must apply judicial mind and should not mechanically direct police investigation in every case.

Sujal Vishwas Attavar: ordinarily exhaust the BNSS sequence before the High Court

In Sujal Vishwas Attavar v. State of Maharashtra, 2026 INSC 442, the Supreme Court reiterated the structured sequence under BNSS. Where the grievance is non-registration of an FIR, the complainant ordinarily should first use Section 173(1), then Section 173(4) before the Superintendent of Police, and thereafter Section 175(3) before the Magistrate.

The Court held that writ jurisdiction under Article 226 should ordinarily not be invoked as the first forum where effective statutory remedies exist, while recognising that exceptional urgency—particularly situations involving imminent danger to life or liberty—may require a different approach.

This 2026 decision is especially important for cybercrime petitions seeking a direct High Court direction to “register FIR.” A properly documented statutory escalation record now matters more than ever.

Does every NCRP complaint require an FIR?

No mechanical rule can be framed without examining the offences alleged. The correct legal questions are:

Does the complaint disclose a cognizable offence?
Does Section 173(3) permit a preliminary enquiry for the punishment range involved?
If such enquiry is conducted, was the statutory process followed within fourteen days?
Was the complainant informed of a refusal or adverse conclusion?
Has the complainant invoked Section 173(4)?

The existence of an NCRP number proves that a cyber complaint was lodged; it does not decide all these downstream questions.

Financial cyber fraud: complaint first, FIR later is common in practice

Recent Delhi High Court matters demonstrate the practical sequence. In Vijay Shankar Rao Gore v. State (NCT of Delhi) (27 February 2026), the Court recorded that an NCRP complaint preceded the FIR in a substantial cyber-fraud case. In Ashish Rechard v. State (NCT of Delhi) (11 March 2026), the complainant first reported the matter to helpline 1930 and thereafter lodged a formal complaint pursuant to which the FIR was registered.

These cases illustrate why victims and lawyers should distinguish between the reporting record and the formal FIR record.

What should a strong cybercrime complaint contain?

A complaint should be capable of being read by an investigator without requiring the complainant to reconstruct the case orally weeks later. A useful structure is:

identity and contact details of the complainant;
date and time when the cyber incident began;
modus operandi—WhatsApp call, Telegram group, fake website, phishing email, impersonation, remote-access app, investment platform, UPI collect request, etc.;
chronology of communications and payments;
bank-account / UPI / wallet details used to receive funds;
UTR / transaction numbers for every transfer;
phone numbers, email addresses, URLs, social-media handles and usernames used by the suspected offenders;
financial loss with an exact total;
offence ingredients in simple factual language;
evidence list and preservation request;
1930/NCRP references already generated;
specific request for FIR registration and investigation where cognizable offences are disclosed.

Electronic evidence: screenshots alone are not enough

Cybercrime cases rise or fall on electronic evidence. Victims often save only a few screenshots and then delete the original chat, replace the phone, reset the device or lose access to the account. That can significantly weaken the evidentiary trail.

Under the Bharatiya Sakshya Adhiniyam, 2023, electronic and digital records have legal recognition. Section 61 prevents denial of admissibility merely because a record is electronic; Sections 62 and 63 govern proof and admissibility of electronic records, including the statutory certificate mechanism.

What electronic material should be preserved?

original mobile phone and SIM used during the incident;
full WhatsApp/Telegram/chat export where possible;
screenshots showing date, time and account identity;
email in original form, including headers where relevant;
URLs and screen recordings of fraudulent websites/apps;
downloaded APK/application files if safely available;
bank statements and UTR numbers;
UPI app transaction details;
call logs and caller numbers;
SMS alerts;
social-media profile URLs and usernames;
QR codes, payment links and wallet addresses;
cryptocurrency transaction hashes and exchange records;
cloud backups;
NCRP and 1930 acknowledgements;
proof showing when the complaint was first reported.

Do not edit the original files merely to make them “cleaner.” Preserve originals and work on copies.

Section 63 certificate and hash values

Section 63 of the Bharatiya Sakshya Adhiniyam contains a certificate mechanism for computer output and electronic records. The statutory Schedule includes fields concerning the device or digital source and hash values.

At the complaint stage, a victim may not yet know which precise certificate will ultimately be required at trial. The practical response is to preserve the original device and source records carefully so that proper evidentiary certification can be generated when the material is formally produced.

Should the victim hand over the original phone immediately?

Not casually. If police require the device for forensic examination or seizure, the process should be documented. Before surrendering a business-critical or personal device, preserve a lawful backup where appropriate and obtain a seizure memo, acknowledgement or other formal record identifying the device.

Never alter, wipe or remotely delete data after the device becomes relevant to a criminal investigation.

Territorial jurisdiction in cybercrime

Cybercrime frequently creates multiple jurisdictional links:

place where the victim received the fraudulent communication;
place from which the victim made the transfer;
location of the victim’s bank;
location of the beneficiary bank;
place where the accused operated;
location of devices, servers or intermediaries;
place where the consequence of the offence occurred.

Section 173’s “irrespective of area” language addresses initial recording of cognizable information. Questions about which police station ultimately investigates and which court conducts inquiry or trial are governed by the broader BNSS jurisdiction framework and the facts of the offence.

What if the cybercrime happened partly outside India?

Cross-border cybercrime may involve foreign phone numbers, overseas social-media accounts, offshore exchanges, foreign payment processors or servers located outside India. That does not mean a victim in India should avoid reporting the offence.

The complaint should identify every Indian nexus and preserve the foreign identifiers. Investigation may subsequently require intermediary requests, international cooperation, mutual legal assistance or platform-level preservation processes.

Can you file directly before the Magistrate without first approaching the SP?

For a Section 175(3) application seeking police investigation after refusal to register a cognizable FIR, the Supreme Court’s interpretation of the BNSS makes the Section 173(4) SP step important and ordinarily mandatory. A properly prepared Magistrate application should therefore annex proof of the earlier complaint to police and the subsequent SP representation.

A separate private complaint route may raise different procedural questions. The choice between seeking police investigation and proceeding as a complaint case depends on whether evidence is already within the complainant’s reach or whether coercive investigation, forensic tracing, search, seizure or third-party production is necessary.

When is police investigation especially necessary in cybercrime?

Cyber matters often require powers unavailable to a private complainant, including:

subscriber/KYC information from telecom providers;
bank KYC and beneficiary-account details;
IP logs and intermediary records;
device seizure and forensic examination;
call-detail records;
platform preservation requests;
money-trail tracing across multiple accounts;
identification of mule accounts;
search and seizure;
coordination with other States or agencies.

These features can strongly support a properly reasoned request for police investigation before the Magistrate where the statutory prerequisites are met.

What if police register the FIR but do not investigate properly?

Non-registration and defective investigation are distinct grievances. The Supreme Court has repeatedly recognised that the Magistrate’s supervisory jurisdiction can be invoked in accordance with the statutory framework where investigation is not being conducted properly. A complainant should first create a written record of the specific investigative omission rather than merely alleging “no action.”

Examples include failure to seek beneficiary-bank information despite known UTRs, failure to preserve a known social-media account, failure to act on an identified phone number or failure to obtain readily available KYC details.

Can the High Court still be approached?

Yes, constitutional and inherent jurisdictions remain available in appropriate cases. But after Sujal Vishwas Attavar, a complainant seeking registration of FIR should expect the Court to ask whether the statutory sequence under Sections 173(1), 173(4) and 175(3) has been exhausted.

Exceptional circumstances—such as imminent danger to life or liberty, manifest jurisdictional failure or another situation making the statutory remedy ineffective—may justify earlier constitutional intervention. Ordinary inaction alone should not be assumed to justify bypassing the BNSS structure.

1930/NCRP complaint checklist

Call 1930 immediately for financial cyber fraud.
File the NCRP complaint without avoidable delay.
Record the NCRP complaint number.
Download/save acknowledgement.
Notify your bank and payment service provider.
Preserve UTRs and bank statements.
Preserve chats, calls, emails, URLs and app records.
Ask whether an FIR has been registered.
If cognizable information is refused, create proof of the refusal/inaction.
Send a complete Section 173(4) representation to the SP.
If necessary, prepare a Section 175(3) application with affidavit and annexures.
Do not delete, alter or fabricate electronic evidence.

Common mistakes after filing a cyber complaint

Assuming the NCRP number is the FIR number.
Waiting weeks before reporting financial fraud.
Filing only screenshots without transaction IDs or source records.
Deleting the original chat after taking screenshots.
Sending an electronic police complaint but ignoring the three-day signature requirement.
Accepting territorial-jurisdiction refusal without invoking Section 173.
Going directly to the High Court without first exhausting Sections 173(4) and 175(3) in an ordinary case.
Filing a vague SP representation that does not identify the cognizable offence.
Failing to attach proof of the original police complaint to the Magistrate application.
Changing phones or factory-resetting devices before evidence is preserved.

Frequently asked questions

Is calling 1930 enough to register an FIR?

No. Calling 1930 is an important rapid-response step for financial cyber fraud, but you should separately verify whether a formal FIR has been registered.

Is an NCRP acknowledgement an FIR?

Not automatically. It proves that a cybercrime complaint has been reported through NCRP. A formal FIR has its own FIR number, date, police station and statutory record.

Can I lodge a cyber FIR in a different city?

For cognizable information, Section 173 permits reporting irrespective of the area where the offence was committed. This supports the Zero FIR mechanism. The case may later be transferred to the appropriate jurisdiction.

Can an FIR be given by email or electronic communication?

Section 173 expressly recognises information by electronic communication. The information must be signed by the informant within three days for the statutory electronic-reporting process contemplated by Section 173(1)(ii).

Can police hold a cyber complaint in enquiry forever?

Where Section 173(3) applies, the statutory preliminary enquiry contemplated by that provision is to be completed within fourteen days. The police should not use “enquiry” as an indefinite substitute for deciding whether to proceed.

What should I do if the SHO refuses my cyber FIR?

Use Section 173(4): send the substance of the complaint in writing and by post to the Superintendent of Police with proof and annexures. If relief is still not obtained, the Magistrate route under Section 175(3) is available subject to its statutory requirements.

Does the Magistrate have to order an FIR?

No. Section 175(3) requires judicial application of mind. The Magistrate considers the affidavit-supported application, may make inquiry and considers the police officer’s submissions before deciding whether investigation should be ordered.

Can I approach the High Court directly?

In exceptional cases, yes. But the Supreme Court in 2026 reaffirmed that the ordinary sequence for non-registration is police station, SP and then Magistrate before invoking writ jurisdiction.

Should I preserve the phone used during the fraud?

Yes. Preserve the original device and data. Screenshots are useful but may not capture all metadata or source information required for a later forensic or evidentiary exercise.

Key takeaways

A cybercrime victim should treat 1930, NCRP, FIR registration and investigation as connected but legally distinct stages. For urgent financial fraud, speed through 1930/NCRP can help contain money movement. For formal criminal investigation, determine whether an FIR has actually been registered.

Section 173 BNSS gives victims important protections: territorial location is not a valid reason to refuse cognizable information, electronic communication is recognised, and refusal can be escalated to the Superintendent of Police. Section 175(3) then provides a Magistrate remedy with a structured affidavit-and-inquiry process.

At every stage, preserve the digital trail. In cybercrime, the complaint explains the story; the electronic evidence proves it.

Authoritative legal sources

Disclaimer: This article is a general legal-information resource and is not solicitation or a substitute for advice on a specific cybercrime complaint. The applicable offences, cognizability, territorial jurisdiction and procedural remedy depend on the actual facts, police record and law in force on the relevant date.

Fastrack Legal Solutions