A bank account freeze in a cyber-fraud case has, until now, worked with a brutal simplicity: somebody somewhere filed a complaint, a few thousand rupees traced their way into your account through three or four intermediaries, and your entire balance became unusable for months. The Rajasthan High Court has held that this cannot continue, and the reasoning it gave applies well beyond Rajasthan.
The case is Shree Balaji Enterprises v. Reserve Bank of India, citation 2026:RJ-JP:33344. Legal-press summaries report that Justice Anand Sharma disposed of 105 connected writ petitions by a common judgment delivered on 20 August 2026, a Thursday, with the detailed guidelines widely reported afterwards. We have relied on those summaries for the case details; we were not able to obtain the order text itself, and say so here rather than imply otherwise.
If your account has been frozen over a cyber-fraud complaint
- Find out which police station asked for it. Ask your bank for the reference of the agency request: the complaint number and the originating state. Without it you are writing to the wrong people.
- Go to that agency, not the portal. The cybercrime portal cannot lift a freeze, and the Home Ministry says so itself. The power sits with state police.
- Evidence the transaction. If you sold something and were paid, assemble the invoice, delivery proof and message trail showing you supplied something real.
- Ask for proportionality in writing. Cite the requirement that only the disputed amount be held where it can be identified, as the Rajasthan High Court has now directed.
- Use the grievance route. Clause 10 of the MHA SOP and I4C’s Grievance Redressal Module exist for this, and a documented grievance creates a record a later court application can rest on.
What the court directed
The court’s principal directions
- No blanket freeze on a vague message: An account cannot be put under an indefinite blanket debit freeze on a vague, unverified or cryptic communication from an agency.
- Record the link: The investigating officer must record a clear nexus between the account and the alleged crime.
- Hold only what is disputed: Where the disputed amount is identifiable and nothing justifies more, only that amount may be held; the account otherwise operates.
- Full freeze as the exception: Reserved for cases, such as mule accounts, where complicating factors justify it.
- Follow the statute: Agencies must comply with Sections 106 and 107 of the BNSS on reporting to the Magistrate and attaching property.
- Review it: Every continuing restraint must be reviewed and lifted promptly where the holder is uninvolved or the case is closed.
As reported by legal-press summaries of the judgment. The court also required Rajasthan's Director General of Police and the state's cyber crime chief to issue a comprehensive circular.
A bank cannot be used as a substitute for the statutory judicial process.
Rajasthan High Court, as reported
The court also directed the Reserve Bank of India to issue a general circular or advisory to all scheduled banks and other regulated entities, requiring periodical training and sensitisation programmes for the officials who actually action these requests. And it directed that grievances from account holders be resolved as per Clause 10 of the standard operating procedure issued by the Ministry of Home Affairs on 2 January 2026, a Friday.
The thing the government says on its own website
The most useful fact here is hiding on a login page rather than in any press release. The Ministry of Home Affairs, on the cyber police portal itself, states the following about the National Cyber Crime Reporting Portal and the Indian Cyber Crime Coordination Centre:
The claim: The national cybercrime portal froze your account, so it can unfreeze it. What the record shows: The Home Ministry’s own clarification: “neither NCRP nor I4C has the authority to place liens, freeze, or unfreeze bank accounts. The responsibility lies with the law enforcement agencies (LEAs) of the respective States/UTs.” I4C is a platform for reporting complaints with no administrative control over state police. False.
Read that twice if you have a frozen account. An enormous number of people spend weeks emailing the cybercrime portal, or turning up at a bank branch demanding that the portal be contacted, on the assumption that the portal did this and the portal can undo it. It did not and it cannot. The freeze was actioned by a state or union territory police force under the Bharatiya Nagarik Suraksha Sanhita, and that force is the only body that can lift it.
This is also precisely why the Rajasthan High Court’s directions are addressed to the Director General of Police rather than to I4C. The court aimed at the body that actually holds the power.
How an innocent account ends up frozen
Cyber-financial fraud moves money through layers. A victim in one state transfers money to an account controlled by fraudsters; that money is broken up and pushed onward within minutes, often through accounts belonging to people who have no idea what is passing through them. A small trader who sold a phone, a freelancer who invoiced a client, a shopkeeper who accepted a UPI payment: any of them can end up holding a few thousand rupees of tainted money without the faintest indication that anything is wrong.
When the complaint is filed and the trail is followed, every account in the chain can be flagged. Under the old practice, each of those accounts could be frozen in full.
The distinction the MHA's January 2026 SOP says decides everything
Money mule
- Knowingly lends an account to fraudsters, usually for a cut.
- Can face criminal action and a full freeze.
Bona fide receiver
- Sold goods or services, was paid, and had no reason to suspect the source.
- Should not face criminal action or a complete freeze.
- Has to evidence the underlying sale: invoice, delivery proof, chat records.
What proportional means in rupees
The difference between a blanket freeze and a lien on the disputed sum is not a technicality. It is the difference between a functioning business and a dead one.
Illustrative, following the example structure in the MHA SOP guidance. A blanket freeze immobilises twenty times the disputed sum.
There is a further protection worth knowing. Where the disputed sum is below ₹50,000 and no judicial order extends the hold, the bank is required to release the funds within 90 days. I4C has also developed a Grievance Redressal Module for account holders whose accounts are frozen or whose digital banking has been suspended, intended to give genuine holders a route to a fair review.
It is worth being clear about what kind of problem this is. Money sitting in a frozen account is not lost and it is not forgotten: unlike the unclaimed deposits that end up with the Reserve Bank after ten years of silence, this is money you know about, can see on your statement, and cannot touch. That makes it a procedural problem rather than a search problem, which is why the remedy is a police officer and a magistrate rather than a portal.
If you are the victim, the rules are different, and time-bound
Everything above concerns the person whose account received the money. If you are the person whose money was taken, a separate and much older framework applies: RBI’s directions on limiting customer liability in unauthorised electronic banking transactions.
| Situation | Your liability |
|---|---|
| Bank’s own fraud, negligence or deficiency | Zero: whether or not you report it |
| System breach elsewhere, reported within 3 working days | Zero |
| System breach elsewhere, reported in 4 to 7 working days | Lower of the transaction value or the cap in the table below |
| Reported beyond 7 working days | As per the bank’s Board-approved policy |
| Your own negligence, e.g. sharing credentials | Entire loss until you report it; the bank bears everything after |
Working days are counted per the working schedule of your home branch and exclude the date on which you received the bank’s communication about the transaction.
| Account type | Maximum liability |
|---|---|
| BSBD accounts | ₹5,000 |
| Other savings accounts, PPIs and gift cards | ₹10,000 |
| Current, cash credit or overdraft accounts of MSMEs | ₹10,000 |
| Individual current, CC or OD accounts with average balance up to ₹25 lakh | ₹10,000 |
| Credit cards with limit up to ₹5 lakh | ₹10,000 |
| All other current, cash credit and overdraft accounts | ₹25,000 |
Reproduced from Table 1 of the RBI circular. Your liability is the transaction value or this figure, whichever is lower, so a ₹3,000 fraud reported on day five costs you ₹3,000, not ₹10,000.
3 working days: How long a fraud victim has to report for zero liability. Report on day five instead and you can be liable for up to ₹25,000. Notify the bank first, in writing, and get a complaint reference; argue afterwards. The clock excludes the day you got the bank's message and runs on your home branch's working calendar.
Once notified, the bank must credit the disputed amount back, a shadow reversal, within 10 working days of your notification, value-dated to the date of the unauthorised transaction, and without waiting for any insurance settlement.
Which circular covers you depends on your bank. The one dated 14 December 2017 is addressed to urban, state and district co-operative banks. For a scheduled commercial bank, small finance bank, payments bank or prepaid instrument issuer, the equivalent is RBI circular DBR.No.Leg.BC.78/09.07.005/2017-18 of 6 July 2017. The liability structure is the same.
What the judgment does not do
Three limits are worth stating plainly, because a lot of coverage is reading this as a general amnesty.
It is a High Court judgment, and its operative directions (the circular within four weeks, the standing order) are addressed to the Rajasthan police. The reasoning carries persuasive weight elsewhere and the RBI direction has national reach, but a police officer in another state is not bound by it in the way a Rajasthan officer is.
It does not prevent a full freeze where one is justified. The court expressly preserved the ability to freeze an entire account where complicating factors such as a mule account exist. What it removed was the mechanical, unexamined, indefinite version.
And it does not make anyone’s account unfreezable. If money that is genuinely the proceeds of crime sits in your account, it can be attached under the BNSS. The judgment insists that the statutory process actually be followed, which is a different thing from saying the process cannot reach you.
What to do if it happens to you
The five steps at the top of this guide are the sequence that works. What the ruling adds is leverage for the fourth: a High Court direction that only the identifiable disputed sum may be held, which you can now cite by name when you ask for the rest of your money back.
What the ruling changes for you
The significance of this ruling is not that it invented a new protection. Proportional holding was already the stated policy in the MHA standard operating procedure of January 2026. The significance is that a constitutional court has now said the policy is binding practice rather than advice, attached a compliance mechanism to it, and told the Reserve Bank to train the bank officials who press the button.
For anyone dealing with a bank account freeze, the practical takeaways are three. The cybercrime portal did not do this and cannot undo it: find the investigating agency. Proportionality is the argument to make, in writing, because a five-thousand-rupee dispute does not justify immobilising a lakh. And if the disputed sum is under ₹50,000 with no judicial order behind the hold, the ninety-day release is a deadline you can hold the bank to.
The deeper problem the court identified is structural and remains unfixed. A bank freezing an account on a one-line message from an agency is performing a judicial function without any of the safeguards that attach to one. Until the standing orders and the RBI advisory actually land, that will keep happening, and outside Rajasthan, nobody has been given a four-week deadline to stop it.
Frequently asked
- Can the cybercrime portal freeze or unfreeze my bank account?
- No. The Ministry of Home Affairs states on its own cyber police portal that neither the National Cyber Crime Reporting Portal nor I4C has the authority to place liens, freeze or unfreeze bank accounts. That power sits with the law enforcement agencies of the respective States and Union Territories under the BNSS. Writing to the portal will not lift a freeze.
- What did the Rajasthan High Court rule about bank account freezes?
- In Shree Balaji Enterprises v. Reserve Bank of India (2026:RJ-JP:33344), the Court held that no account may be subjected to an indefinite blanket debit freeze on a vague or cryptic communication. Where the disputed amount is identifiable, only that amount may be held under lien. Investigating officers must record a clear link between the account and the alleged crime, comply with Sections 106 and 107 of the BNSS, and review every continuing restraint periodically.
- Can my whole account be frozen for a small disputed amount?
- It should not be, where the disputed sum is identifiable and nothing else justifies a wider freeze. On a balance of ₹1,00,000 with a ₹5,000 disputed transaction, the proportionate approach holds ₹5,000 and leaves ₹95,000 operable. A full freeze is reserved for cases with complicating factors such as a mule account.
- What is the difference between a money mule and a bona fide receiver?
- A money mule knowingly allows their account to be used by fraudsters, usually for a share of the proceeds. A bona fide receiver sold goods or services and was paid, with no reason to suspect the source of the money. Under the Ministry of Home Affairs standard operating procedure, bona fide receivers should not face criminal action or a complete account freeze.
- How quickly must I report a fraud to avoid liability?
- Within three working days of receiving the bank’s communication about the transaction, for zero liability where the breach lies elsewhere in the system. Reporting in four to seven working days limits your liability to the transaction value or a cap of ₹5,000 to ₹25,000 depending on account type, whichever is lower. Beyond seven working days it is decided by the bank’s own Board-approved policy.
- How long can a bank hold my money in a cyber-fraud case?
- Where the disputed sum is below ₹50,000 and no judicial order extends the hold, the bank is required to release the funds within 90 days. Account holders can also use Clause 10 of the MHA standard operating procedure and I4C’s Grievance Redressal Module to seek a review.
