What Changed · Part 2 · Banking · 12 min read · September 2026

Your account is frozen over someone else's fraud. Who froze it decides who can unfreeze it.

The customer at the counter holds out his phone. The balance is all there — every rupee of it — but UPI payments fail, the ATM declines, and the app shows a line he has never seen before. I haven't done anything, he says, and very often that is true. The branch can see the restriction on its screen. What it usually cannot do is remove it, because in most of these cases the bank is not the one who decided to put it there.

The first question at the desk: who put it there?

"Frozen" is the word everyone uses, but it covers three different restrictions. They come from different places, they are lifted by different people, and the route out of one does nothing for the other two. So before anything else, find out which one you have.

A hold on a specific amount. This is the most common kind today. Someone loses money to a fraud and reports it on the national cybercrime portal or through the 1930 helpline. The police push the complaint into the reporting system that banks are connected to, and the system follows the money account by account. Every bank the money reached gets a notice, and holds up to the reported amount in the account that received it. If ₹18,000 of that money landed with you, ₹18,000 is held. The rest of your balance should still be usable — which is why it helps to look at your available balance, not the total.

Digital banking switched off, or the account seized. When the same account turns up in several complaints, the police can go further. They can direct the bank to stop UPI, IMPS, NEFT, RTGS, ATM and card use — leaving only transactions at the branch counter — or seize the account outright under Section 106 of the Bharatiya Nagarik Suraksha Sanhita. This is the version that feels like a freeze, because it is one.

The bank's own restriction. The third kind has nothing to do with a complaint. Banks restrict accounts on their own when a periodic KYC update is overdue, or when their monitoring flags activity that looks like money laundering. A KYC restriction ends with a KYC update at the branch. A suspicion-based hold is what RBI's September draft is about — more on that below.

To tell them apart, ask the branch — in writing if you can — for three things: what type of restriction it is, the reference number that came with it, and which police station or officer ordered it, if one did. You are entitled to more of this than most people assume. The Home Ministry's 2026 procedure for the cybercrime reporting system lets the bank give you the address and contact details of the agency that ordered the action, and the Financial Intelligence Unit clarified in June 2025 that sharing this is not "tipping off". What you will not be told is anything about the person who complained.

Why an honest account ends up in a fraud trail

The system that froze your account was built to be fast, and for the victim it has to be. When someone calls 1930 within minutes of being cheated, the money is often still sitting in the first account it reached, and a hold placed then saves it. The Home Ministry's own figures show the scale: between April 2021 and November 2025, holds stopped ₹7,647 crore of the ₹52,969 crore reported from leaving the banking system. The same document admits the other half of the story — only ₹167 crore of that had actually gone back to victims. Money is held quickly. It is released slowly, to the victim and to everyone caught in between.

The trail also does not care whether you knew. Fraud money rarely stops at the first account. It is split, forwarded, spent on a phone, used to buy crypto from a stranger, or sent as a "refund" for an order that never existed. If someone paid you with money they had just stolen, your account is a layer in their fraud, and it gets a notice like every other layer. The procedure itself tells investigating officers to keep in mind that an account may have been used without its holder's knowledge — which says a great deal about how often that happens.

The files that reach a branch desk tend to follow a handful of patterns. A second-hand phone, bike or laptop sold online to a buyer who paid by UPI. A peer-to-peer crypto sale. An unexpected credit, followed by a call asking you to "return" it — to a different number. A relative or employee who used your account or UPI ID for their own transactions. In each case the account holder may have done nothing wrong on their side. In each case the hold stays valid until someone with the authority to lift it says so.

The route that works today: your branch first, then the police, on a clock

For restrictions that came through the cybercrime portal, the Home Ministry's procedure sets out a grievance route with a deadline at every step. The most important thing it says is also the least obvious: the door is your own branch, not the police station.

1. Go to your branch, in person

   Visit the branch where the account is held, or the one your bank designates. For banks with branches, the procedure expects you to come in, because the bank has to re-check your KYC. Carry your ID, a statement showing the credit, any SMS or notice you received, and whatever proves the credit was genuine — an invoice, the chat with the buyer, a delivery receipt, a sale agreement.

2. The bank checks first — within 7 days

   The bank runs its own due diligence on you and on the transaction. If it is satisfied the transaction was genuine, it files your grievance on the portal's grievance module within 7 calendar days of your complaint. This is where many files quietly stall: the bank has to be convinced before the police ever see your side. Paper convinces it. A story does not.

3. The investigating officer decides — within 15 days

   The officer verifies your explanation, preferably over a video call; the procedure says you should not normally be summoned in person. If satisfied, the officer directs the bank to lift the hold within 15 calendar days of receiving the grievance. If not, the reasons are recorded and sent to you by SMS or email.

4. Silence or refusal escalates it

   If the officer does nothing for 15 days, the grievance moves on its own to a District Grievance Officer of Additional or Deputy Superintendent of Police rank. If the officer refuses, you can ask for a review within 15 days, again through the branch. The district officer then has 15 days to decide.

5. A seized account can go one level higher

   Where the account was seized or its digital banking suspended, a further appeal lies to a State Grievance Officer — a Deputy Inspector General of Police or above — within 15 days, with another 15 days for the decision.

There is also a 90-day clock for holds you have contested this way. If no lawful direction to continue the hold arrives within 90 days of the bank filing your grievance, the bank has to alert the police before the period runs out. If the money is not needed in any other case, no court petition is pending over it and the police have not asked for more time, the hold can then come off at your request after the bank's own checks. The police can seek up to 90 more days. At any stage, the courts remain open to you.

If the account holder is a senior citizen, has a disability, or is terminally ill and cannot come to the branch, the procedure allows someone else to raise the grievance on their behalf.

One honest caveat. On 4 August 2026 the Supreme Court recorded that the grievance portal already covered 1,23,590 branches across 69 banks — and in the same order told every state to put the grievance and money-restoration modules to work without delay, which tells you they do not yet work equally well everywhere. If the branch says it has never heard of this route, ask for the bank's grievance officer for cyber-fraud holds, and put your request in writing.

What RBI's September draft actually proposes

The draft is RBI's answer to that same Supreme Court order, which asked it to write a standard procedure for temporary debit holds on money linked to mule accounts and cyber fraud. RBI released it for public comment on 11 September as an amendment to its KYC Directions. Read it slowly and one line changes how you should read all the coverage around it: the procedure is for holds a bank places on its own suspicion, and it expressly sets aside holds placed or continued on a specific instruction from a law-enforcement agency.

For those bank-initiated holds, the draft sets a clock at every step:

The whole-account version exists too. If the bank suspects the account itself is a mule account, the draft lets it hold everything — though the bank's internal policy must treat an account-level hold as a last resort, for exceptional circumstances. Two other lines deserve attention. Banks would have to display their nodal officers' names and contact details on their websites and in every branch, and resolve complaints under this procedure within 30 days. And an account released after a hold does not simply go back to normal: the bank must keep it — and your other accounts and relationships with that bank — under enhanced monitoring.

None of this is in force yet. Comments close on 2 October 2026, and RBI has proposed that the directions apply from 1 April 2027, or earlier if a bank decides to adopt them sooner.

What the headlines got wrong

"RBI limits freezes to the disputed amount." Not quite. The very first step of the draft allows a hold on the entire account when the bank suspects the account itself is a mule account. The "last resort" language is an instruction about what a bank's internal policy must say, and "exceptional circumstances" is not defined.

"Frozen accounts will be released in 60 days." Only holds a bank places on its own suspicion. A hold ordered through the cybercrime portal runs on police instructions and on the Home Ministry procedure's clocks — the draft does not touch it.

"The new rules apply now." They are a draft. If your account was frozen after a cyber complaint this year, the route that applies to you is the grievance route above.

What the courts have been saying

Much of this law is being written one petition at a time. In August 2026 the Rajasthan High Court decided 105 such petitions together and held that where the disputed amount can be identified, the account should be allowed to run with a hold on that amount alone. In some of the cases before it, the disputed transactions were below ₹1,000 while balances many times larger sat frozen. Other High Courts have taken a similar line in individual cases. That is a summary for understanding, not legal advice — whether a petition makes sense in your case is a question for a lawyer who has seen your papers.

From the desk: the first 48 hours

• Get the facts in writing. The type of restriction, the reference number, and the police station that ordered it, if any. Day one
• Collect your proof before anyone asks. The statement page with the credit, the chat or invoice behind it, and the sender's details. Day one
• Raise the grievance at your branch. Ask for an acknowledgement — the bank's 7-day clock runs from your complaint. Within 48 hours
• Protect your EMIs. A frozen salary account bounces an EMI as surely as an empty one, and the credit bureau records the missed payment, not the reason. Tell your lender in writing and pay from another source. Before the next due date
• Don't route money around the hold. Opening a fresh account elsewhere and moving money through it can make your file look worse, and restrictions have followed account holders to other banks. Always
• Never pay anyone to get unfrozen. Calls from the "cyber cell" offering release for a fee are a fraud of their own. The grievance route costs nothing. Always

Fast to hold, slow to release — but no longer unwritten

The machinery that froze your account was built for the person who lost money, and it does that job well: it moves in minutes, and it catches funds before they vanish. Release was never designed to be fast. What changed in 2026 is that release now has a written process, named officers and deadlines — and if RBI finalises its draft, a bank's own holds will get a clock of their own.

Use the process. Keep paper at every step. And start at the branch.

Written at the MoneyClarityTech desk — by a working retail-credit professional in Indian banking who reads loan files, credit reports and bank statements every working day. Patterns from hundreds of real cases; every identifying detail removed. More about MoneyClarityTech →