UPI Fraud Legal Remedies: Criminal and Civil Options

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 2 Nov 2026 · Cyber law

UPI fraud offers three separate remedies: a criminal complaint for punishment, a civil suit for the money, and a banking claim for a reversal. Each has a different standard of proof and timeline, and the right order is banking first, criminal case second, civil suit last.

UPI fraud gives a victim two separate legal remedies that run on different tracks: a criminal complaint that seeks punishment of the person who took the money, and a civil claim that seeks the return of the money itself. A third remedy sits with the bank and the RBI, which can reverse or compensate the loss without any court case at all. Choosing between them is not a matter of preference; each one has a different standard of proof, a different timeline and a different chance of actually putting money back in your account.

The criminal track begins with an FIR under section 173 of the Bharatiya Nagarik Suraksha Sanhita, 2023 and can end in conviction under section 66D of the Information Technology Act, 2000 read with section 318(4) of the Bharatiya Nyaya Sanhita, 2023. The civil track is a suit for recovery of money or damages. The banking track is a complaint under the RBI's 2017 direction on limited liability and, if needed, the Integrated Ombudsman Scheme, 2021. A well-advised victim usually starts all three in the right order rather than picking one.

The remedies side by side

Remedy	Legal basis	Standard of proof	What it can deliver
Criminal complaint	IT Act s 66D; BNS ss 318(4), 336, 61; BNSS s 173	Beyond reasonable doubt	Punishment, and a compensation order in appropriate cases
Banking claim	RBI direction on limited liability, July 2017; Integrated Ombudsman Scheme, 2021	Preponderance of probability on the customer's conduct	Reversal, provisional credit, compensation
Civil suit	Suit for recovery of money or damages; Limitation Act, 1963	Preponderance of probability	A money decree, interest, costs, execution against assets
Data compensation	IT Act s 43A; DPDP Act, 2023	Negligence and failure of security safeguards	Compensation from the entity that lost the data

Reading the table across, the criminal case has the highest standard and the slowest pace but the strongest coercive powers: the police can demand KYC, transaction logs and device data, and the court can order attachment. The banking claim is quick, free and does not need a lawyer in most cases, but it is decided on your conduct as much as on the fraudster's. The civil suit is the only route that produces an enforceable money decree against a named defendant, and it is also the route most victims skip.

The criminal complaint: what it can and cannot do

Section 66D of the IT Act punishes cheating by personation using a computer resource with imprisonment up to three years and a fine up to one lakh rupees. Section 318(4) of the BNS punishes cheating and dishonestly inducing the delivery of property with imprisonment up to seven years and a fine. Section 336 covers forgery and section 340 covers a forged electronic record, which is relevant where the fraudster produced a fake payment screenshot or a fake merchant page. Section 61 covers criminal conspiracy, which is how a call centre, a mule account holder and a cash-out operator are tied together in one case.

The procedural route matters as much as the section. Under section 173 of the BNSS the police must register the information, and the proviso allows it to be given electronically. If the station refuses, section 175(3) allows an application to the Magistrate for a direction to investigate. Section 35 restricts arrest without notice for offences punishable with less than seven years, and sections 480 and 482 deal with regular and anticipatory bail. For a victim, the practical value of the FIR is not the trial date; it is the legal authority it gives the investigating officer to seek account and device records from banks and platforms.

What the criminal case cannot do is guarantee the return of the money. A conviction may bring a fine or a compensation order, but the court cannot create assets the accused does not have. This is why the FIR should be filed for its investigative power, not as a substitute for the banking claim or the civil suit.

The civil suit: recovering the money as money

A civil suit for recovery of money is founded on the same facts but asks a different question: who is holding money that belongs to the plaintiff. The defendants are usually the beneficiary account holder, and where the account was opened with false KYC, the bank may be added for negligence in onboarding. The suit can ask for the amount, interest, and costs. Where the fraud is established, a claim in damages for deceit and for negligence can be pleaded in the alternative.

Two procedural points decide whether the suit is worth filing. The first is limitation. A suit for recovery of money arising from a fraud is generally governed by the three-year period in the Limitation Act, 1963, counted from the date the fraud was discovered or could with reasonable diligence have been discovered. Filing after that invites a limitation defence that can end the case before trial. The second is recoverability. A decree against a person with no bank balance and no property is a piece of paper until execution proceedings find assets, so the financial position of the defendant should be assessed before the suit is filed.

Interim protection is available in the right case. An application for attachment before judgment can be made where there is evidence that the defendant is disposing of assets to defeat a decree. Freezing orders are more commonly obtained through the criminal investigation, because the police can act on the account faster than a civil court can. In practice, the civil suit and the criminal freeze are used together: the freeze preserves the money, and the suit gives the victim a decree to execute against it.

The banking remedy: the fastest route and the easiest to lose

The RBI's July 2017 direction on limited liability for unauthorised electronic banking transactions is the most useful document a UPI fraud victim has. It requires the bank to register a complaint, provide a provisional credit within ten working days, resolve the complaint within ninety days, and refrain from charging the customer for reporting the fraud. Liability is zero where the breach is on the bank's or the system's side and the customer reports within three working days. It is capped at five thousand rupees for basic accounts and ten thousand rupees for other accounts where the report is made within seven working days. Beyond seven days, the bank's policy governs.

Where the bank rejects the claim or fails to decide within ninety days, the RBI's Integrated Ombudsman Scheme, 2021 provides a free escalation. The Ombudsman can direct the bank to pay compensation, and the complaint can be filed online. The limit on what the Ombudsman can award is set by the Scheme, and for larger losses the civil suit remains the route to the full amount.

Section 43A of the IT Act adds a separate claim where a body corporate was negligent in protecting sensitive personal data and that negligence caused the loss. This is useful where the fraud followed a data breach at a merchant or platform rather than a mistake by the customer. The DPDP Act, 2023 creates additional obligations and a separate complaint mechanism, but the compensation route under section 43A remains the clearer path for an individual loss.

Choosing the order of remedies

The sensible order is dictated by speed. Report to 1930 and the bank first, because that is the only step that can freeze money. File the portal complaint and the FIR next, because they give the investigation its authority and produce the record the bank will ask for. Claim the provisional credit within the RBI timeline. Escalate to the Ombudsman when the ninety days run out or the claim is rejected. File the civil suit only when the amount justifies the cost and there is a defendant worth suing, or when limitation is running and the claim needs to be preserved.

Running the tracks in this order avoids two common mistakes. It avoids filing a civil suit while the money is still recoverable through a freeze, and it avoids waiting for a criminal trial that may take years before asking the bank to pay under a scheme designed to resolve claims in ninety days.

Where the tracks meet

The three remedies are not sealed off from each other. What you say in one is read in the others. A statement to the police that you "authorised the payment but was cheated afterwards" is a different case from a statement that you never authorised the debit, and the bank will rely on the first version if it appears anywhere in the record. This is why the wording of the first complaint matters more than its length, and why it should be written once, carefully, and then repeated consistently.

The criminal case can also help the civil one. Once the investigating officer obtains the beneficiary's KYC and bank statement, the victim has the identity and the account details needed to sue the right person, which is often impossible to establish from the payment app alone. Conversely, the civil suit can help the criminal case by producing documents, such as the merchant's invoices or the platform's correspondence, that the police may not have the time to collect. Where an accused offers to return the money during the investigation, the settlement should be recorded in writing and placed before the court rather than accepted privately, because a private repayment that is not documented can later be portrayed as an admission that no fraud occurred.

Mistakes that cost victims their remedy

Filing only a police complaint and never a written claim with the bank, which forfeits the RBI liability route.
Accepting a settlement that records the transaction as authorised, which undermines both the criminal case and the Ombudsman complaint.
Missing the three-working-day and seven-working-day windows, then arguing about them after the bank has closed the file.
Deleting the device data before a section 63 Bharatiya Sakshya Adhiniyam certificate can be prepared.
Suing the wrong defendant, such as a bank that merely processed the payment, without pleading its specific negligence.
Letting the three-year limitation period run while waiting for the police investigation to conclude.

When to involve a lawyer

A claim of a few thousand rupees against a cooperative bank rarely needs a lawyer. The calculation changes when the bank alleges negligence, when the amount is large, when the beneficiary is identified and has assets, when a civil suit and a criminal freeze have to be coordinated, or when you have been named as an accused because money passed through your account. In Kolkata, financial offence cases are commonly listed before the Bankshall Court, bail matters before the City Sessions Court, and quashing or transfer petitions before the Calcutta High Court.

Before you choose a track, it helps to map the facts once with someone who works on both sides. A cyber crime lawyer in Kolkata can tell you whether the bank's liability is arguable, whether the civil suit is worth its cost, and what the criminal complaint needs to contain. If your matter is in another district, the West Bengal cyber law page sets out the court structure, and civil litigation covers the suit and execution stages.

Need help with a cyber crime matter?

Tell me what happened and I will tell you what to file, where, and by when. First conversation is free.

Call +91-9007000603 WhatsApp

Frequently asked questions

What legal remedies exist for UPI fraud in India?

There are three: a criminal complaint under section 66D of the IT Act, 2000 and section 318(4) of the BNS, 2023; a civil suit for recovery of money or damages; and a banking claim under the RBI's 2017 limited liability direction, escalated if needed to the RBI Ombudsman.

Which remedy returns money fastest in UPI fraud?

The banking route. A freeze request made through 1930 or cybercrime.gov.in can hold the beneficiary account within hours, and the RBI direction requires a provisional credit within ten working days. A criminal trial and a civil suit both take far longer and do not by themselves return the money.

Can I file both a criminal case and a civil suit for UPI fraud?

Yes. The two run in parallel and address different questions: punishment of the offender and return of the money. The criminal case can produce bank and KYC records that help the civil suit, while the civil suit can produce documents the police may not collect.

What is the limitation period for a UPI fraud civil suit?

A suit for recovery of money arising from fraud is generally governed by the three-year period in the Limitation Act, 1963, counted from the date the fraud was discovered or could reasonably have been discovered. Filing after that allows a limitation defence that can end the case early.

Is a UPI fraud offence bailable?

Cheating under section 318(4) of the BNS is punishable with up to seven years and is generally non-bailable, while section 66D of the IT Act carries up to three years. Bail is decided on the facts, the amount and the accused's record, under sections 480 and 482 of the BNSS, 2023.

Can the bank be made a party to a UPI fraud suit?

Yes, where the bank's own negligence contributed, for example by opening the beneficiary account on false KYC or by failing to act on a freeze request. A bank that merely processed a valid payment is harder to hold liable without pleading a specific breach of duty.

What compensation can a UPI fraud victim claim?

The amount transferred, interest, and costs in a civil suit. The bank route can deliver the full amount where liability is zero, or a capped amount where the report was late. A criminal court may also order compensation to the victim as part of sentencing.

Does section 43A of the IT Act apply to UPI fraud?

It applies where a body corporate was negligent in protecting sensitive personal data and that negligence caused the loss, such as a merchant or platform breach. It gives a compensation claim against that entity, separate from the claim against the bank or the fraudster.

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Cyber crime lawyer in your city · Bank account freeze help · Contact