---
title: "I was added to a WhatsApp investment group and lost money"
description: "An 'expert' group showed profits on an app, and you cannot withdraw. Your rights, how to fight it step by step, and what to do if it is fake."
url: "https://dpdpr.in/rights/scenarios/whatsapp-investment-group/"
canonical: "https://dpdpr.in/rights/scenarios/whatsapp-investment-group/"
site: "dpdpr.in"
updated: "2026-11-02"
disclaimer: "Independent reference, not legal advice. Not affiliated with the Government of India or MeitY."
---

# I was added to a WhatsApp investment group and lost money

Plain-language help for ordinary people. General information, not legal advice. Helplines, portals and screen names were checked against official Government and regulator pages on 1 November 2026. Portals change: if a screen looks different, follow the words on the screen and the official guide linked in each step.

"The app showed my investment had doubled. When I tried to withdraw they asked for a 'tax' first."

The situation in a citizen's own words, paraphrased from public reports. No names or personal details.

SEBI warned on 22 October 2026 against stock tips in invitation only WhatsApp groups. Stop paying, call 1930, and report on SEBI's Market Intelligence portal.

**Safety first.** Threatened or in danger: call **181** (women) or go to the nearest police station. Lost money: call **1930** at once.

## Your rights

- **Right to check who you deal with.** Registered intermediaries are listed on sebi.gov.in/intermediaries.html and authentic trading apps on investor.sebi.gov.in.
- **Right to recognise genuine calls.** SEBI has told intermediaries to use the 1600 number series for service and transaction calls to existing customers.
- **Right to SCORES** against a registered broker: Action Taken Report within 21 days, then reviews.
- **No SEBI protection with unregistered groups or apps.** SEBI warns that SCORES and exchange redress are not available for disputes with unregistered entities, so report them on SEBI's Market Intelligence portal and to the police.
- **DPDP rights from 13 May 2027.** You can ask what data the company holds and who it shared it with (section 11), ask for correction or erasure (section 12), and complain to the company, then to the Data Protection Board (sections 13 and 27). The company answers for its processors (section 8(1)).

## How to fight it, step by step

One action per step. Each step says what to write, what to attach, what you get back, and how long to wait before the next step. If the person turns out to be fake, skip to [If it is fake](#fake).

1. **Save the evidence before you block or delete anything.**
What to write: A short note with the date, time, number used, and exactly what was said or what details they knew.
What to attach: Screenshots of the call log, SMS, WhatsApp chats (with the number visible), and any payment screen.
What you get back: A record that cannot later be denied.
How long to wait: Do this the same day.
2. **Stop paying and exit the group or app. Do not transfer more to 'unlock' withdrawals.**
What to write: Nothing.
What to attach: Nothing.
What you get back: No further loss.
How long to wait: At once.
3. **Call 1930 and file on cybercrime.gov.in if money was lost.**
What to write: Each payment with UTR numbers and the app or group name.
What to attach: Screenshots.
What you get back: An acknowledgement number.
How long to wait: At once.
4. **Report the unregistered group, app or 'adviser' on SEBI's Market Intelligence portal (mi.sebi.gov.in).**
What to write: Names, numbers, links.
What to attach: Screenshots.
What you get back: A reference.
How long to wait: No wait.
5. **If a registered broker leaked your data or you suspect its staff, complain to the broker, then on SCORES.**
What to write: What happened and your client ID.
What to attach: Evidence.
What you get back: A SCORES complaint number.
How long to wait: 21 days for the Action Taken Report.
6. **Get a lawyer if the stakes are high.**
What to write: Nothing yet. Take your full file to the lawyer.
What to attach: All of the above.
What you get back: Advice on a legal notice, a claim before your State's IT Adjudicating Officer, or a civil suit for damages.
How long to wait: Before you send any legal notice or file a suit. This page is not legal advice.

## What people tried and what worked

- People reported to the police and SEBI. The reports did not say what was recovered.

Based on reports on public forums, and the news reports listed below. Paraphrased, with no usernames or personal details. What worked for one person may not work for you; the numbered steps above are the official route.

### News reports

- [A senior lost crores in a WhatsApp group scam.](https://timesofindia.indiatimes.com/technology/tech-news/whatsapp-group-scam-costs-75-year-old-rs-11-1-crore-know-how-to-stop-others-from-adding-you-to-groups-without-your-permission/articleshow/115841132.cms) (timesofindia.indiatimes.com)

**Not legal advice.** This page explains the rules in plain words so you can act. Consult a lawyer before you sue anyone or send a legal notice. Laws and portals change; check the linked official source.

## Step 1: stay safe and find out who it is

1. Do not share an OTP, PIN, password or card number.
2. Ask for their name, company, role and ID. Write it down.
3. Hang up and call the company on a number you find yourself, on its official website or app.
4. Ask whether this person works for the company or a partner. Ask for a written answer (Letter 1 below).

## If it is genuine: hold the company accountable

### Which rules this may break

- **SEBI cautions (2025 and 22 October 2026):** do not join invitation-only WhatsApp groups run by unknown 'experts'; deal only with registered intermediaries.
- **SEBI SCORES:** complaints against registered entities.
- **IT Act section 66D and the BNS:** cheating by impersonation.

### What the company must do, and by when

- Answer your complaint on SCORES within 21 days (registered brokers).
- Tell you whether it shared your details with authorised persons or vendors.

### Letter 1: ask them to confirm who the caller is

Send it through the official channel. Keep a copy and the acknowledgement.

To: The Grievance Officer, \[Broker or depository participant name\] Subject: Please confirm whether this person works for you Dear Sir or Madam, I am your customer. My client ID: \[number\]. On \[date\] at \[time\] I received a call or message from \[phone number\]. This is not an official number. The person said they were \[name\], \[role or employee ID\], from the broker. They knew my \[list the details they knew\]. Please confirm in writing within 7 days: 1. Whether this person is your employee, agent, sub-broker, authorised person, vendor or partner. 2. If yes, their name, role and the agency they work for. 3. Whether you allow staff or agents to contact customers from personal numbers. 4. If they are not connected with you, please say so, so I can report the number. Name: Registered mobile number: Date:

### Letter 2: ask how your data got there

To: The Grievance Officer, \[Broker or depository participant name\] Subject: How did my personal data reach a personal phone? Complaint number \[if any\] Dear Sir or Madam, On \[date\] a person connected with you, \[name if known\], contacted me from a personal number \[number\] and knew my \[details\]. \[Describe what they did.\] Please tell me in writing: 1. What personal data about me this person could see, and through which system or app. 2. Whether you shared my data with any agency, sub-broker, authorised person, vendor, partner or processor, and their names. 3. How my data reached a personal phone or account outside your official systems. 4. What action you have taken against the person or agency, including suspension while you investigate. 5. What you have done to stop this happening again. 6. Whether my contact details were shared with any authorised person, vendor or partner, and their names. SEBI says investors should deal only with SEBI registered intermediaries and authentic trading apps, which can be checked on sebi.gov.in. SEBI has told intermediaries to use the 1600 number series for service and transaction calls to existing customers. From 13 May 2027, sections 8 and 11 of the Digital Personal Data Protection Act, 2023 also apply. Please reply within 21 days on SCORES. If I do not hear from you, I will escalate to SEBI SCORES. Name: Registered mobile number: Date:

### Evidence to keep

- Screenshots of calls and messages with numbers, dates and times.
- Order, booking, policy or account numbers.
- Your complaint numbers and the company's replies.
- A note of what the caller knew or did.

More in the [evidence checklist](https://dpdpr.in/rights/evidence-checklist/).

### Can you sue? What realistically happens

- **Consumer Commission:** the most practical route for compensation. Cheap, no lawyer needed, file within 2 years.
- **IT Act section 43A (until 13 May 2027):** if the company was negligent with *sensitive* personal data (passwords, bank or card details, health records, biometrics) and that caused wrongful loss or gain, it must pay compensation. Claims up to Rs 5 crore go to your State's IT Secretary acting as Adjudicating Officer (section 46); larger claims go to a court. Appeal within 45 days (section 57). Your phone number and address alone are not sensitive data under the 2011 Rules.
- **Civil suit for damages:** possible, but slow and costly. Section 61 of the IT Act bars civil courts from matters the Adjudicating Officer can decide.
- **Police:** only where there is a crime, for example a person who disclosed your information in breach of a contract to cause wrongful loss or gain (IT Act section 72A, up to 3 years), identity theft (66C), cheating by impersonation (66D), stalking or threats.
- **Realistic outcome:** most people get results from a firm written complaint and the regulator or ombudsman. Courts take years. Consult a lawyer before suing.

### From 13 May 2027: the Data Protection Board

From **13 May 2027** the DPDP Act's duties apply. The company is responsible for processing done by it or by anyone processing on its behalf (section 8(1)), may use a processor only under a valid contract (section 8(2)), must protect your data with reasonable security safeguards (section 8(5)), and must tell you and the Board about a breach (section 8(6)). It may use your data only for the lawful purpose you agreed to (sections 4 to 6). Section 44(2) removes IT Act section 43A from that date. Complain to the company first; if it does not resolve it, complain to the Data Protection Board. The Board can impose penalties up to Rs 250 crore, but **penalties go to the Government (the Consolidated Fund of India, section 34), not to you**. For money, use the ombudsman or the Consumer Commission. Appeals from the Board go to TDSAT within 60 days (section 29).

## If it is fake: urgent steps

1. If anyone asks for an OTP, PIN or payment, stop. It may be fraud.
2. Call 1930 if money was lost, then file on cybercrime.gov.in.
3. Report the number on Chakshu (Sanchar Saathi).

Step by step guides:

Report money lost to fraud: call 1930

### Report money lost to fraud: call 1930

1930 is the national cyber crime helpline run with the Ministry of Home Affairs. It links your report to banks and wallets so they can try to stop the money. Call as fast as you can. The sooner the report reaches the bank, the better the chance.

**Keep this ready before you start:**

- Your mobile number.
- Name of the bank, wallet or app the money left from.
- Account number, wallet ID or UPI ID that was debited.
- Transaction ID or 12 digit UTR number for each payment.
- Date and amount of each payment.
- Card number, if a debit or credit card was used.
- Screenshots of the payment and of the chat or SMS.

1. Dial **1930** from any phone.
2. Tell them you want to report a financial cyber fraud.
3. Give each transaction one by one: bank, transaction ID or UTR, date and amount.
4. Write down the acknowledgement number they give you. It also comes by SMS.
5. Save that SMS. Take a screenshot of it.
6. Now file the full complaint on [cybercrime.gov.in](https://cybercrime.gov.in) (steps below). The official cybercrime.gov.in instructions ask you to complete it within 24 hours of the call.
7. Call your bank's official customer care number too, and ask them to block the card, UPI or account. Use the number on your card or passbook.

Checked on 1 November 2026 against: [I4C (Ministry of Home Affairs): National Cybercrime Reporting Portal and 1930](https://i4c.mha.gov.in/ncrp.aspx), [National Cyber Crime Reporting Portal: FAQ](https://cybercrime.gov.in/Webform/FAQ.aspx).

Complain about a broker or investment app: the broker first, then SEBI SCORES

### Complain about a broker or investment app: the broker first, then SEBI SCORES

SCORES is SEBI's complaint portal for stock brokers, depository participants, mutual funds, listed companies and other SEBI registered entities. Complain to the broker first. If it does not fix the problem, go to SCORES.

**Keep this ready before you start:**

- Your PAN, name, address, email, mobile number and date of birth. SCORES needs all six.
- Your client ID or demat account number.
- Contract notes, ledger, screenshots of trades and app messages.
- Your earlier complaint to the broker and its reply or ticket number.

1. First write to the broker's grievance desk. Its email and escalation contacts are on its website. Save the ticket number.
2. If there is no answer or the answer is poor, open [scores.sebi.gov.in](https://scores.sebi.gov.in/), or use the SCORES app.
3. Click **Sign in/Sign up**. In the pop up, click **Register** next to **Don't have an account?**
4. Register by fetching your details from the KYC Registration Agency (KRA) database, or fill the registration form yourself.
5. Sign in with your user ID, mobile number or email. Enter the OTP and your password. You will see the **Investor Dashboard**.
6. Click **Lodge a complaint**.
7. Choose the category and sub category, the nature of complaint, and the name of the broker or company.
8. Describe what happened in short sentences: dates, amounts, client ID, and what you want done. Attach your proof.
9. Submit. Save the complaint number.
10. The broker must reply on SCORES with an Action Taken Report within 21 calendar days. The dashboard shows days remaining.
11. Not happy with the reply? Ask for a first review within 15 calendar days. The Designated Body (for example the stock exchange) reviews it within 10 days.
12. Still not happy? Ask for a second review by SEBI within 15 days of that reply.
13. For money disputes you can also go to SMART ODR (smartodr.in) for conciliation and arbitration. Choosing ODR closes the SCORES complaint.
14. Help: SEBI toll free **1800 266 7575** or **1800 22 7575**, 9 AM to 6 PM.

Checked on 1 November 2026 against: [SEBI SCORES: complaint portal (home page with toll free numbers)](https://scores.sebi.gov.in/), [SEBI SCORES 2.0: FAQ (registration, lodging, 21 day timeline, reviews, one year limit)](https://scores.sebi.gov.in/faqs), [SEBI investor website: SMART ODR](https://investor.sebi.gov.in/smart_orr.html), [SMART ODR portal (run by the stock exchanges and depositories)](https://smartodr.in/).

Check that you are paying a real SEBI registered broker

### Check that you are paying a real SEBI registered broker

Many investment scams use WhatsApp or Telegram groups and ask you to pay into a private account. SEBI now gives registered brokers a special UPI handle and a free checking tool.

**Keep this ready before you start:**

- The UPI ID or the bank account number and IFSC you were asked to pay.

1. Look at the UPI ID. Registered brokers and mutual funds use the **@valid** handle with a suffix, such as **.brk** for brokers and **.mf** for mutual funds (for example abc.brk@validhdfc).
2. When you pay a @valid handle, your UPI app shows a thumbs up inside a green triangle. If you do not see it, stop.
3. To check any UPI ID or bank account, open [SEBI Check](https://siportal.sebi.gov.in/intermediary/sebi-check), or SEBI's Saarthi app.
4. Enter the @valid UPI ID, or the bank account number and IFSC. See if it matches a registered entity.
5. If it does not match, do not pay. Report the group or number on Chakshu. If you already paid, call 1930.

Checked on 1 November 2026 against: [SEBI press release 64/2025: @valid UPI handles and SEBI Check are live](https://www.sebi.gov.in/sebi_data/attachdocs/oct-2025/1759322811695.pdf), [SEBI Check: verify a broker's UPI ID or bank account](https://siportal.sebi.gov.in/intermediary/sebi-check).

## Related guides

- [\*\*Stock brokers and investment apps (SEBI)\*\*Trading apps, demat accounts, investment scams and SEBI SCORES.](https://dpdpr.in/rights/stock-brokers/)
- [\*\*Social media and messaging apps\*\*Fake profiles, hacked accounts, leaked photos and the Grievance Appellate Committee.](https://dpdpr.in/rights/social-media/)

See also [when a platform shares your data with a third party](https://dpdpr.in/rights/platforms-and-third-parties/) and the [escalation ladder](https://dpdpr.in/rights/escalation-ladder/).

## Official sources

Checked on 1 November 2026. Company pages are labelled as the company's own words.

- [SEBI press release 65/2026: caution against stock tips in invitation-only WhatsApp groups](https://www.sebi.gov.in/media-and-notifications/press-releases/oct-2026/caution-to-investors-against-stock-tips-offered-through-invitation-only-whatsapp-groups_105389.html)
- [SEBI press release 22/2025: frauds on social media platforms, 1600 number series](https://www.sebi.gov.in/sebi_data/attachdocs/may-2025/1746621138080.pdf)
- [SEBI Market Intelligence portal: report unregistered entities](https://mi.sebi.gov.in/)
- [SEBI SCORES: complaint portal (home page with toll free numbers)](https://scores.sebi.gov.in/)
- [SEBI SCORES 2.0: FAQ (registration, lodging, 21 day timeline, reviews, one year limit)](https://scores.sebi.gov.in/faqs)
- [SEBI press release 64/2025: @valid UPI handles and SEBI Check are live](https://www.sebi.gov.in/sebi_data/attachdocs/oct-2025/1759322811695.pdf)
- [National Cyber Crime Reporting Portal: FAQ](https://cybercrime.gov.in/Webform/FAQ.aspx)