Waking up to a failed UPI transaction or a "debit freeze" message from your bank is unsettling — more so when you've done nothing wrong. In India, this is one of the most common side-effects of the cyber fraud epidemic: a fraudster moves stolen money through a chain of accounts, and investigators freeze every account in that chain while they figure out who's actually involved. If your account was just a stop along the way, you can end up locked out of your own money for weeks or months without ever having filed a complaint yourself.
This guide explains why banks freeze accounts over cyber crime complaints, what the current 2026 procedure looks like, and the legal remedies available if the freeze drags on or seems disproportionate.
This is general legal information, not legal advice. Timelines and outcomes vary by bank, state, and the specific investigating agency — for an urgent freeze, get advice from our experienced Lawyer in cyber and banking law.
Why Banks Freeze Accounts Over Cyber Crime Complaints
When someone reports a cyber fraud — UPI scam, phishing, fake investment app, SIM swap — the money doesn't stay in one place. It typically moves rapidly through a chain of accounts, wallets, and payment gateways within minutes. Investigators (often working through the National Cybercrime Reporting Portal, NCRP, and India's cybercrime coordination body, I4C) trace this trail and instruct every bank along the chain to freeze the relevant funds, sometimes referring to the accounts as "Layer 1," "Layer 2," "Layer 3," and so on based on how far they are from the original fraud. Being flagged as a Layer 2 or Layer 3 account does not by itself mean you're accused of anything — it often just means money passed through your account, even if you received it for a perfectly legitimate reason (a sale on OLX, a freelance payment, repayment of a personal loan).
Under the Ministry of Home Affairs' Standard Operating Procedure dated January 2, 2026, banks are generally expected to place a hold only on the specific disputed amount rather than freezing an entire account — though wider suspension can still happen where an account has multiple reports against it or where the directions genuinely require it.
Is the Freeze Even Legal? The Section 106/107 BNSS Distinction
A significant legal development worth knowing: through late 2025 and into 2026, the Kerala, Bombay, and Delhi High Courts have each drawn a firm line on what actually authorises a bank freeze.
- Section 106 BNSS allows police to seize property connected to an offence through a fairly routine process.
- Section 107 BNSS deals with attachment of property suspected to be proceeds of crime — and this requires an order from a Magistrate, not merely a police email or letter to the bank.
Courts have increasingly held that debit-freezing a bank account is, in substance, an attachment — so it cannot be done under Section 106 on a police communication alone. The Kerala High Court took this view in Headstar Global Pvt. Ltd. v. State of Kerala (2025); the Bombay High Court followed in December 2025; and the Delhi High Court, in Malabar Gold and Diamond Ltd. v. Union of India (January 2026), held that freezing the account of someone who was neither an accused nor a suspect, without a Magistrate's order under Section 107, was illegal and violated the constitutional rights to carry on trade and to personal liberty under Articles 19(1)(g) and 21. If your account has been frozen for weeks purely on the strength of a police letter, with no Magistrate's order in sight, this line of cases is directly relevant to your legal position.
Step-by-Step: How to Get Your Account Unfrozen
- Identify exactly who ordered the freeze and why
Visit your branch and ask for the reference number, the cyber police station or cyber cell involved, and the reason code. Banks are permitted to share the contact details of the law-enforcement agency that ordered the freeze (though not the identity of the original complainant). Do not assume a social media complaint or the 1930 helpline call alone will lift an existing freeze — you need to engage directly with the authority that ordered it. - File your own complaint or grievance without delay
If you haven't already, file a complaint on the NCRP (or call the 1930 cyber fraud helpline) explaining that you are not the fraudster and describing how the funds reached your account. This formally changes your status in the record from an anonymous "linked account" to someone actively cooperating and asserting their position. - Use the 2026 grievance mechanism
Under the January 2026 SOP, there's now a structured grievance process with defined timelines: the bank is expected to submit an eligible grievance within seven calendar days, and the Investigating Officer is expected to decide it within fifteen calendar days. Delays are common where there are multiple complaints, missing documents, or competing claims to the same funds — but these timelines give you a concrete basis to press for a decision rather than an open-ended wait. - Know the 90-day backstop
An account cannot, in principle, be kept frozen indefinitely on a bare police instruction. If the police don't produce a Magistrate's order or a formal extension within roughly 90 days, the bank is expected to release the hold. In practice this deadline is sometimes missed, which is exactly when a lawyer's notice to the branch and the investigating officer becomes useful. - Obtain a No Objection Certificate (NOC)
If the cyber cell is satisfied you're a genuine, uninvolved recipient — for instance, an online seller who received a legitimate payment — request a written NOC or an instruction letter releasing the hold, and submit it to your bank's nodal officer. Keep every communication in writing; verbal assurances that "it will be sorted" rarely move a bank without paperwork. - Apply to the Magistrate under Sections 497 & 503 BNSS
If the freeze originates from a formal seizure reported to a court (rather than just an informal bank-level hold), you can file an application before the jurisdictional Magistrate for release of the property — the current equivalent of the old Sections 451 and 457 CrPC is now Sections 497 and 503 of the BNSS. Magistrates have released frozen accounts on conditions such as furnishing a bond for the disputed amount, so the account can operate while the underlying investigation continues. - Approach the High Court under Article 226 where the freeze is illegal
Where the freeze has no real nexus to your conduct, is mechanical, disproportionate, or continues without any Magistrate's order, a writ petition under Article 226 of the Constitution is available. Courts may decline to entertain the writ if you haven't first tried the Magistrate route, since that's treated as an effective alternative remedy — but where the illegality is clear (as in the Kerala, Bombay, and Delhi High Court rulings discussed above), courts have been willing to intervene directly and set the freeze aside.
A Few Practical Warnings
- Don't spend or move disputed funds that land in your account unexpectedly, even if you believe they're rightfully yours — under the principle of unjust enrichment, money received by mistake isn't automatically yours to keep, and moving it can complicate your position considerably.
- Verify before you travel. Fraudulent calls impersonating "cyber cell officers" are themselves a known scam; confirm the officer and complaint details before appearing anywhere in person, and note that the current SOP favours video verification where feasible.
- Distinguish a police freeze from your own bank's lien. If the block is actually your bank recovering unpaid dues or EMIs rather than a cyber cell instruction, the fix is different — clear or dispute the dues directly, and escalate to the RBI Banking Ombudsman if unresolved.
- Business accounts need faster action. A frozen business account can disrupt vendor payments and salaries almost immediately; don't wait passively for an investigation that could take months — push the grievance process from day one.
When to Bring in a Lawyer
Many small, clear-cut cases resolve through direct engagement with the bank and cyber cell. But once a freeze crosses 30–90 days with no movement, or where an entire account (not just a disputed amount) remains locked despite you clearly being an innocent party, a lawyer's representation — a formal notice to the branch manager and investigating officer, followed by a Magistrate's application or writ petition if needed — tends to move things considerably faster than repeated branch visits.
We are recognised as one of the best cyber crime lawyers in Delhi, regularly handling bank account freeze matters, NCRP grievances, and Section 497/503 BNSS release applications for clients across India. If your account has been frozen over a cyber crime complaint and the standard process isn't moving, reach out to our team for a case-specific assessment.
Key Takeaways
- A frozen account doesn't mean you're accused of a crime — being a Layer 2 or Layer 3 account in the money trail is common for entirely innocent recipients.
- Under the 2026 MHA SOP, banks should freeze only the disputed amount where possible, and grievances follow defined timelines (7 days for the bank, 15 days for the IO).
- Section 106 vs. Section 107 BNSS matters: a full account freeze without a Magistrate's order under Section 107 has been held illegal by the Kerala, Bombay, and Delhi High Courts.
- The 90-day rule means a freeze shouldn't continue indefinitely without a court order or extension.
- Legal remedies include an NOC from the cyber cell, an application before the Magistrate under Sections 497/503 BNSS, and a writ petition under Article 226 where the freeze is clearly illegal or disproportionate.
