Cryptocurrency scam — what you can recover in India
Cryptocurrency is not legal tender in India and is not banned in India. The legal channels for scam recovery target the rupee off-ramp — the bank, the UPI rail, the FIU-registered exchange — not the crypto itself. Once funds leave to a foreign or self-custodial wallet, on-chain recovery is extremely limited. This article maps the regulatory grey zone, the tax-and-PMLA overlays, the criminal levers under the IT Act and the BNS, and the structural limits on recovery.
Regulatory-volatility caveat at the threshold: the Indian legal framework for cryptocurrency is in motion. As of the last-reviewed date of this article (12 May 2026), the position rests on three settled props — the Supreme Court's 2020 ruling in Internet & Mobile Association of India v Reserve Bank of India, the Finance Act 2022's tax-recognition framework for Virtual Digital Assets, and the 7 March 2023 Ministry of Finance notification bringing VDA service providers within the Prevention of Money-Laundering Act, 2002. None of these props grants cryptocurrency legal-tender status; none of them bans it; together they create a tax-and-AML-recognition framework around a financial instrument that the Reserve Bank of India does not formally regulate as currency. A draft Cryptocurrency and Regulation of Official Digital Currency Bill has been pending in successive sessions and may, when enacted, displace the framework described here. The doctrine in this article should be read as the position on the last-reviewed date.
The regulatory state — three props and one structural gap
The structural fact about Indian crypto regulation is that there is no central statute. The framework is built from three orthogonal interventions, each addressing one slice of the question.
The first prop — the IAMAI ruling. The Reserve Bank of India's circular dated 6 April 2018 prohibited banks and other RBI-regulated entities from dealing in virtual currencies or providing services to any individual or business entity that dealt in or settled virtual currencies. The Supreme Court, in Internet & Mobile Association of India v Reserve Bank of India, (2020) 10 SCC 274, set the circular aside on proportionality grounds. The Court held that while the RBI's power under Section 35A of the Banking Regulation Act, 1949, Section 36(1)(a) of the same Act and the relevant provisions of the Payment and Settlement Systems Act, 2007 was broad enough to issue such a circular in principle, the particular circular failed the proportionality test because the RBI had not demonstrated any actual or proximate harm caused to its regulated entities by the trading of virtual currencies. The IAMAI ruling did not legalise cryptocurrency — it merely vacated the banking-channel prohibition. Post-IAMAI, banks may, subject to KYC and AML diligence, service crypto-related transactions.
The second prop — the Finance Act, 2022 tax-recognition framework. The Finance Act, 2022 inserted Section 2(47A) into the Income-tax Act, 1961, defining "virtual digital asset" — any information or code or number or token (not being Indian currency or foreign currency) generated through cryptographic means and providing a digital representation of value, including any non-fungible token. Section 115BBH was inserted to provide a flat thirty per cent tax on income from the transfer of any VDA, with no deduction permitted other than the cost of acquisition, no set-off of loss from one VDA against gain from another, and no carry-forward of VDA losses. Section 194S was inserted to require deduction of tax at source at one per cent on the consideration for transfer of a VDA by a resident, with effect from 1 July 2022. These tax-recognition provisions are emphatically not legal-status grants — Section 115BBH(3) expressly clarifies that the Section does not affect the legal status of any VDA under any other law for the time being in force. The Finance Act 2022 framework is a tax-collection lever on a financial instrument the legislature has declined to characterise as currency.
The third prop — the PMLA notification. Notification S.O. 1072(E) dated 7 March 2023 issued by the Ministry of Finance under Section 2(1)(sa)(vi) of the Prevention of Money-Laundering Act, 2002 brought "virtual digital asset service providers" within the definition of "person carrying on designated business or profession" — and therefore within the "reporting entity" obligations of the PMLA. A VDASP is now obliged, under Section 12 of the PMLA, 2002, to maintain records of all transactions, verify the identity of clients, maintain beneficial-owner information and furnish information to the Financial Intelligence Unit-India. FIU-IND registration is required for any entity carrying on VDA exchange, transfer, custodial, administrative or financial-service activities. The 7 March 2023 notification is the principal AML overlay; Vijay Madanlal Choudhary v Union of India, 2022 SCC OnLine SC 929, the Supreme Court's three-judge ruling upholding the broad architecture of the PMLA (Sections 3, 5, 8, 17, 19, 24, 45 and 50), supplies the constitutional backdrop against which the VDA-VDASP overlay operates.
The structural gap is that none of the three props grants cryptocurrency legal-tender status; none of them ban it; none of them creates a sectoral regulator for crypto in the way SEBI regulates securities or the IRDAI regulates insurance. The result is a financial instrument that is taxed, AML-monitored and bank-channel-permissible, but neither legally tendered nor sectorally regulated. The scam-recovery framework operates against this structural gap.
The scam architecture — what is actually being run
The recurrent scam patterns are five.
Pump-and-dump runs — a coordinated group of operators inflate the price of a thinly-traded token through social-media coordination and matched buy-orders, then sell into the retail buyers they have attracted. The Indian doctrinal lever is cheating under Section 318 BNS combined with the IT Act offences below; SEBI's securities-fraud jurisdiction does not extend to VDAs because Section 2(h) of the Securities Contracts (Regulation) Act, 1956 does not include VDAs within "securities". The doctrinal floor for pump-and-dump is therefore Section 318 BNS, not the securities-fraud framework.
Fake-exchange scams — a counterfeit website or app, often impersonating a legitimate FIU-registered exchange, collects deposits and either disappears or freezes withdrawals. The criminal characterisation engages Section 66D of the IT Act, 2000 (cheating by personation by computer resource) and Section 319 BNS (cheating by personation).
Wallet-drainage via phishing or SIM-swap — the victim's seed phrase or two-factor authentication is compromised through phishing, vishing or carrier-level SIM swap, and the perpetrator drains the wallet. The criminal characterisation engages Section 66 IT Act, Section 66C IT Act (identity theft) and Section 66D IT Act, along with Section 318 BNS.
P2P romance-and-investment scams — the perpetrator builds a multi-week relationship with the victim through a dating or messaging platform, then induces a transfer to a fake "trading platform" that simulates returns and ultimately freezes withdrawal. The conventional charge-set is Section 318 BNS, Section 319 BNS, Section 61 BNS (conspiracy where multiple operators are involved) and Section 66D IT Act. Where the scam operates on the scale and organisation that the Section 111 BNS "organised crime" definition contemplates — continuing unlawful activity by two or more persons, including by an organised crime syndicate, with a substantial pecuniary benefit — the Section 111 BNS overlay is engaged and the punishment escalates.
Off-ramp laundering — the perpetrator, having taken the victim's INR through a UPI or bank transfer to a "mule" account, converts it to USDT or another stablecoin on a non-KYC exchange and routes it onward. This pattern engages the PMLA — Section 3 (offence of money-laundering: directly or indirectly attempting to indulge in or knowingly assisting or knowingly being a party to any process or activity connected with the proceeds of crime and projecting or claiming it as untainted) and Section 4 (punishment: rigorous imprisonment for three to seven years and fine), with the predicate offence drawn from the Schedule to the PMLA — into which the cheating offences under Section 318 BNS [Section 420 IPC] and the IT Act offences are read.
The criminal map — IT Act + BNS + PMLA
The criminal track in a cryptocurrency scam pulls on three statute-sets in combination.
Under the Information Technology Act, 2000: Section 43 (civil-penalty for unauthorised access, contamination or damage to a computer resource) supplies the civil-penalty foundation; Section 66 (computer-related offences) criminalises Section 43 acts done dishonestly or fraudulently — imprisonment up to three years and fine up to five lakh rupees; Section 66C (identity theft) criminalises fraudulent or dishonest use of an electronic signature, password or unique identification feature of another person — imprisonment up to three years and fine up to one lakh; Section 66D (cheating by personation by computer resource) criminalises personation by means of a computer resource or communication device — same punishment ceilings. The Supreme Court in Shreya Singhal v Union of India, AIR 2015 SC 1523, while striking down Section 66A, expressly preserved Section 66 on the ground that its "dishonestly" and "fraudulently" elements are defined with sufficient specificity. Sharat Babu Digumarti v Government of NCT of Delhi, (2017) 2 SCC 18, held that where the IT Act and the IPC both punish the same conduct in the electronic-record space, the special-law IT Act offence prevails on the doctrine of generalia specialibus non derogant — a principle that continues to apply under the IT Act / BNS configuration.
Under the Bharatiya Nyaya Sanhita, 2023: Section 318 (cheating, the successor to Sections 415, 417 and 420 IPC) supplies the generic cheating offence — Section 318(4) BNS prescribes imprisonment up to seven years and fine for the aggravated dishonest-inducement form; Section 319 (cheating by personation, the successor to Sections 416 and 419 IPC) supplies the personation-specific offence; Section 61 BNS (criminal conspiracy, the successor to Section 120B IPC) supplies the multi-actor lever; Section 111 BNS (organised crime, the BNS's new offence with no direct IPC predecessor) supplies the scale-and-syndicate lever where two or more persons engage in continuing unlawful activity for direct or indirect material benefit. Section 111 BNS carries a punishment of rigorous imprisonment from five years to life — a meaningful uplift from the Section 318 / Section 66D ceilings and the single most important doctrinal addition of the BNS for high-value crypto-scam prosecutions.
Under the Prevention of Money-Laundering Act, 2002: Section 3 defines the offence of money-laundering — directly or indirectly attempting to indulge in or knowingly assisting any process or activity connected with the proceeds of crime, including its concealment, possession, acquisition or use and projecting or claiming it as untainted; Section 4 prescribes the punishment — rigorous imprisonment of three to seven years and fine. The predicate offence (the scheduled offence whose commission yields the proceeds of crime) is drawn from the Schedule to the Act, which includes cheating under Section 420 IPC (and, by application of Section 8(1) of the General Clauses Act, 1897, the corresponding BNS Section 318(4)). Section 12 of the PMLA imposes reporting and KYC obligations on reporting entities — including, after the 7 March 2023 notification, VDA service providers. The Enforcement Directorate's PMLA jurisdiction is engaged where the proceeds-of-crime threshold is met; the Section 5 attachment, Section 17 search, Section 19 arrest and Section 50 summons powers operate. Vijay Madanlal Choudhary v Union of India, 2022 SCC OnLine SC 929, upheld this architecture.
Procedural levers under the Bharatiya Nagarik Suraksha Sanhita, 2023: Section 173 BNSS [Section 154 CrPC] is the FIR provision. Section 105 BNSS [Section 100 CrPC] is the search-and-seizure provision and, applied to digital fraud, authorises seizure of devices, hot wallets, hardware wallets and any computer resource in which the proceeds or evidence may reside. The recording of digital seizure under the BNSS regime is required to be audio-video recorded — a procedural safeguard relevant to admissibility of seized crypto-related evidence under Section 63 of the Bharatiya Sakshya Adhiniyam, 2023 (the successor to Section 65B of the Indian Evidence Act, 1872).
The recovery channels — where the legal levers actually bite
The structural truth of crypto-scam recovery in India is that the levers bite the rupee off-ramp, not the cryptocurrency itself. The recovery channels are four, and each has a defined reach and a defined limit.
Channel one — the cybercrime portal and the 1930 helpline. Where the victim's INR has passed through a bank or UPI rail before reaching the scammer's wallet — the typical pattern in P2P romance scams and fake-exchange scams — the National Cybercrime Reporting Portal at cybercrime.gov.in and the financial-fraud helpline at 1930 are the first lever. The reporting triggers, on the banking side, the Reserve Bank of India's circular dated 6 July 2017 (DBR.No.Leg.BC.78/09.07.005/2017-18) — "Customer Protection: Limiting Liability of Customers in Unauthorised Electronic Banking Transactions" — issued under Section 35A of the Banking Regulation Act, 1949. The circular's three-bucket liability framework allocates loss based on where the fault lay and how quickly the customer notified the bank after the bank's communication: zero customer liability where the loss was caused by bank or system breach (or by third-party breach where the customer notifies within three working days); limited liability capped per account type for notification between four and seven working days; full customer liability for notification beyond seven working days subject to the bank's Board-approved policy. Paragraph 9 of the circular requires shadow-reversal within ten working days. The circular bites the bank, not the scammer — but it is the principal lever for recovering at least part of the INR debit before it is converted to crypto.
Channel two — the FIR under Section 173 BNSS. The FIR with the IT Act and BNS charges set out above is the principal criminal lever. The investigation under Section 176 BNSS engages the cybercrime cell of the State police; the search-and-seizure powers under Section 105 BNSS reach the scammer's devices and wallets where they are physically located in India. Where the scam has crossed a State boundary, Section 197 BNSS (place of inquiry or trial) supplies the venue-flexibility lever.
Channel three — the ED-PMLA route. Where the proceeds-of-crime element is engaged, the Enforcement Directorate may register an Enforcement Case Information Report and exercise the Section 5 attachment power against assets traceable to the proceeds. The ED's PMLA jurisdiction, post-Vijay Madanlal Choudhary, is broad enough to reach cryptocurrency held in Indian wallets and at FIU-registered Indian exchanges; the cross-border reach is shaped by mutual legal assistance arrangements. The ED route is in practice reserved for high-value cases; retail crypto-scam victims do not typically secure ED attention except where the case aggregates into an investigation of an organised scam.
Channel four — exchange cooperation. The 7 March 2023 PMLA notification has, in practice, given Indian law enforcement a working channel with FIU-registered exchanges. Where a victim can identify the receiving wallet and link it to an account at a registered exchange, the exchange's Section 12 PMLA obligations — KYC, record-maintenance, FIU reporting — give law enforcement a hook to obtain the beneficial-owner information and, where the funds are still in the exchange's custody, to freeze them. The lever fails where the funds have moved to a non-KYC exchange or to a self-custodial wallet; once funds are in a self-custodial wallet whose private key the victim does not control, no domestic legal channel can compel the wallet's owner to part with them.
The structural limit — on-chain recovery is extremely limited
The single most important doctrinal point in this field is one that the regulatory and prosecutorial architecture does not solve. Once the proceeds of a crypto-scam leave the regulated rupee off-ramp and arrive in a self-custodial wallet, the legal channels reach the architecture but not the asset.
The reasons are structural. A self-custodial wallet is controlled by whoever holds the private key. A court order against an unknown wallet-owner cannot be served, cannot be enforced and cannot, without the cooperation of the wallet-owner, recover the asset. The blockchain is transparent — tracing the transaction flow is in many cases possible — but transparency is not recovery. An order against a foreign exchange is enforceable only through the foreign jurisdiction's recognition rules; for non-MLAT jurisdictions, the recovery lever is effectively absent.
The Indian recovery framework therefore operates on the rupee side of the off-ramp, not on the crypto side. Where the bank or UPI rail can still be reached — the customer has notified within the RBI circular's three-working-day window, the receiving bank account is identifiable, the scammer's mule account has not yet been emptied — partial recovery is realistic. Where the funds have already been converted to USDT, moved to a foreign exchange and withdrawn to a self-custodial wallet, the practical recovery is, in most retail cases, zero.
This structural limit shapes everything else. The criminal-track charges under Section 318 BNS, Section 66D IT Act and Section 111 BNS may produce prosecution and conviction; the PMLA proceedings may produce attachment of any Indian-resident assets of the perpetrator; the consumer-fora route is not available because cryptocurrency-related disputes have generally not been treated as falling within "consumer" jurisdiction. But the actual recovery of the lost cryptocurrency, once self-custodied, is doctrinally beyond Indian legal channels.
The procedural roadmap for the victim
The roadmap admits of a short sequence that follows from the channels just described.
Within seventy-two hours of the suspected fraud. Report to cybercrime.gov.in and call the 1930 financial-fraud helpline; notify the bank in writing of any unauthorised debit to trigger the RBI 6 July 2017 circular's three-working-day zero-liability window. Where the debit has passed through UPI, the UPI operator (NPCI) is notified through the bank channel.
Within seven days. File the FIR under Section 173 BNSS at the jurisdictional cybercrime police station with charges drawn from Section 318 BNS, Section 319 BNS (where personation is involved), Section 61 BNS (where conspiracy is involved), Section 111 BNS (where the scale-and-syndicate threshold is met), Section 66 IT Act, Section 66C IT Act (where credentials were misused), and Section 66D IT Act (where personation by computer resource is involved). Where the scam was operated through an FIU-registered exchange, the exchange is named in the FIR with a specific prayer for KYC-trail disclosure under Section 12 PMLA.
Documentary trail. The transaction hashes, the wallet addresses (sending and receiving), the exchange order-IDs, the communications with the scammer (chat logs, emails, voice-call recordings) and the bank-statement entries are compiled. The hash, address and order-ID trail is the principal evidentiary anchor; it is the input on which any on-chain tracing analysis depends and the basis for the Section 63 BSA certificate accompanying the electronic record.
Subsequent steps depend on case-value. A representation to the Enforcement Directorate where the proceeds-of-crime threshold is met; a complaint to FIU-IND where a registered exchange's KYC obligations have been breached; a civil suit against any identifiable Indian-resident perpetrator for recovery of the rupee value (the limitation under Article 113 of the Schedule to the Limitation Act, 1963 is three years from the accrual of the right). The civil-suit route is rare but doctrinally available.
Where the framework sits today and what remains genuinely open
The position in 2026 admits of four propositions.
One — the three-prop framework (IAMAI, Finance Act 2022, PMLA notification of 7 March 2023) is settled in the sense that no element of it has been judicially disturbed since its inception. The framework is, however, partial; the absence of a sectoral regulator and a comprehensive statute is a structural feature, not a transition-phase artefact.
Two — the criminal-track levers under the IT Act and the BNS are doctrinally adequate to prosecute the typical crypto-scam patterns. Section 111 BNS (organised crime) is the principal new lever; its application to crypto-scam syndicates is at an early stage and the case-law contours are still being drawn.
Three — the recovery levers operate on the rupee off-ramp. The RBI 6 July 2017 circular, the 1930 helpline, the FIU-registered exchange's KYC obligations, and the ED's PMLA attachment power between them cover the regulated channels through which the scam proceeds pass. Where the proceeds remain in those regulated channels, partial recovery is realistic; where they have crossed into self-custodial or non-cooperating-foreign-jurisdiction custody, recovery is structurally limited.
Four — the doctrinal questions that remain open are five. First, the constitutional status of cryptocurrency once the pending Cryptocurrency Bill is enacted is unsettled and may significantly alter the framework above. Second, the interface between the Finance Act 2022 tax-recognition framework and any future sector-specific regulation has not been worked out. Third, the question whether a cryptocurrency holder is a "consumer" for the purposes of Section 2(7) of the Consumer Protection Act, 2019 in respect of services rendered by an FIU-registered exchange is not authoritatively decided. Fourth, the admissibility of on-chain analysis evidence — output of forensic blockchain-tracing tools — under Section 63 of the Bharatiya Sakshya Adhiniyam, 2023 is at an early stage and trial-court practice has not consolidated. Fifth, the cross-border-attachment question — whether and how an Indian Enforcement Directorate order can reach cryptocurrency held in a foreign self-custodial wallet — remains practically unresolved.
For the victim who notifies within seventy-two hours, files the FIR within the week, and pursues the FIU-registered exchange and the bank in parallel, the framework is genuinely effective for the rupee leg of the loss. For the victim whose funds have left the regulated channels into a self-custodial or non-cooperating-foreign custody, the framework is, on the doctrine as it stands at the last-reviewed date, partial. The grey zone is real, the channels are mapped, and the limits are structural — not the product of an oversight in the current text but the consequence of a regulatory architecture that has chosen taxation and AML-monitoring over sectoral regulation of the underlying asset.