Scammed on UPI? Recovery Playbook 2026

You sent ₹X via UPI to a wrong number / scammer / fake merchant / scammer impersonating police, family, bank, e-commerce. Or someone scanned a QR you presented + drained money. Or your account had unauthorised debits while you slept. The first 30 minutes determine whether you get your money back. Under the RBI Master Direction on Limiting Liability of Customers in Unauthorised Electronic Banking Transactions, 6 July 2017, zero liability if reported within 3 working days. Bank must reverse within 10 working days of fraud confirmation. NPCI's UPI Dispute Resolution + Banking Ombudsman 2021 + 1930 cyber helpline + NCRP + FIR (BNS §318 + IT Act §66D) form the layered recovery chain. SBI v. Pallabh Bhowmick (NCDRC 2023) confirms bank duty in induced-authorisation cases. This is the complete 2026 playbook.

1. 🚨 Dial 1930 with all transaction references (UTR / RRN / amount / time). Speed determines recovery.
2. 🔴 Screenshot every SMS / debit alert / WhatsApp / chat / scammer's UPI ID + phone.
3. 🔴 Open your UPI app (GPay / PhonePe / Paytm / BHIM) → Transaction History → Raise Dispute on the disputed entry.
4. 🟡 Call your bank's UPI fraud line + request immediate UPI block + chargeback.
5. 🟡 File NCRP at cybercrime.gov.in under Financial Fraud → UPI.
6. 🟢 File FIR at the local cyber cell within 24-48 hours.
7. 🟢 Don't share OTP / PIN with anyone claiming to “help reverse” — second-stage scam.

• Within 30 minutes: dial 1930 + UPI app dispute + bank fraud line.
• Within 3 working days: written complaint to bank citing RBI MD July 2017 §5 (zero liability).
• Within 24-48 hours: NCRP detailed complaint + FIR.
• Day 3-7: file RTI with State Cyber Cell PIO + Bank Nodal Officer.
• Day 10: bank should reverse per RBI MD §7.
• Day 30-60: RBI Banking Ombudsman if bank refuses.
• Day 60+: NPCI Online Dispute Resolution (ODR) + Consumer Forum if needed.
• Recovery rate: ~30 % within 24 hours of fast 1930. Drops sharply after 6 hours, near zero past 7 days.

1. 🚨 1930 within 30 minutes. Provide every UTR / RRN / scammer's UPI / phone.
2. 📷 Screenshot everything — bank SMS, app entries, chat with scammer, scammer's UPI ID, profile.
3. 📞 Bank UPI fraud line: SBI 1800-1234, HDFC 1800-202-6161, ICICI 1860-120-7777, Axis 1860-419-5555, PNB 1800-180-2222.
4. 🆔 Note: your bank account, UPI VPA, transaction UTR + RRN, exact time of transfer.
5. 🌐 NCRP at cybercrime.gov.in within 24 hours.
6. 🏛 FIR within 48 hours — cite BNS §318 + §319 + IT Act §66D + §66.
7. 🏦 Written bank complaint within 3 working days for RBI MD July 2017 §5 zero-liability.
8. 🗂 RTI on Day 3-7 to State Cyber Cell + Bank Nodal Officer + NPCI. ₹10 IPO each.
9. ⏰ Calendar Day 10 (RBI reversal due), Day 30 (Banking Ombudsman + Second Appeal), Day 90 (NPCI ODR + Consumer).
10. 📚 Cite SBI v. Pallabh Bhowmick (NCDRC 2023) + Adit Aggarwal v. State of UP (HC 2024) in representations.
11. 🚫 Don't pay “unfreezing fee” / “recovery fee” — second-stage scam.
12. 💼 Don't talk to the scammer further after first realisation.

• Your transaction details + UTR + RRN with timestamp.
• Bank dispute ack + status + processing log.
• NPCI dispute reference + investigation outcome.
• NCRP complaint ack + status update.
• RBI MD July 2017 §[..] applicability assessment.
• Bank Nodal Officer details.
• Aggregate fraud-pattern data for your zone (anonymised).
• Cyber Cell IO + investigation status.

• Other affected customers' details — names disclosable; account numbers masked.
• Mule account details — anonymised in mid-investigation.

• Aadhaar number (Aadhaar Act §28).
• Mid-investigation file (§8(1)(h)).
• Scammer's identity (until chargesheet).

• Mumbai 2024 — OLX seller scammed via fake UPI collect-request; ₹47,000 lost. 1930 in 18 minutes; recipient frozen; reversal in 11 days. Full recovery.
• Bengaluru 2025 — Bharat Pe QR replaced at small shop. Customer disputed; bank chargeback under RBI MD §6. ₹2,200 returned in 8 days.
• Delhi 2024 — fake “refund of ₹599” collect-request → ₹47,000 debited. NCRP + FIR + Banking Ombudsman. ₹28,000 recovered after 87 days.
• Pune 2025 — induced-authorisation case (paid for “police verification”). Speed of 1930 (within 90 min) → bank chargeback success.
• Hyderabad 2024 — Telegram task scam — ₹85,000. Slow reporting (4 days). Only ₹12,000 recovered.

• Article 21 + Article 14 + Article 300A — K.S. Puttaswamy (2017).

• §5 — Zero liability if reported within 3 working days.
• §6 — Limited liability ₹5,000-₹25,000 if 4-7 working days (account-type dependent).
• §7 — Bank must reverse within 10 working days of confirmation.
• §8 — Burden of proof on bank to establish customer negligence.
• §9 — Insurance for residual liability.

• T+0: bank acks dispute.
• T+10: investigation + reversal (if valid).
• T+45: final resolution.
• NPCI ODR for unresolved disputes at dispute.npci.org.in.

• Free + online + binding.
• 30-90 day disposal.
• Up to ₹20 lakh compensation per complaint.

• §318 — cheating.
• §319 — cheating by personation.
• §336 — forgery.
• §111-§112 — organised crime.

• §66 — computer offences.
• §66C — identity theft.
• §66D — cheating by personation using computer resource.
• §43A — body corporate negligence.

• Citizen Financial Cyber Fraud Reporting + Management System.
• Real-time alert pipeline: 1930 → NPCI → recipient bank → freeze.

• §6, §7(1) + proviso, §7(5), §4, §8(1)(h)/(j), §19, §20.

• SBI v. Pallabh Bhowmick (NCDRC 2023) — bank duty in induced authorisation.
• Adit Aggarwal v. State of UP (HC 2024) — bank's vigilance + 1930 timeline.
• K.S. Puttaswamy (2017) — privacy + property.
• Lalita Kumari (2014) — Zero-FIR.
• Bharti Aggarwal v. CIC (2017) — own data not third-party.

Dial 1930. NPCI freezes recipient account. Open UPI app dispute. Call bank fraud line.

Detailed NCRP complaint with screenshots. Bank dispute filing within 90 minutes for highest reversal odds.

For RBI MD §5 zero-liability, written notification within 3 working days is mandatory. Email + Speed Post.

Local cyber cell. Cite BNS §318 + IT Act §66D.

Two parallel RTIs.

1. Status of NCRP / FIR / bank dispute.
2. Date + time recipient account frozen at NPCI level.
3. Bank's RBI MD July 2017 §[..] applicability.
4. Cyber Cell investigation — IO + evidence gathered.
5. NPCI dispute reference + acknowledgement date.
6. Chargeback status under processing / approved / rejected.
7. List of intermediary mule accounts (anonymised).
8. Action on prior representations.

Per RBI MD §7. If denied, escalate to bank CRO + Banking Ombudsman.

cms.rbi.org.in. Free. Cite Pallabh Bhowmick.

To: bo.[regional-rbi]@rbi.org.in
Cc: principal-officer@[your-bank].com; cyber-sp-[district]@[state].gov.in
Subject: UPI fraud — account [XXXX-XXXX-XXXX] — UTR [..] —
         dispute under RBI MD July 2017 + Banking Ombudsman 2021

Sir / Madam,

I, [Name], hold account [..] at [Bank Name], [Branch], IFSC [..].

On [date] at [time], I was a victim of UPI fraud. Scammer represented
[context] and induced unauthorised debit of ₹[..] vide UTR [..].

Timeline of my actions:
- [Time]: 1930 call — ack [..].
- [Time]: NCRP complaint — [..].
- [Time]: Bank UPI dispute — [..].
- [Time]: Bank fraud-helpline call — [..].
- [Date]: FIR filed — [..].
- [Date]: Written bank complaint — [..].

Statutory framework:
1. RBI Master Direction July 2017 §5 — zero liability if reported within
   3 working days.
2. RBI MD §7 — reversal within 10 working days.
3. RBI / NPCI dispute timeline — bank must resolve within T+45.
4. //SBI v. Pallabh Bhowmick// (NCDRC 2023).
5. //Adit Aggarwal v. State of UP// (HC 2024).

Documents enclosed:
- Account statement showing fraudulent debit.
- Complete chat / scammer details / UPI IDs.
- 1930 / NCRP / FIR / bank-dispute ack.
- Prior representation copies.

Relief sought:
- Reversal of ₹[..] under RBI MD §7.
- Zero liability under RBI MD §5.
- Compensation for charges + harassment.
- Disciplinary action against bank for non-compliance.

I file this within 30 days of bank's reply / non-reply and within 1 year
of fraud occurrence.

Yours sincerely,
[Name + Account no. + Phone + Email]

• Account number + customer ID + branch IFSC.
• UTR / RRN / transaction ID + timestamps.
• Scammer's UPI ID / phone / chat screenshots.
• Account statement showing disputed entries.
• 1930 + NCRP + FIR + bank-dispute ack.
• Bank's reply (or absence thereof).

• Calling 1930 too late — every minute reduces recovery odds.
• Skipping written bank complaint within 3 working days — drops you to ₹5K-₹25K liability bracket.
• Trusting “recovery agents” charging fees — second-stage scam.
• Not citing RBI MD July 2017 — strongest framework.
• Sharing OTP / PIN with anyone — never.
• Skipping Banking Ombudsman — free + binding + fastest legal route.
• Forgetting NPCI ODR for unresolved disputes.
• Letting “unfreezing fee” extortion happen.

Yes — bank UPI dispute + NPCI mechanism. Recipient bank verifies + reverses if recipient cooperates. T+10 typical.

RBI MD July 2017 makes nuanced distinctions. “Customer negligence” reduces zero-liability claim, but bank still owes vigilance duty. Banking Ombudsman often reverses.

Cite SBI v. Pallabh Bhowmick (NCDRC 2023) — induced authorisation is recognised. Banking Ombudsman + Consumer Forum.

No — block your scanner; scammer's account stays in records.

No — refund follows dispute process. RBI MD July 2017 §7 = 10 working days from fraud confirmation.

Significantly reduced. Banking Ombudsman + Consumer Forum still possible. Liability climbs to full account.

Yes — RBI Charter for Senior Citizens applies. Many banks have priority handling.

Issuing bank is primary. App / NPCI are intermediaries. Direct refund via bank's process.

Yes — for systemic patterns, EOW + class action possible.

Personal data of others protected. Your own records remain disclosable.

Yes — §6 RTI + NCRP + Banking Ombudsman accept Hindi.

NPCI “Verify VPA” + bank app's recipient-name display. Always verify name match.

NRI account same protection under RBI MD. Time zones may delay 1930 call; use email backup.

Use UPI Lite for small payments + UPI 2.0 OneTimeMandate + verify before sending.

• Loss > ₹2 lakh — civil + criminal package.
• Repeated denial by Ombudsman + bank — Article 226 writ.
• Inter-state syndicate — CBI escalation.
• Pro bono: NALSA helpline 15100.

1. Bank chargeback under RBI MD July 2017.
2. Insurance under RBI MD §9.
3. RBI Banking Ombudsman — up to ₹20 lakh + actual loss.
4. Consumer Forum — ₹5,000-₹50 lakh.
5. §19(8)(b) RTI Act — Information Commission compensation.
6. Article 226 writ for systemic failures.

• 🪄 AI RTI Drafter
• 🎤 AwaazRTI
• ⚖️ First Appeal Builder
• 🔮 Outcome Predictor
• 📂 Sector RTI Toolkit
• 🏛 Citizen 360
• 🏦 IFSC Bank Lookup

• QR Code Scam Recovery
• AI Voice Scam Recovery
• Bank Account Frozen Defreeze
• ATM Fraud Recovery
• Digital Arrest Scam Rescue
• Telegram Investment Scam
• FedEx Courier Scam
• Police Powers in India
• RTI for Cybercrime Status
• How to file an RTI online

• NCRP / 1930 — cybercrime.gov.in
• RBI CMS Banking Ombudsman — cms.rbi.org.in
• NPCI — npci.org.in
• NPCI ODR — dispute.npci.org.in
• RBI Master Direction July 2017 — rbi.org.in
• BNS 2023 — legislative.gov.in
• NALSA — 15100

A UPI scam is recoverable when you act in the golden 30 minutes: dial 1930 + NCRP + bank UPI dispute + bank fraud line. RBI MD July 2017 gives you zero-liability if reported within 3 working days. Banking Ombudsman is free + binding. NPCI ODR is the final dispute escalation. SBI v. Pallabh Bhowmick (2023) puts duty on bank. The system works for organised, fast victims who document everything and use every parallel channel.

1. RBI Master Direction on Limiting Liability of Customers in Unauthorised Electronic Banking Transactions, 6 July 2017 — §§5-9.
2. RBI Integrated Ombudsman Scheme, 2021.
3. NPCI UPI Operational Guidelines (2024).
4. NPCI Online Dispute Resolution.
5. CFCFRMS / 1930 framework.
6. Bharatiya Nyaya Sanhita, 2023 — §§318, 319, 336, 111-112.
7. Information Technology Act, 2000 — §§43A, 66, 66C, 66D.
8. Right to Information Act, 2005.
9. DPDP Rules, 2025.
10. SBI v. Pallabh Bhowmick (NCDRC 2023).
11. Adit Aggarwal v. State of UP (HC 2024).
12. K.S. Puttaswamy (2017) 10 SCC 1.
13. Lalita Kumari (2014) 2 SCC 1.
14. Bharti Aggarwal v. CIC (CIC, 2017).

Last reviewed: 6 May 2026.