UPI Fraud in India: What to Do, Who Pays, and How to Recover
By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 3 Nov 2026 · Cyber crime
UPI fraud is an unauthorised or induced transfer through the Unified Payments Interface — a fake collect request, a "scan this QR to receive money" trick, an OTP read out to a caller, or a compromised device. Report it on 1930 and to your bank in writing immediately: under the RBI framework a customer who notifies a third-party breach within three working days has zero liability, and that clock starts at the transaction, not at the police complaint.
UPI moves money instantly and irreversibly at the customer level, which is exactly why fraudsters prefer it. The transaction cannot be "cancelled" from your app. What can happen is a freeze on the destination account, a chargeback through the bank, or a recovery suit — in that order of speed, and each depends on how quickly you act and what you can prove.
The four frauds that account for most UPI losses
- Collect request fraud. The fraudster sends a "payment request" that looks like an incoming payment. Approving it with your PIN sends money out. Nobody ever needs your PIN to pay you.
- QR-code swap. You are told to scan a QR code to receive a refund or a payment; scanning it debits you instead.
- OTP and screen-share fraud. A caller posing as bank staff or customer care asks you to install a screen-sharing app, then reads the OTP from your screen.
- Compromised account or SIM swap. Your credentials are stolen through a phishing page, or your SIM is reissued, and transactions are made without your involvement at all.
The legal difference matters: in the first three you authorised the transaction but were induced by fraud, and in the last you did not authorise it. Banks and courts treat the two categories differently.
Who bears the loss — the RBI liability rules
The Reserve Bank's customer protection framework for unauthorised electronic banking transactions sets out a three-tier rule:
| When you report | Your liability (third-party breach) |
|---|---|
| Within 3 working days | Zero |
| Within 4 to 7 working days | Limited, capped between ₹5,000 and ₹25,000 depending on the account type |
| Beyond 7 working days | As per the bank's policy, subject to the bank proving contributory negligence |
Two things follow. First, report in writing — a phone call is not evidence; an email to the bank's nodal officer with the transaction reference is. Second, the bank cannot simply say "you shared the OTP" and close the file; it has to show negligence, and the burden of proof sits with the bank once you have reported within the window.
Step by step: the first 48 hours
- Freeze the channel. Block the UPI handle, card and net banking from the app or by calling the bank's hotline. Change passwords from a clean device.
- Call 1930. The national helpline raises a freeze request on the beneficiary account through the payment network. Give the UTR, amount, time and beneficiary UPI ID or account number.
- File on cybercrime.gov.in. Keep the acknowledgement number. This is the document the bank and the police will ask for.
- Write to the bank. Email the branch and the nodal officer, mark it "unauthorised electronic transaction — liability under RBI customer protection circular", attach the portal acknowledgement, and demand a transaction log and the beneficiary account details.
- Ask for a chargeback. The bank raises a chargeback with the beneficiary bank through NPCI. This is a documentary process with deadlines, and it is where most self-filed complaints die for want of a proper covering letter.
When the bank refuses to pay
If the bank does not resolve the complaint within 30 days you can approach the RBI Integrated Ombudsman Scheme, 2021 at cms.rbi.org.in — free, online, and binding on the bank up to the scheme's limit. Alongside that, a consumer complaint before the district consumer commission is available for deficiency in service, and a civil suit for recovery lies against the beneficiary where the money landed. For larger amounts, a criminal complaint under section 318 BNS and sections 66C and 66D of the IT Act runs in parallel.
Where the money has moved into a mule account held by a real person, a "beneami" or freeze-and-recover strategy works better than a pure police complaint: an application to the investigating officer for lien on the beneficiary account, followed by a restitution request before the court under the BNSS provisions on disposal of property, often recovers a substantial part of the amount even before trial.
What to preserve
Export the statement covering the fraud date as a PDF from net banking, not a screenshot. Note the UTR of every transfer. Save the chat or call log showing the inducement, the caller's number, the UPI ID and the QR code image. Keep the bank's acknowledgement and the cybercrime portal reference. If a screen-sharing app was used, do not uninstall it before taking screenshots of the app list and the session history.
Prevention that actually works
Set a daily UPI limit well below your balance. Never approve a collect request you did not initiate. Remember that receiving money never requires a PIN. Decline all requests to install remote-access apps. Enable transaction alerts by email as well as SMS. And treat any call that begins with "your account will be blocked" as fraud by default — no bank, police unit or RBI officer conducts business over UPI transfers.
Making the Bank's Liability Rules Work for You
The RBI framework for unauthorised electronic transactions only helps a customer who follows a specific procedure. The three-day window is the single most important fact in a UPI fraud case, and it runs from the transaction, not from the police complaint.
What a written complaint to the bank must contain
- Account holder name, account number and registered mobile number.
- The UPI transaction reference number and the exact amount and time of the debit.
- A clear statement of whether the transaction was authorised by you or not, and, if it was, that the authorisation was obtained by fraud.
- The manner of the fraud: a collect request approved by mistake, a QR code scanned to receive money, or an OTP read out to a caller.
- A demand that the transaction be treated as an unauthorised electronic transaction under the RBI customer protection framework and that liability be determined accordingly.
- A request that the beneficiary bank details and the destination account be reported to the cyber cell.
What happens if the bank refuses
| Stage | Action | Timeline |
|---|---|---|
| Bank complaint | Written complaint to the branch and the nodal officer | Acknowledgement immediately; decision usually within a month |
| Internal escalation | Reminder to the grievance redressal officer | A fortnight |
| RBI Integrated Ombudsman | Complaint after the bank's reply or the expiry of the stipulated period | Free, online, weeks |
| Consumer or civil remedy | Consumer complaint for deficiency in service or a civil suit | Months to years |
| Criminal complaint | Information on the cybercrime portal and a police complaint | Same day for registration |
Points that decide the outcome
The burden of proving contributory negligence sits with the bank once the customer has reported within the prescribed period. A bank cannot close the file merely by saying the OTP was shared. Equally, the customer should not admit negligence; describe the facts and leave the legal characterisation to the claim. Where the loss arose from a failure of the bank's own systems, the customer's position is stronger.
Preserve this evidence
- The SMS and email alerts for the debit, with the timestamp.
- Screenshots of the collect request or QR code, and the caller's number if it is known.
- The full chat or call log in which the fraud was induced.
- Any screen-share app installed at the caller's insistence, since the installation record is itself evidence.
For a UPI or banking fraud matter see cyber and financial fraud services and the contact page.
If a UPI debit was induced by a collect request, a QR code or OTP fraud, the first conversation is free. Call +91-9007000603 with the transaction reference before the three-day clock runs out.
Need help with a cyber crime matter?
Tell me what happened and I will tell you what to file, where, and by when. First conversation is free.
Call +91-9007000603 WhatsAppFrequently asked questions
Can I get my UPI money back?
Sometimes. If you report on 1930 quickly enough and the money is still in the beneficiary account, it can be frozen and returned. If it has been withdrawn, recovery depends on a chargeback through the bank, a lien on the beneficiary account, or a restitution order in the criminal case.
Is UPI fraud bailable?
Offences under sections 66C and 66D of the IT Act are generally bailable. Cheating under section 318 BNS is often non-bailable. The sections named in the FIR decide whether bail is needed.
Does the bank have to refund unauthorised transactions?
Under the RBI customer protection framework, yes, if the unauthorised transaction arose from a third-party breach and you notified the bank within three working days. Liability beyond that is limited and depends on the bank proving negligence.
What if the fraudster used my own PIN?
Sharing a PIN weakens the zero-liability claim but does not end it. If you were induced by impersonation or a screen-sharing app, the transaction is still the product of fraud, and the bank must show contributory negligence rather than assume it.
How long does a UPI chargeback take?
Typically four to eight weeks, depending on the beneficiary bank response and the payment network cycle. A written escalation to the nodal officer and, if needed, the RBI Ombudsman keeps it moving.
Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.
Related articles
Cyber crime lawyer in your city · Bank account freeze help · Contact