Documents needed to file a UPI fraud complaint

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 3 Nov 2026 · Online fraud

A UPI fraud complaint is decided by paperwork, not by how loudly it is made. You need a written complaint, a bank statement showing the debit, the UPI transaction ID or UTR, screenshots of the call, chat or link that made you pay, and identity proof. Gather those five and both the bank and the police have something to act on.

Your UPI fraud complaint is only as strong as the paper behind it. The bank and the police both need the same three facts in one place: that money left your account, that you did not authorise it, and exactly which transaction it was. The core set of documents is short - a written complaint, a bank statement covering the debit, the UPI transaction ID or UTR shown against it, screenshots of whatever induced the transfer, and proof of your identity. Everything else you gather supports those five.

No statute prints a list headed "documents for a UPI fraud complaint". The requirement is built from two directions at once. Your bank acts under the Reserve Bank of India's directions on limiting customer liability in unauthorised electronic banking transactions, which oblige it to accept your report, acknowledge it, and credit the amount back within the timelines those directions set. The police act on a first information report under section 173 of the Bharatiya Nagarik Suraksha Sanhita, 2023, which must disclose a cognizable offence. In a UPI fraud that offence is ordinarily cheating under section 318(4) of the Bharatiya Nyaya Sanhita, 2023, punishable with imprisonment of up to seven years, usually read with sections 66C and 66D of the Information Technology Act, 2000, which deal with identity theft and with cheating by personation using a computer resource.

The five documents that matter most

If you gather nothing else, gather these. Each one answers a question that the bank's nodal officer or the investigating officer would otherwise have to ask you twice, and each one is available to you without waiting for anybody's permission.

Document	What it proves	Where you get it
Written complaint, signed and dated	The date and manner of reporting, which starts the bank's response clock	You draft it and submit it to the bank and the police station
Bank statement covering the debit	The amount, date, time and the running balance before and after	Net banking as a PDF, or the branch for a stamped copy
UPI transaction ID, UTR or reference number	Lets the bank trace the beneficiary and the settlement leg of the transfer	The payment app's transaction details screen, or the bank's alert
Screenshots of the inducement	Dishonest intention - the false promise, call, chat, link or collect request	Your own phone; keep the originals, do not delete the thread
Identity proof, ideally masked	That you are the account holder entitled to make the complaint	Your own records; share a masked copy where it is accepted

The written complaint

Write it yourself, in plain language, and keep it to a page if you can. A complaint is read once, quickly, and it either tells the reader what happened or it does not. Use dates and amounts, not adjectives. The particulars that should always appear are these:

Your name, address, mobile number and email, and the bank, branch and account number.
The date and time of the debit, the amount, and the UPI transaction ID or UTR.
How the fraud ran - a call, a message, a link, an app, a QR code or a collect request - in two or three sentences.
A clear statement that you did not authorise the transaction and received neither goods nor services.
What you have already done, with reference numbers: the bank helpline call, the 1930 call, the complaint on the National Cyber Crime Reporting Portal.
What you want: reversal of the amount and written acknowledgement of the complaint.

Keep a copy of everything you send, and the date you sent it. If you hand the complaint in at the branch counter, ask for a receipt or a stamp on your copy. If you send it by email, send it to the bank's nodal officer address from the address registered with the bank, and keep the sent mail.

Proof that the money left your account

The statement is the spine of the case, and the bank's own alert is the time stamp. Download the statement for the whole month rather than only the day of the debit, so the entries before and after sit in context. Then keep the SMS or email alert the bank sent for that transaction: the directions on customer liability run from the moment the bank communicates the unauthorised transaction to you, so the alert is not a nuisance, it is the starting point of a deadline.

Read the narration carefully. UPI debits can appear against a virtual payment address, a merchant name or a person's name, and the beneficiary is sometimes shown only in the app and not on the statement. Write down the beneficiary exactly as it appears, character for character. A single wrong character in a virtual payment address sends a tracing request down the wrong path and costs days you do not have. If the app shows a twelve-digit reference alongside the transaction, note it as well as the short UPI transaction ID; the two are different numbers and the bank may ask for either.

Proof of the inducement

This is the set most victims under-collect, and it is the one that converts a bank complaint into a criminal case. Money leaving your account without your consent is a banking problem. Money leaving it because someone lied to you is cheating, and cheating is what the police register. Preserve the chat thread or SMS, the caller's number, the call timings from your phone's call log, the link you were sent, the name of any app you were asked to install, and any collect request you approved believing it was money coming in rather than going out.

Take screenshots that show the number, the date and the message in a single frame where possible, and take them before any serious step: forwarding, blocking or clearing a chat can change how it displays. Do not factory reset the phone and do not uninstall the app you were induced to install. If a bank or the police later want the device examined, an intact phone is evidence; a cleaned phone is an argument you will lose.

Identity details and the acknowledgement numbers

Every step you take produces a number, and the numbers are your leverage. Keep the bank's complaint reference, the acknowledgement SMS or email, the 1930 complaint number, the reference generated on the National Cyber Crime Reporting Portal, and the FIR or Zero FIR number once a case is registered. When you follow up, quote the number. A follow-up without a reference number is a fresh conversation every time; with one, it is a query on an existing file that somebody has to answer.

You will also be asked for identity proof - a masked Aadhaar or a PAN copy is normally enough for the bank's complaint cell, while the police station may want a photograph and an address proof for their own file. Where a masked document is accepted, prefer it. There is no reason to hand over a full unmasked identity document to a call centre operator who has asked for it over the phone.

How to file: the order that matters

Report to your bank immediately. Use the app's dispute option, the twenty-four hour helpline, or the branch. Whatever you use, ask for a complaint reference number and note the time.
Call 1930 and file on cybercrime.gov.in. The helpline routes financial fraud reports into the system that alerts banks along the transfer chain. The earlier this is done, the better the chance that funds still sitting in the first beneficiary account can be put under lien or returned.
Send the written complaint to the bank's nodal officer, marked as an unauthorised electronic transaction, with the documents listed above attached. Keep the acknowledgement.
File a police complaint. Information about a cognizable offence may be given to an officer in charge of a police station irrespective of the area where the offence was committed, so a station cannot turn you away on the ground that the fraud happened elsewhere. Ask for a Zero FIR if your station says the file belongs to another station, and for a free copy of the FIR under section 173.
Escalate under the RBI Integrated Ombudsman Scheme if the bank is silent beyond the period the scheme allows, or if its reply does not settle the claim. A complaint is maintainable where no reply is received within thirty days, or where the reply is unsatisfactory.

What decides the outcome

Three things do most of the work: speed, characterisation and traceability.

Speed. Under the RBI directions, a customer who notifies the bank within three working days of the bank's communication about an unauthorised third-party transaction is entitled to zero liability; if the notice comes between four and seven working days, liability is limited to the transaction value or the amount the directions specify for that class of account, whichever is lower; beyond seven working days it is decided by the bank's board-approved policy. The directions also require the amount to be credited by way of shadow reversal within ten working days of the notification, resolution within a period not exceeding ninety days, and - importantly - they place the burden of proving that the customer is liable on the bank.
Characterisation. If you shared an OTP or a PIN, or approved a collect request that turned out to be a debit, the bank will argue customer negligence, and the directions do say that a customer who has shared credentials bears the loss until the transaction is reported. Whether that argument succeeds depends on what the records actually show about what you were told and what you tapped.
Traceability. Money still lying in the first beneficiary account can be frozen or placed under lien. Money layered through several accounts and withdrawn in cash is usually gone, and no paperwork brings it back. This is why the transaction reference and the speed of the report matter more than the length of your complaint.

Common mistakes that weaken a complaint

Reporting by telephone and assuming the call is itself a complaint. It is not, until there is a reference number in writing.
Waiting for the bank to act before telling the police, or the reverse, so that two files are built without each other.
Sending screenshots in which no date, number or amount is visible.
Deleting the fraud chat, or resetting the phone, to clean up after the incident.
Filing a complaint that never names the transaction reference at all.
Accepting an oral refusal from a bank officer instead of insisting on a written reference and a written reason.

When to involve a lawyer

Paperwork is usually enough while the bank is cooperating. It stops being enough when the bank rejects the claim on customer-negligence grounds, when the amount is large enough that a wrong answer is expensive, when the police decline to register a case, or when a friend or family member whose account received the money is being treated as an accused rather than a witness. At that point the complaint needs to be put in a form that the bank, the Ombudsman and a court cannot skip, and there may be a parallel case to answer. A cyber crime lawyer in Kolkata can do that work, press for registration where the police sit on the complaint, and take the case to the appropriate forum; see the blog for the procedural articles that go with this checklist.

Need help with a cyber crime matter?

Tell me what happened and I will tell you what to file, where, and by when. First conversation is free.

Call +91-9007000603 WhatsApp

Frequently asked questions

Which documents do I need to file a UPI fraud complaint?

You need a signed written complaint, a bank statement covering the debit, the UPI transaction ID or UTR, screenshots or records of the call, chat or link that induced the transfer, and identity proof. Supporting documents are the bank's alert SMS or email for that transaction, the bank complaint reference number, the 1930 and portal acknowledgement references, and any collect request or app details.

Do I need an FIR to get my UPI fraud money back?

No, the bank's process does not depend on an FIR. The RBI directions on unauthorised electronic transactions require your bank to accept and act on your report, so recovery through the bank can begin on the strength of that report alone. An FIR helps because it lets the police trace the beneficiary account, seek records and place a lien, and it strengthens any later claim or escalation.

What is the UPI transaction ID and where do I find it?

It is the reference number shown against the payment in your UPI app's transaction details, and it is the number the bank uses to trace the beneficiary and the settlement leg. Open the app, select the failed or fraudulent transaction, and look for the transaction ID or reference. The same transaction also generates a bank reference and a UTR, so note every number you can see.

Can the police refuse my UPI fraud complaint because the fraud happened in another state?

No. Under section 173 of the BNSS 2023, information about a cognizable offence may be given to an officer in charge of a police station irrespective of the area where the offence was committed, which is the statutory basis for a Zero FIR. The receiving station records it and transfers it to the station with territorial jurisdiction. If a station still refuses, put the request in writing.

How long should I keep the screenshots and chats for a UPI fraud case?

Keep them until the case is finally over, which can take years. A criminal case is tried on certified electronic records supported by a certificate under section 63(4) of the Bharatiya Sakshya Adhiniyam, 2023, and the original device or the original chat data may be needed long after you think the matter is closed. Store copies on a second device or in cloud storage immediately.

Do I need a certificate for electronic evidence in a UPI fraud complaint?

Not at the stage of reporting, but yes before an electronic record is given in evidence. Section 63 of the Bharatiya Sakshya Adhiniyam, 2023 makes electronic records admissible only on the conditions it sets, and section 63(4) requires a certificate identifying the record and the device, signed by the person in charge of the device and by an expert. Your own phone's records are usually certified by you.

What if the bank says my UPI fraud complaint is rejected due to customer negligence?

Ask for the rejection in writing with reasons, because the burden of proving customer liability rests on the bank under the RBI directions. Then escalate: first to the bank's grievance officer and nodal officer, and if the reply is unsatisfactory or no reply comes within thirty days, to the RBI Integrated Ombudsman Scheme. Where the amount is substantial, the correctness of that negligence finding can also be challenged.

Can I file a UPI fraud complaint on behalf of a family member?

You can help prepare and submit the paperwork, but the complaint should be signed by the account holder, because the bank's liability rules and the criminal complaint both turn on the account holder's authorisation. If the account holder cannot sign, a written authority or a guardianship document may be needed. A complaint signed by the wrong person gives the bank an easy reason to delay.

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Cyber crime lawyer in your city · Bank account freeze help · Contact