--- title: "A caller from 'IRDAI' or the Insurance Ombudsman said I can get a..." description: "Someone claiming to be from IRDAI or an ombudsman promised a refund or bonus for a fee. Your rights, how to fight it step by step, and what to do if it is fake." url: "https://dpdpr.in/rights/scenarios/fake-irdai-refund-call/" canonical: "https://dpdpr.in/rights/scenarios/fake-irdai-refund-call/" site: "dpdpr.in" updated: "2026-11-02" disclaimer: "Independent reference, not legal advice. Not affiliated with the Government of India or MeitY." --- # A caller from 'IRDAI' or the Insurance Ombudsman said I can get a refund on my old policy Plain-language help for ordinary people. General information, not legal advice. Helplines, portals and screen names were checked against official Government and regulator pages on 1 November 2026. Portals change: if a screen looks different, follow the words on the screen and the official guide linked in each step. "The caller said he was from IRDAI and could get my lapsed policy money back. I just had to pay a processing fee." The situation in a citizen's own words, paraphrased from public reports. No names or personal details. IRDAI says it does not sell insurance, does not announce bonuses and does not call people about complaints. Anyone asking for a fee in IRDAI's name is a fraudster. **Safety first.** Threatened or in danger: call **181** (women) or go to the nearest police station. Lost money: call **1930** at once. ## Your rights - **Right to zero liability if you report fast.** RBI: report an unauthorised electronic transaction within 3 working days of the bank's alert for zero liability where the fault lies elsewhere; the bank must credit the amount within 10 working days of your report. - **Right to rely on IRDAI's warning.** IRDAI's public notice says it is not involved in selling insurance or investing premiums, does not announce bonuses, and asks the public to lodge a police complaint about such calls. - **Right to report fraud** on 1930, cybercrime.gov.in and Chakshu. - **Right to police help.** The police must take your complaint about threats, stalking or harassment. You can also report online at cybercrime.gov.in. - **DPDP rights from 13 May 2027.** You can ask what data the company holds and who it shared it with (section 11), ask for correction or erasure (section 12), and complain to the company, then to the Data Protection Board (sections 13 and 27). The company answers for its processors (section 8(1)). ## How to fight it, step by step One action per step. Each step says what to write, what to attach, what you get back, and how long to wait before the next step. If the person turns out to be fake, skip to [If it is fake](#fake). 1. **Do not click links or call numbers in the message. If you did, call your bank's official number at once.** What to write: Ask to block cards, UPI and net banking. What to attach: Nothing. What you get back: A complaint number. How long to wait: At once. 2. **Call 1930 if money was lost, then file on cybercrime.gov.in.** What to write: Each transaction with UTR numbers. What to attach: Screenshots. What you get back: An acknowledgement number. How long to wait: At once. 3. **Report the message or number on Chakshu.** What to write: Choose the closest category. What to attach: Screenshot. What you get back: A reference. How long to wait: No wait. 4. **Complain to the bank in writing about any loss.** What to write: The transaction and your 1930 acknowledgement. What to attach: Evidence. What you get back: A complaint number. How long to wait: Within 3 working days of the alert for zero liability. 5. **Go to the RBI Ombudsman on cms.rbi.org.in if the bank does not resolve it.** What to write: Your complaint number. What to attach: Replies. What you get back: An RBI complaint number. How long to wait: After 30 days, within 90 days. 6. **Get a lawyer if the stakes are high.** What to write: Nothing yet. Take your full file to the lawyer. What to attach: All of the above. What you get back: Advice on a legal notice, a claim before your State's IT Adjudicating Officer, or a civil suit for damages. How long to wait: Before you send any legal notice or file a suit. This page is not legal advice. ## What people tried and what worked - Victims paid fees and lost money in reported cases. - Police arrested a gang in one reported city case after complaints. Based on reports on public forums, and the news reports listed below. Paraphrased, with no usernames or personal details. What worked for one person may not work for you; the numbered steps above are the official route. ### News reports - [Mint reader asked about a Bima Lokpal call offering a lapsed policy refund.](https://www.livemint.com/money/personal-finance/bima-lokpal-called-and-asked-me-to-claim-a-refund-for-a-lapsed-insurance-policy-is-this-fraud-11768471731655.html) (livemint.com) - [A police inspector lost lakhs in a fake insurance refund scam.](https://timesofindia.indiatimes.com/city/ahmedabad/ahmedabad-police-inspector-duped-of-rs-5-4-lakh-in-fake-insurance-refund-scam/articleshow/133599346.cms) (timesofindia.indiatimes.com) - [An insurer warned customers against fraudulent calls and fake claims.](https://www.business-standard.com/finance/personal-finance/beware-lic-warns-customers-against-fraudulent-calls-fake-claims-125031700233_1.html) (business-standard.com) - [News report](https://www.livemint.com/insurance/news/how-not-to-get-conned-by-fake-insurance-calls-1559756785742.html) (livemint.com) **Not legal advice.** This page explains the rules in plain words so you can act. Consult a lawyer before you sue anyone or send a legal notice. Laws and portals change; check the linked official source. ## Step 1: stay safe and find out who it is 1. Do not share an OTP, PIN, password or card number. 2. Ask for their name, company, role and ID. Write it down. 3. Hang up and call the company on a number you find yourself, on its official website or app. 4. Ask whether this person works for the company or a partner. Ask for a written answer (Letter 1 below). ## If it is genuine: hold the company accountable ### Which rules this may break - **RBI, 6 July 2017:** customer liability in unauthorised electronic transactions. - **IT Act section 66D:** cheating by impersonation using a computer resource. ### What the company must do, and by when - Block the instrument and record your complaint. - Credit the amount within 10 working days where RBI's rules apply. ### Letter 1: ask them to confirm who the caller is Send it through the official channel. Keep a copy and the acknowledgement. To: The Grievance Officer, \[Bank or company named in the message\] Subject: Please confirm whether this person works for you Dear Sir or Madam, I am your customer. My account or consumer number: \[number\]. On \[date\] at \[time\] I received a call or message from \[phone number\]. This is not an official number. The person said they were \[name\], \[role or employee ID\], from the company. They knew my \[list the details they knew\]. Please confirm in writing within 7 days: 1. Whether this person is your employee, agent, agent or partner. 2. If yes, their name, role and the agency they work for. 3. Whether you allow staff or agents to contact customers from personal numbers. 4. If they are not connected with you, please say so, so I can report the number. Name: Registered mobile number: Date: ### Letter 2: ask how your data got there To: The Grievance Officer, \[Bank or company named in the message\] Subject: How did my personal data reach a personal phone? Complaint number \[if any\] Dear Sir or Madam, On \[date\] a person connected with you, \[name if known\], contacted me from a personal number \[number\] and knew my \[details\]. \[Describe what they did.\] Please tell me in writing: 1. What personal data about me this person could see, and through which system or app. 2. Whether you shared my data with any agency, agent, partner or processor, and their names. 3. How my data reached a personal phone or account outside your official systems. 4. What action you have taken against the person or agency, including suspension while you investigate. 5. What you have done to stop this happening again. Under RBI's rules on unauthorised electronic transactions, if you tell your bank within 3 working days of its alert and the fault is neither yours nor the bank's, you have zero liability. From 13 May 2027, sections 8 and 11 of the Digital Personal Data Protection Act, 2023 also apply. Please reply within the time your bank's policy sets (RBI requires settlement within 90 days for unauthorised transactions). If I do not hear from you, I will escalate to the RBI Ombudsman and the police. Name: Registered mobile number: Date: ### Evidence to keep - Screenshots of calls and messages with numbers, dates and times. - Order, booking, policy or account numbers. - Your complaint numbers and the company's replies. - A note of what the caller knew or did. More in the [evidence checklist](https://dpdpr.in/rights/evidence-checklist/). ### Can you sue? What realistically happens - **Consumer Commission:** the most practical route for compensation. Cheap, no lawyer needed, file within 2 years. - **IT Act section 43A (until 13 May 2027):** if the company was negligent with *sensitive* personal data (passwords, bank or card details, health records, biometrics) and that caused wrongful loss or gain, it must pay compensation. Claims up to Rs 5 crore go to your State's IT Secretary acting as Adjudicating Officer (section 46); larger claims go to a court. Appeal within 45 days (section 57). Your phone number and address alone are not sensitive data under the 2011 Rules. - **Civil suit for damages:** possible, but slow and costly. Section 61 of the IT Act bars civil courts from matters the Adjudicating Officer can decide. - **Police:** only where there is a crime, for example a person who disclosed your information in breach of a contract to cause wrongful loss or gain (IT Act section 72A, up to 3 years), identity theft (66C), cheating by impersonation (66D), stalking or threats. - **Realistic outcome:** most people get results from a firm written complaint and the regulator or ombudsman. Courts take years. Consult a lawyer before suing. ### From 13 May 2027: the Data Protection Board From **13 May 2027** the DPDP Act's duties apply. The company is responsible for processing done by it or by anyone processing on its behalf (section 8(1)), may use a processor only under a valid contract (section 8(2)), must protect your data with reasonable security safeguards (section 8(5)), and must tell you and the Board about a breach (section 8(6)). It may use your data only for the lawful purpose you agreed to (sections 4 to 6). Section 44(2) removes IT Act section 43A from that date. Complain to the company first; if it does not resolve it, complain to the Data Protection Board. The Board can impose penalties up to Rs 250 crore, but **penalties go to the Government (the Consolidated Fund of India, section 34), not to you**. For money, use the ombudsman or the Consumer Commission. Appeals from the Board go to TDSAT within 60 days (section 29). ## If it is fake: urgent steps 1. If anyone asks for an OTP, PIN or payment, stop. It may be fraud. 2. Call 1930 if money was lost, then file on cybercrime.gov.in. 3. Report the number on Chakshu (Sanchar Saathi). Step by step guides: Report money lost to fraud: call 1930 ### Report money lost to fraud: call 1930 1930 is the national cyber crime helpline run with the Ministry of Home Affairs. It links your report to banks and wallets so they can try to stop the money. Call as fast as you can. The sooner the report reaches the bank, the better the chance. **Keep this ready before you start:** - Your mobile number. - Name of the bank, wallet or app the money left from. - Account number, wallet ID or UPI ID that was debited. - Transaction ID or 12 digit UTR number for each payment. - Date and amount of each payment. - Card number, if a debit or credit card was used. - Screenshots of the payment and of the chat or SMS. 1. Dial **1930** from any phone. 2. Tell them you want to report a financial cyber fraud. 3. Give each transaction one by one: bank, transaction ID or UTR, date and amount. 4. Write down the acknowledgement number they give you. It also comes by SMS. 5. Save that SMS. Take a screenshot of it. 6. Now file the full complaint on [cybercrime.gov.in](https://cybercrime.gov.in) (steps below). The official cybercrime.gov.in instructions ask you to complete it within 24 hours of the call. 7. Call your bank's official customer care number too, and ask them to block the card, UPI or account. Use the number on your card or passbook. Checked on 1 November 2026 against: [I4C (Ministry of Home Affairs): National Cybercrime Reporting Portal and 1930](https://i4c.mha.gov.in/ncrp.aspx), [National Cyber Crime Reporting Portal: FAQ](https://cybercrime.gov.in/Webform/FAQ.aspx). File a complaint on cybercrime.gov.in ### File a complaint on cybercrime.gov.in The National Cyber Crime Reporting Portal takes complaints about online fraud, hacking, fake profiles, harassment and more. Your complaint goes to the police of your State or Union Territory. The screen names below come from the portal's FAQ and the Ministry of Home Affairs citizen manual. The portal can change. If a screen looks different, follow the words on the screen. **Keep this ready before you start:** - Date and time of the incident. - Incident details in your own words. The portal checklist asks for at least 200 characters and no special characters such as # $ @ ^ \* \` ~ | ! - A photo or scan of a national ID (Voter ID, Driving Licence, Passport, PAN or Aadhaar) in .jpg, .jpeg or .png, not more than 5 MB. - For money fraud: bank or wallet name, 12 digit transaction ID or UTR, date and amount. - Evidence files such as screenshots, not more than 10 MB each. - If known: the other person's mobile number, email, bank account, website link or social media handle. 1. Open [cybercrime.gov.in](https://cybercrime.gov.in) in a browser. 2. Click **File a complaint**. 3. Read the message. Tick **I Accept**. 4. Click **Report Other Cyber Crime**. (For sexual content involving women or children, use the women and child section instead.) 5. Type your name in **User Name**. Type your mobile number. 6. Click **Get OTP**. Type the OTP you receive. It is valid for 30 minutes. 7. Fill the security answer. Click **Submit**. 8. In **Incident details**, choose the **Category of complaint**. For money loss choose Online Financial Fraud. For fake profiles or harassment choose Online and Social Media Related Crime. 9. Choose the **Sub-Category** that fits best. 10. Enter the approximate date and time. If you are late, fill **Reason for delay in reporting**. 11. Choose **Where did the incident occur?** (for example a phone call, SMS, WhatsApp, a website or an app). 12. Upload your evidence files. 13. Write what happened in the details box. Say who contacted you, from which number, what they said, what you shared or paid, and when. 14. Click **Save and Next**. 15. Add suspect details if you have them: name, mobile number, bank account, UPI ID or website. Click **Save & Next**. 16. Fill your own details and address. Choose your State, District and Police Station. 17. Upload your ID proof. Click **Save & Preview**. 18. Check everything. Tick **I Agree**. Click **Confirm & Submit**. 19. Write down the **Complaint ID** shown on screen. You also get it by SMS and email. It is a complaint number, not an FIR number. 20. Click **Download PDF** and save the file in a safe folder. 21. To check progress later, log in the same way and click **Check Status**. 22. If you get no action, or are not happy with what the police did, contact the cyber crime grievance officer of your State or Union Territory listed on the portal. You can also visit your local police station with the PDF and ask for an FIR. Checked on 1 November 2026 against: [National Cyber Crime Reporting Portal: FAQ](https://cybercrime.gov.in/Webform/FAQ.aspx), [National Cyber Crime Reporting Portal: checklist before filing](https://www.cybercrime.gov.in/Webform/Crime_AuthoLogin.aspx), [I4C (Ministry of Home Affairs): National Cybercrime Reporting Portal and 1930](https://i4c.mha.gov.in/ncrp.aspx). Report a fraud call, SMS or WhatsApp on Chakshu (Sanchar Saathi) ### Report a fraud call, SMS or WhatsApp on Chakshu (Sanchar Saathi) Chakshu is run by the Department of Telecommunications. Use it for calls or messages that try to cheat you, such as fake KYC, fake police, fake customer care, job or loan offers and sextortion. It is for numbers that tried to cheat you. If you already lost money, call 1930 first. **Keep this ready before you start:** - A screenshot of the call log or message. The form asks for one. - The number or SMS header that contacted you. - Date and time (within the last 30 days). - Any phone numbers or links mentioned in the message. - Your own mobile number, to get an OTP. 1. Open [sancharsaathi.gov.in/sfc](https://sancharsaathi.gov.in/sfc/), or open the **Sanchar Saathi** app (Google Play or App Store). 2. On the website, under **Citizen Centric Services**, choose **Chakshu - Report Suspected Fraud Communication**. 3. Under **Report Suspected Fraud**, click **Proceed**. 4. Choose how it came: call, SMS or WhatsApp. 5. Choose the category. The list includes: KYC and Payment related to Bank / Electricity / Gas / Insurance; Impersonation as Police, CBI, Customs, Aadhaar, RBI; Fake Customer Care Helpline; Online job / lottery / gifts / loan offers; Sextortion; IVR / Robo Calls; Malicious link / website; Investment, Stock Market and Trading; Impersonation as DoT / TRAI; Impersonation as a relative / friend; Any Other Suspected Fraud. 6. Attach the screenshot. The portal may fill some details from the image. Check them. 7. Type the number it came from. For an SMS with a name instead of a number, choose **With header** and type the header. 8. Enter the date and the time in HH:MM AM/PM format. 9. In **complaint details**, write at least 30 characters. Say what they asked for and what they claimed. 10. Add any phone numbers and links that were in the message. 11. Enter the mobile number on which you got the call or message. 12. Type the captcha. Click **Verify Mobile via OTP**. Enter the OTP. Click **Verify OTP**. 13. Tick the declaration. Click **Preview**. Check it. Click **Submit**. 14. Take a screenshot of the thank you message. The Department says it will not send you individual results, for privacy reasons. 15. If it came on WhatsApp, also report the chat inside WhatsApp. The portal asks you to do this. Checked on 1 November 2026 against: [Chakshu: report suspected fraud or spam (Sanchar Saathi)](https://sancharsaathi.gov.in/sfc/), [Sanchar Saathi portal and FAQ (Department of Telecommunications)](https://sancharsaathi.gov.in/). ## Related guides - [\*\*Insurance companies and agents\*\*Policy data leaks, mis-selling calls and claim problems: the IRDAI route.](https://dpdpr.in/rights/insurance/) - [\*\*Spam calls, SMS and telemarketing\*\*Block marketing, complain within 7 days, and report fraud calls on Chakshu.](https://dpdpr.in/rights/spam-calls-sms/) See also [when a platform shares your data with a third party](https://dpdpr.in/rights/platforms-and-third-parties/) and the [escalation ladder](https://dpdpr.in/rights/escalation-ladder/). ## Official sources Checked on 1 November 2026. Company pages are labelled as the company's own words. - [RBI: limiting liability of customers in unauthorised electronic banking transactions (6 July 2017)](https://www.rbi.org.in/Scripts/NotificationUser.aspx?Id=11040) - [RBI: Reserve Bank Integrated Ombudsman Scheme, 2026 (FAQs)](https://www.rbi.org.in/CommonPerson/english/Scripts/FAQs.aspx?Id=3407) - [RBI Complaint Management System (CMS)](https://cms.rbi.org.in/) - [National Cyber Crime Reporting Portal: FAQ](https://cybercrime.gov.in/Webform/FAQ.aspx) - [I4C (Ministry of Home Affairs): National Cybercrime Reporting Portal and 1930](https://i4c.mha.gov.in/ncrp.aspx) - [Chakshu: report suspected fraud or spam (Sanchar Saathi)](https://sancharsaathi.gov.in/sfc/) - [IRDAI public notice: beware of spurious calls and fictitious offers](https://irdai.gov.in/documents/38105/43988/SPURIOUS+CALLERS.pdf/88322a0e-ba98-4d60-f45a-1d4ba367d91f?t=1631522671247&version=1.0)