UPI Fraud: What to Do in the First Hour

Lost Money in a UPI Fraud? What to Do in the First Hour — 1930, Your Bank and the RBI’s Liability Rules

If money has disappeared from your bank account after a UPI scam, the first hour matters. You may be able to help authorities and your bank act quickly by reporting the fraud, preserving transaction details and asking the bank to take immediate steps to prevent further unauthorised transactions.

Remember three actions: call 1930, report the transaction to your bank, and submit a complaint on the National Cyber Crime Reporting Portal. Do not wait to collect every document before reporting the incident.

India’s national cybercrime helpline, 1930, accepts reports of financial cyber fraud around the clock. After calling, follow the instructions to complete the online complaint and preserve the acknowledgement number.

Cyber financial fraud helpline: 1930
Online reporting: cybercrime.gov.in
Your bank: Use its official app, website, 24-hour fraud helpline or branch
UPI app: Raise a complaint against the transaction, but do not rely on the app alone

The steps below explain what to do, what evidence to keep and how the Reserve Bank of India’s customer-liability rules may apply.

1 The first hour: A step-by-step action plan

<text color="secondary" size="sm">Act immediately. Do not delay a report while trying to contact the scammer or recover the money yourself.</text>

First 10 minutes: Call 1930

Call 1930, the national helpline for financial cyber fraud.

Be ready to provide the information requested, which may include:

Your name and mobile number
The bank or payment app involved
Transaction date and amount
Transaction ID or UPI reference number
The account, wallet or UPI details involved
Screenshots or other available evidence

Write down the complaint acknowledgement or reference number. Follow the instructions given by the helpline operator.

The aim is to get the incident reported quickly so the relevant authorities and financial institutions can take appropriate action. Reporting does not guarantee that the money will be recovered, but delay can reduce the opportunity to intervene.

Official source: National Cyber Crime Reporting Portal

Within the first 15 minutes: Contact your bank

Use the bank’s official fraud-reporting channel. Do not rely solely on a message sent through social media or a phone number provided by a stranger.

Tell the bank that you suspect UPI fraud and ask it to:

Register an unauthorised-transaction or fraud complaint, as applicable
Take immediate steps to prevent further unauthorised transactions
Check whether the transaction can be flagged or whether any funds can still be held or traced
Secure your account and UPI access if your credentials may be compromised
Provide a complaint or service-request number

If your mobile banking, UPI PIN or account credentials may be compromised, ask the bank how to block or reset the affected access securely.

Get written acknowledgement of your bank complaint. Record the time of reporting, the complaint number and the channel used.

RBI directions require banks to provide round-the-clock channels for reporting unauthorised electronic transactions and to take immediate steps after receiving a report. See the RBI customer-liability notification.

Within 30 minutes: Submit the online cybercrime complaint

Visit cybercrime.gov.in and follow the available reporting instructions.

Complete the online complaint as directed after your call to 1930. Keep the details consistent with what you reported to the helpline and your bank.

Include the transaction information, the sequence of events, relevant phone numbers or UPI IDs, and supporting screenshots where requested.

Save the complaint acknowledgement and any reference number. If the portal or helpline instructs you to complete a step within a specified time, follow that instruction promptly.

Within the first hour: Preserve evidence and secure your accounts

Take screenshots or download records showing:

The UPI transaction and its reference number
The amount, date and time
The recipient’s UPI ID or displayed details
SMS and bank alerts
Messages, calls, links or QR codes involved in the incident
The complaint numbers from the bank and cybercrime reporting process

Do not delete chats, uninstall the app or reset the phone before preserving relevant evidence, unless your bank or the authorities advise you to take a security step that requires it.

If you shared a UPI PIN, OTP, password or remote-access permission, tell your bank. Change compromised credentials using official channels, and revoke suspicious app permissions or remote-access tools when safe to do so.

2 What if you sent the money yourself after being tricked?

This distinction matters.

A scammer may persuade a victim to scan a QR code, approve a collect request, enter a UPI PIN or make a payment under false pretences. In another case, someone may access the victim’s account and make a transaction without permission.

Both situations can involve fraud, but the RBI’s unauthorised electronic-transaction liability rules do not automatically make every scam payment refundable.

If you authorised the payment because a scammer deceived you, report it as cyber fraud immediately and ask your bank to investigate. The bank and authorities will need to examine how the transaction was initiated and whether it was authorised, unauthorised or involved a failure by a regulated entity.

If you did not initiate or approve the transaction, state clearly that it was unauthorised and report it to your bank without delay.

Do not describe a payment as unauthorised if you knowingly approved it, even if you were tricked about the purpose. Explain exactly what happened. Accurate reporting helps the bank assess the complaint under the appropriate rules.

3 RBI rules: When can a customer have zero or limited liability?

RBI’s customer-protection framework for unauthorised electronic banking transactions sets out circumstances in which a customer may have zero or limited liability. The outcome depends on the facts, including whether the bank was at fault, whether a third-party breach occurred and whether the customer was negligent.

Zero liability in specified circumstances

Under the RBI framework, zero liability can apply where:

The unauthorised transaction resulted from contributory fraud, negligence or deficiency on the bank’s part, regardless of when the customer reported it; or
The breach was a third-party breach, with neither the bank nor the customer at fault, and the customer notified the bank within three working days of receiving communication about the transaction.

These provisions concern unauthorised electronic banking transactions. They should not be interpreted as a promise that every UPI scam victim will receive a refund.

Limited liability when reporting is delayed

For a qualifying third-party breach where neither the bank nor the customer is at fault, RBI’s framework provides for limited liability when the customer reports the transaction within four to seven working days of receiving communication about it.

The customer’s liability is capped at the transaction value or the applicable amount in RBI’s table, whichever is lower. Beyond seven working days, liability is determined under the bank’s board-approved policy for the relevant circumstances.

The working-day count follows the RBI rules and the home branch’s working schedule, excluding the date on which the transaction communication was received.

What if the customer shared a PIN or OTP?

RBI’s framework says that where the loss is due to customer negligence, such as sharing payment credentials, the customer bears the loss until the unauthorised transaction is reported to the bank. Losses occurring after the report are to be borne by the bank under the specified rule.

That does not mean you should avoid reporting a transaction because you made a mistake. Report it immediately, explain what happened and ask the bank to assess liability under the applicable rules.

Official reference: RBI — Customer Protection and Limiting Liability in Unauthorised Electronic Banking Transactions

4 Does the bank have to reverse the money within 10 working days?

RBI’s customer-liability directions provide for a shadow reversal within 10 working days after the bank is notified in cases eligible for zero or limited liability under the framework. The amount is value-dated as of the unauthorised transaction date.

This is not a universal 10-day refund promise for every UPI scam. The bank must assess the facts and applicable rules, and a transaction in which the customer authorised a payment after being deceived may require a different assessment.

The framework also requires banks to resolve the complaint and establish customer liability within the prescribed period, which cannot exceed 90 days under the relevant directions.

When you report the fraud, ask the bank to confirm in writing:

Whether it has classified the transaction as unauthorised or as a disputed authorised payment.
Which customer-liability framework and bank policy it is applying.
Whether any provisional or shadow reversal is applicable.
What evidence or additional documents it requires.
The complaint’s current status and expected next steps.

5 How to complain through your UPI app

Most participating UPI apps provide a transaction-history or help section for raising complaints.

Open the UPI app you used.
Select the disputed transaction from your transaction history.
Choose the available help, support or report-issue option.
Select the reason that most accurately describes what happened.
Submit the complaint and save the reference number.

NPCI explains that customers can raise grievances or check UPI transaction status through participating banks’ UPI apps. However, NPCI also states that fraudulent, unidentified or unauthorised transactions should be raised with the customer’s bank for redressal.

You can read the NPCI UPI FAQs and NPCI complaint facility.

Do not treat an app complaint as a substitute for the bank’s fraud report or the national cybercrime report.

6 What if the bank does not resolve your complaint?

Start with the bank’s own grievance-redressal process. Escalate to its grievance officer or designated nodal officer if the initial complaint is not resolved.

If you remain dissatisfied, the Reserve Bank – Integrated Ombudsman Scheme, 2026 provides a cost-free grievance mechanism for eligible complaints about deficiencies in service by regulated entities.

Before approaching the RBI Ombudsman, you generally need to complain to the bank first. Under the 2026 scheme, you can ordinarily approach the Ombudsman if the bank rejects your complaint wholly or partly, gives an unsatisfactory response, or does not respond within 30 days.

File through the official RBI Complaint Management System. Check the current scheme’s eligibility and maintainability conditions before filing.

Keep copies of the bank complaint, responses, transaction records, cybercrime acknowledgement and any supporting evidence. An Ombudsman complaint is a route for eligible service grievances; it does not guarantee a particular outcome in a criminal fraud investigation.

Official reference: RBI — Integrated Ombudsman Scheme, 2026 FAQs

7 Mistakes to avoid after UPI fraud

Do not wait until the next working day. Call 1930 and report to the bank immediately.
Do not pay a “recovery agent”. Anyone demanding an upfront fee or OTP to retrieve your money may be attempting another scam.
Do not share your UPI PIN or OTP. A bank, police officer or genuine support representative should not need your PIN.
Do not scan a QR code to receive a refund. Scanning a payment QR code or approving a collect request can result in money leaving your account.
Do not delete evidence. Preserve transaction details, messages and call information.
Do not assume every scam is covered by automatic reimbursement. Liability depends on the facts and applicable rules.
Do not stop at the UPI app complaint. Report to the bank and the cybercrime helpline as well.

Frequently asked questions

What number should I call for UPI fraud in India?

Call 1930, the national cybercrime helpline for financial fraud. Also contact your bank immediately and file the online report at cybercrime.gov.in.

Can I get my UPI money back?

Recovery depends on the circumstances, how quickly the fraud is reported, whether funds can be traced or stopped, the transaction’s authorisation status and the applicable liability rules. Reporting quickly can help, but recovery is not guaranteed.

If I entered my UPI PIN, will the bank reject my complaint?

Not necessarily. Explain exactly what happened. If you knowingly authorised a payment after being deceived, the rules may differ from those for a transaction you did not authorise. The bank must assess the actual circumstances and applicable requirements.

Is the RBI’s three-working-day rule counted from the fraud or the bank alert?

For the third-party-breach category under the RBI customer-liability framework, the reporting period is counted from when the customer receives communication from the bank about the unauthorised transaction, using the prescribed working-day calculation. You should still report suspected fraud immediately rather than wait for that period.

Can I complain to the RBI Ombudsman immediately?

Generally, you must first complain to your bank. Under the RBI Integrated Ombudsman Scheme, 2026, you can ordinarily approach the Ombudsman if the bank rejects the complaint, provides an unsatisfactory response or does not respond within 30 days, subject to the scheme’s requirements.

Final checklist: Save these details now

Call 1930 and save the acknowledgement number.
Report the transaction to your bank and save its complaint number.
Submit the online complaint at cybercrime.gov.in.
Raise a complaint through your UPI app if available.
Save the transaction ID, bank alert and relevant screenshots.
Secure your bank and UPI access if credentials may be compromised.
Follow up with the bank and escalate through the proper grievance process if necessary.

The most important step is to act immediately. Report the fraud, preserve evidence and ask your bank to assess the transaction under the applicable RBI rules. Never pay anyone who promises guaranteed recovery.

This article is for general information and is not legal advice. RBI liability protections depend on the transaction facts and the applicable directions. Use official bank, government and RBI channels for reporting and follow-up.