Time limit to file a UPI fraud complaint in India
By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 5 Nov 2026 · Cyber law
There is no last date for reporting a crime, but a UPI fraud runs on three clocks at once. Your bank's liability rules count working days from the bank's own communication, the chance of recovering the money counts hours, and a court's power to take cognizance counts the limitation period for the offence charged. Missing the wrong clock is what costs money.
A UPI fraud complaint has no filing deadline. You can report the fraud to the police today, next week or three years later, and if the facts disclose a cognizable offence the information has to be recorded. Nothing in the Bharatiya Nagarik Suraksha Sanhita, 2023 fixes a last date for reporting a crime. What delay changes is not whether you can complain, but what you can recover, and how much of the case is still capable of being proved by the time a court looks at it.
Three separate clocks start running after a UPI fraud, and they measure different things. Your bank's liability rules count working days from the moment the bank communicates the transaction to you. The chance of getting the money back counts hours, because it depends on the funds still sitting somewhere that can be traced and frozen. A court's power to take cognizance counts the limitation period that attaches to the offence charged. Losing the first clock costs you the bank's money. Losing the second costs you the fraudster's money, which is usually gone for good. Losing the third can end the prosecution for some of the offences altogether.
There is no deadline to lodge a complaint
Begin with what is settled. Information about a cognizable offence may be given to an officer in charge of a police station, orally or by electronic communication, irrespective of the area where the offence was committed, and it must be reduced to writing, read over to the informant, and a free copy given to the informant. Where the information is given electronically, it is taken on record once the informant signs it within three days. Registration is not a matter of police discretion where the information discloses a cognizable offence, and a refusal is answered by a written complaint to the Superintendent of Police, and then by an application to the Magistrate under section 175(3) of the BNSS 2023 to direct an investigation.
So a delayed complaint is still a complaint. Courts do weigh delay in appreciating evidence, and a complainant who explains the delay honestly - illness, fear of exposure, waiting for the bank's response, a first attempt at recovery through the bank - is in a very different position from one who cannot explain it at all. Delay is a problem of proof. It is not a bar.
The bank's clock: three working days, then seven
These timelines come from the Reserve Bank of India's directions on limiting customer liability in unauthorised electronic banking transactions, and they begin from the date you receive the bank's communication about the unauthorised transaction, which is ordinarily the alert SMS or email. The entitlement is stated in the directions in these words:
A customer's entitlement to zero liability shall arise where the unauthorised transaction occurs in the following events: contributory fraud, negligence or deficiency on the part of the bank, irrespective of whether or not the transaction is reported by the customer; and third party breach where the deficiency lies neither with the bank nor with the customer but lies elsewhere in the system, and the customer notifies the bank within three working days of receiving the communication from the bank regarding the unauthorised transaction.
Where the notification is later, the directions scale the customer's liability. Working days are counted according to the working schedule of the customer's home branch, and the year of the transaction is excluded.
| Time taken to report, from the date you receive the bank's communication | Your liability under the RBI directions |
|---|---|
| Within three working days | Zero liability, where the deficiency lies in the system and not with you |
| Within four to seven working days | The transaction value, or the amount specified in the directions for that class of account, whichever is lower |
| Beyond seven working days | As determined by the bank's board-approved policy |
Two more deadlines sit behind that table. On being notified, the bank is required to credit the amount to your account by way of shadow reversal within ten working days, without waiting for any insurance settlement, and to resolve the complaint and establish the customer's liability within a period that cannot exceed ninety days from the date of the complaint. Where the bank cannot resolve it within that period, the payable amount has to be paid anyway. And on the question that decides most disputed claims, the burden of proving that the customer is liable lies on the bank, not on you.
The recovery clock: hours, not days
No statute sets an hour for reporting a cyber fraud, and that is the honest answer. What exists is a practical window that closes very fast. Money remains recoverable only while it is still identifiable in a bank account. Once it has been layered through two or three accounts and withdrawn, the trail is a matter of investigation rather than instant recovery, and investigation takes months, not minutes.
That is why the first calls matter more than the first letter. Reporting on the 1930 helpline or on the National Cyber Crime Reporting Portal enters the complaint into the system that alerts banks along the transfer chain, so that a beneficiary bank can place a lien on the funds while they are still there. Where the transaction has been reported on the portal, the complaint is routed onward to the police unit that deals with cyber fraud in the relevant district. In a number of states, complaints above a threshold are converted automatically into an e-Zero FIR, which gives the police a registered case and the authority to seek a lien without the victim first travelling to a police station. The scheme is not available everywhere, the threshold differs from state to state, and it changes; ask rather than assume.
The court's clock: limitation on taking cognizance
This is the clock most people have never heard of, and it is the one that can quietly end a case. The BNSS 2023 carries forward the bar on a court taking cognizance of offences of the lighter kind after a prescribed period has run from the date of the offence. For an offence punishable with imprisonment of more than one year but not more than three years, that period is three years, subject to the statute's exceptions: continuing offences are treated differently, and the court can condone a delay where the complaint explains it.
The practical effect in a UPI fraud is this. Sections 66C and 66D of the Information Technology Act, 2000, which punish identity theft and cheating by personation using a computer resource, carry a maximum of three years, so a prosecution resting on them alone is exposed to the limitation bar once three years have passed. Cheating under section 318(4) of the Bharatiya Nyaya Sanhita, 2023 - cheating and dishonestly inducing delivery of property, punishable with imprisonment up to seven years - is not a light offence and is not caught by that bar. A case can be registered long after the event on that charge. Whether it should be is a different question, and one that a first information report filed within days of the fraud never has to answer.
What delay actually costs you
- Call records. Call detail records are retained by operators for a fixed period and then discarded. If the fraud began with a phone call, the record of that call may exist only because the police asked for it early.
- Chat and app data. Threads get cleared, phones get replaced, and apps auto-delete old media. Screenshots taken late often show a chat that has already been trimmed.
- The beneficiary accounts. Mule accounts are used briefly and abandoned. By the time an investigation reaches them, they are frequently dormant, closed or emptied, and the lien that could have preserved the money is no longer possible.
- Your own account of events. A complaint written within days is usually accurate on dates, numbers and the words used. A complaint written months later reconstructs them, and reconstruction is where inconsistencies appear.
- Characterisation. A late complaint invites the argument that you were content with the transaction until some other dispute arose. In a fraud allegation, the promptness of the victim's reaction is part of the proof that there was deception at all.
Day one, week one, month one
| Stage | What you do | What is running against you |
|---|---|---|
| Day one | Call the bank, call 1930, lodge the complaint on the portal, note every reference number | The recovery window, measured in hours |
| Days two to seven | Written complaint to the bank's nodal officer with the statement and screenshots; copy to the branch | The three working days for zero liability, then the capped-liability band to seven |
| Week one to week four | Police complaint and FIR, or a Zero FIR at the nearest station; written request if registration is refused | The duty to register, which is not discretionary, and the practical quality of the investigation |
| Month one to month three | Escalate to the RBI Integrated Ombudsman Scheme if there is no reply within thirty days or the reply is unsatisfactory | The bank's ninety-day outer limit for resolving the complaint |
| Beyond | Follow the investigation; consider the remedies available if the police close the case without a charge sheet | The limitation period for the lighter offences, and the fading of the trail |
Common mistakes that reset your clock
- Waiting to file until all the proof is collected. The bank's clock runs from its communication to you, not from your readiness.
- Treating a helpline call as a lodged complaint. Without a reference number in writing, the call proves nothing.
- Complaining to the police and neglecting the bank, or the reverse. The two remedies are separate and neither substitutes for the other.
- Letting the ninety-day resolution period pass without escalating, and then discovering there is no written record of the complaint at all.
- Withdrawing the complaint after a partial or informal refund, which can leave the balance unrecoverable and the fraudster unpunished.
- Naming the wrong transaction reference, or a number copied incorrectly from a screenshot, so that the bank traces a payment that never happened.
When to involve a lawyer
The timelines above are manageable for most victims, and the early steps need no lawyer: a phone call, a written complaint, a portal report. A lawyer becomes useful when time has already passed and the case needs to be built backwards - when the bank has rejected the claim on customer-negligence grounds, when the police will not register a first information report, when a limitation objection is being raised, or when the beneficiary of the funds is a relative or an acquaintance and the file has started to point at the wrong person. At that stage the work is to put the sequence in order, explain the delay on affidavit if it needs explaining, and press the case in the forum where it will actually move. A cyber crime lawyer in Kolkata handles that stage; the contact page sets out how to bring the papers in.
Need help with a cyber crime matter?
Tell me what happened and I will tell you what to file, where, and by when. First conversation is free.
Call +91-9007000603 WhatsAppFrequently asked questions
Is there a time limit to file a UPI fraud complaint in India?
There is no deadline to report a crime to the police. Information about a cognizable offence can be given at any time, orally or electronically, and it has to be recorded if it discloses such an offence. The effective deadlines are practical ones: three working days from the bank's communication for zero liability, and the first hours for freezing the money.
What happens if I report a UPI fraud after three working days?
You lose the automatic right to zero liability and move into the capped-liability band. Under the RBI directions, notification within four to seven working days limits your liability to the transaction value or the amount specified for that class of account, whichever is lower. Beyond seven working days, liability is decided by the bank's board-approved policy, though the bank still has to prove that you are liable.
Can I file a UPI fraud FIR months after the fraud?
Yes, an FIR can be registered months later. Cheating under section 318(4) of the BNS 2023 is punishable with up to seven years and is not caught by the limitation bar on taking cognizance after a fixed period. Delay is not a bar; it is a fact the court will weigh, so an FIR that explains the delay in writing is stronger than one that ignores it.
How long does the bank have to reverse a UPI fraud transaction?
The RBI directions require the bank, on being notified of an unauthorised electronic transaction, to credit the amount by way of shadow reversal to your account within ten working days, without waiting for any insurance settlement. The complaint must be resolved and your liability, if any, established within a period that cannot exceed ninety days from the date the complaint is received.
How long do I have before the money becomes untraceable?
There is no fixed statutory period, and the honest answer is that the window is measured in hours rather than days. Funds can be frozen while they are still sitting in a traced account. Once they are layered through several accounts and withdrawn, recovery usually becomes a matter of investigation, and the prospects fall sharply after the first twenty-four to forty-eight hours.
Does delay affect the bank's liability in a UPI fraud case?
Yes, beyond the three-working-day and seven-working-day bands. Delay weakens the claim in two ways: the bank may rely on its board-approved policy in place of the capped amounts, and a long silence before reporting is treated as evidence of negligence. Where you reported the transaction to your bank at once, the proof of promptness is the acknowledgement you asked for and kept.
What is the limitation period for the offences in a UPI fraud case?
For offences punishable with imprisonment of more than one year but not more than three years, the BNSS 2023 bars a court from taking cognizance after three years from the date of the offence, subject to the statute's exceptions. IT Act sections 66C and 66D fall in that band. Cheating under BNS section 318(4), punishable with up to seven years, does not.
Should I complain to the bank and the police at the same time?
Yes, and as early as possible, because they serve different purposes. The bank complaint is what puts the liability rules and the reversal timelines in motion. The police complaint is what allows the beneficiary account to be traced, records to be sought and a lien to be placed. Filing only one of them leaves half the remedy unused.
Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.
Related articles
Cyber crime lawyer in your city · Bank account freeze help · Contact