First 24 hours after UPI fraud: what to do right now

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 3 Nov 2026 · Online fraud

The first twenty-four hours after a fraudulent UPI transfer decide how much of your money is likely to come back. The single most useful thing you can do is report immediately, because a transfer that has not yet been cleared through the settlement chain can sometimes be frozen and reversed. Call the national cyber crime helpline on 1930, file the complaint on cybercrime.gov.in, and telephone the bank that holds the account you paid from, in that order or in parallel. Speed is the whole game.

This article sets out what to do hour by hour, what the RBI's liability rules mean for how much you can recover, the documents the bank will demand, and the criminal provisions that apply to the person who took the money. It assumes the fraud was a UPI transfer, so both banks are involved: the one where your account sits, and the one where the fraudster's account sits.

Within the first hour

Do three things at once. First, call 1930 and register a complaint with the date, time, amount, the UPI ID or mobile number you paid, and the transaction reference number. Second, file the same details on cybercrime.gov.in and save the acknowledgement. Third, call your bank's customer care and the branch, tell them the transaction was unauthorised, and ask them to freeze further debits on the account.

Have the details ready before you dial, because the helpline staff work quickly. You will be asked for your name and mobile number, the bank and account involved, the exact amount, the date and time of the debit, the UPI ID or virtual payment address you paid, and the twelve-digit transaction reference. If you have taken a screenshot of the payment confirmation, keep it open. A caller who can supply these without hunting through the phone gets a complaint registered much faster.

Then notify the beneficiary bank if you can identify it. Every UPI transfer carries a UPI transaction ID and an RRN, the reference number used between banks. If the money is still sitting in the recipient's account, a prompt complaint gives the beneficiary bank a chance to place a lien on it before it is withdrawn or moved on. That window is short, often minutes to hours.

One to three hours

1. Write to your bank's nodal officer by email, not only by phone, so there is a written record with a timestamp.
2. Ask for the complaint number in writing. Without a number, it is difficult to prove when you reported, and the timing drives your liability under the RBI framework.
3. Report the UPI ID as fraudulent to the platform app if the payment went through a UPI app, using its in-app fraud reporting option.
4. Secure the account. Change the UPI PIN, change the net banking password, and check whether any device is linked to your account that you do not recognise.
5. Check for remote-access apps on your phone. Many UPI frauds begin with a screen-sharing or remote-control app installed on the victim's device.

Three to twenty-four hours

By now the immediate steps are done and the paperwork begins. Collect the bank statement showing the debit, the UPI app transaction history, the SMS and email alerts for the transaction, and any call recordings or chat messages with the person who induced the payment. If a caller impersonated a bank official or a courier company, the caller's number and call time matter enormously and should be written down before the phone's call log is cleared.

Then decide whether to file a police complaint, and where. A written complaint at the police station having jurisdiction over the place where you were defrauded, or where your bank branch is located, is the usual route. The offence is cognizable, and a written complaint under section 173 of the BNSS, 2023 sets the process in motion. If the police decline to register an FIR, an application to the magistrate under section 175(3) of the BNSS, 2023 asks the magistrate to direct an investigation.

What the RBI liability rules mean for your money

The RBI's directions on limiting the liability of customers in unauthorised electronic banking transactions are the reason the clock matters. The framework proceeds on a simple principle: a customer who reports promptly is protected, and a customer who sits on the loss is not. Where the unauthorised transaction was not caused by the customer's own negligence, the framework contemplates zero liability if the report is made within three working days. A report made after three but within seven working days attracts limited liability. Beyond seven working days, liability is decided under the bank's own policy, which usually means a much smaller chance of a full refund.

"Negligence" is where most disputes are fought. Sharing an OTP, entering a UPI PIN on a link sent by a fraudster, or installing a remote-access app at a stranger's request is generally treated as negligence, and it can shift liability to the customer even for an early report. By contrast, a SIM swap, a cloned card, or a fraudulent debit made through no act of yours favours the customer.

Documents the bank and the police will ask for

• The bank statement showing the disputed debit, ideally for the full statement period.
• The UPI transaction ID and the RRN from the payment confirmation.
• A screenshot or export of the UPI app transaction history for that day.
• The SMS and email alerts generated by the bank for the debit.
• The complaint number from the 1930 call and the acknowledgement from cybercrime.gov.in.
• A copy of your written notice to the bank, with the email or courier proof of delivery.
• The beneficiary UPI ID, account number or merchant details, if you have them.
• A copy of the FIR, if one has been registered, and any call log showing the fraudster's number.

If the bank does not act

A bank that refuses to credit the disputed amount, or that simply does not respond, is not the end of the road. The RBI Integrated Ombudsman Scheme, 2021 allows a complaint to the RBI Ombudsman against a bank for deficiency in service, and it is a free, written process. Before that, a written escalation to the bank's nodal officer and then to its principal nodal officer is expected, and the dates of those complaints become part of the ombudsman record.

A civil suit for recovery of the amount is possible in parallel, and a criminal complaint can proceed at the same time. These are not alternatives to one another; they are different tracks that serve different purposes, and a bank that faces a live police complaint often moves faster on the credit.

What the fraudster has done in law

The person who induced the transfer has generally committed cheating. Under the Bharatiya Nyaya Sanhita, 2023 the relevant provision is section 318, with the aggravated form in section 318(4) where property is dishonestly obtained. Under the Information Technology Act, 2000, section 66D covers cheating by personation using a computer resource, which fits a caller who pretends to be a bank official or a buyer. Where a phone number or an email account was taken over to run the fraud, section 66C on identity theft and section 66 on computer-related offences may also apply.

Money taken by UPI is rarely kept in one account. It is passed quickly from the beneficiary account to a second and a third, often through accounts opened in the names of people who lent their identity or documents for a small payment. Investigators call these mule accounts, and tracing through them is how a case is actually built. The UPI transaction ID, the RRN, the beneficiary account number and the merchant details recorded in your complaint are the breadcrumbs, which is why a detailed early report is worth far more to the investigation than a late, general one.

What decides the outcome

• How fast you reported: the single largest factor, because it drives both the RBI liability rule and the chance of freezing funds.
• Whether the money was still in the chain: funds already withdrawn in cash or layered through multiple accounts are far harder to recover.
• Whether negligence is alleged: a bank will look for OTP sharing or a remote-access app on your device.
• The quality of identifiers: the UPI ID, RRN, transaction ID and beneficiary account details you supply.
• How firmly you escalate: written complaints, a nodal officer letter and an ombudsman filing all move a reluctant bank.

What not to do in the first twenty-four hours

• Do not call the fraudster back or argue with them, which gives them time to move the money and warns them you have noticed.
• Do not format or reset your phone before the evidence is copied, because the chat, the app and the call log are all evidence.
• Do not accept a verbal assurance from a bank helpline. Ask for a complaint number, in writing.
• Do not delay the police complaint because you hope the bank will resolve it, since the two tracks do not conflict.
• Do not hand over your PIN, OTP or card details to anyone who calls after the fraud, claiming to help you recover the money.

When to involve a lawyer

A lawyer is rarely needed to file the first complaint, and the first twenty-four hours are better spent reporting than looking for counsel. Legal help becomes valuable when the bank refuses to credit the amount, when the police do not register an FIR, when the loss is large enough to justify a civil suit, or when you are the one being investigated for a UPI offence rather than the victim. If your bank is resisting a legitimate claim, you can contact the office to plan the escalation to the ombudsman or the court. If a case has been registered against you in a payment dispute, the discussion usually starts with criminal defence, and general information on Bengal jurisdiction sits on the cyber crime lawyer in Kolkata page.

Recovery is never guaranteed, and no competent lawyer will promise it. What an early, well-documented complaint buys you is the best position the rules allow: the strongest liability claim against the bank, and the widest window in which the money can still be stopped.

Person-to-person or merchant: the route differs

The route differs slightly depending on who received the money. In a person-to-person transfer the funds sit in an individual's account, so identifying the beneficiary bank is central, and a lien on that specific account is the goal. In a merchant payment, such as a QR code at a shop or an online checkout, the money passes through a merchant account and a payment aggregator, and a complaint to the platform can sometimes stop settlement before it reaches the merchant. Either way, the identifiers you already saved are exactly what the bank or platform will ask for, and the earlier they are supplied the better the chance of holding the money still.

Frequently asked questions

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Related articles

• What to do in the first 24 hours after credit card fraud
• UPI Fraud Evidence: What to Preserve in 48 Hours
• Online gaming fraud evidence to preserve in first 48 hours
• Instant loan app fraud: evidence to preserve in 48 hours
• Which police station handles UPI fraud in Kolkata
• UPI fraud and company liability under the IT Act

Cyber crime lawyer in your city · Bank account freeze help · Contact