UPI fraud recovery in India — the 2026 money-back roadmap

Scanned a QR code, got a “collect request” call, or watched money leave your account to a stranger? UPI fraud moves fast, but so does the recovery machinery — if you touch it in the right order. The first hour decides how much comes back; the Right to Information Act decides how fast the police file moves after that.

1. Call 1930. It is the helpline run for exactly this. Give the transaction reference, amount and time; the aim is to freeze the receiving account before the money is layered away. The same details go into a written complaint on cybercrime.gov.in — keep the complaint number.
2. Tell your bank in writing — the app's complaint button plus an email to the bank's official complaint id, with the UPI transaction id, date, counterparty UPI id or Virtual Payment Address, and amount. A written trail starts the RBI clock.
3. Do not delete anything. Screenshots of the collect request, the QR, the SMS, the caller's number — all of it is evidence for the bank and the police.
4. Lodge the police complaint. Many states take cyber-fraud FIRs online; our download FIR copy online guide lists the state portals. Quote the 1930 and cybercrime.gov.in reference numbers in it.

The full telephonic script for the 1930 call, with what to say when the “bank verification officer” is really the fraudster, is in the 1930 helpline guide.

The controlling rule is RBI's circular of 6 July 2017 — Customer Protection: Limiting Liability of Customers in Unauthorised Electronic Banking Transactions (RBI/2017-18/15). It works in three steps:

• Reported within 3 working days of the bank's communication: zero liability — the customer loses nothing, wherever the fault lies in the system.
• Reported within 4 to 7 working days (third-party fraud): your exposure is capped per transaction at the transaction value or the Table-1 ceiling, whichever is lower — ₹5,000 for Basic Savings Bank Deposit accounts, ₹10,000 for most other savings accounts, prepaid instruments and MSME current accounts, ₹25,000 for larger current, cash-credit and overdraft accounts and high-limit credit cards.
• Beyond 7 working days: liability falls to be decided under the bank's Board-approved policy — which the bank must publish.

Two force-multipliers sit in the same circular: once you notify the bank, it must make a shadow reversal within 10 working days of the notification, and it must resolve the complaint and pay any compensation within 90 days — if it cannot decide by then, the compensation is paid anyway. And the burden of proving that you were at fault sits on the bank, not on you.

Where the money left by a failed-but-debited UPI transaction — no fraudster at all, just a debit with no service — the RBI turn-around-time rules apply instead: T+5 resolution and ₹100-a-day compensation, the same machinery explained in our ATM cash-not-dispensed guide.

The bank money and the police case run on separate tracks, and the police track is the one that stalls. RTI fixes that:

• Police cyber cell / investigating officer — an RTI under §6(1) asking for FIR status, chargesheet progress and the freezing status of the fraudster's account is the classic prod. Police are public authorities; the application costs ₹10.
• Public-sector banks (SBI, PNB, Bank of Baroda and the rest) are public authorities too — an RTI to the CPIO asks for the fraud-investigation file status and the internal report on your complaint, things a branch will never volunteer.
• Private banks and payment apps are not public authorities under the Act. Your levers there are the bank's own grievance hierarchy and the RBI Integrated Ombudsman — file at the RBI complaint portal after 30 days of an unsatisfactory bank reply, per our banking ombudsman guide.

To: The Public Information Officer,
[Police station / Cyber police station, city].

Subject: Information under §6(1), RTI Act 2005 —
FIR No. [___] dated [___] (UPI fraud ₹[___])

Kindly provide:
1. Present status of investigation of FIR No. [___] —
   stage, sections invoked, and officer responsible.
2. Status of the freeze/lien reported on the suspect
   accounts named in the FIR, and of funds recalled.
3. Date till which the chargesheet or final report is
   committed under §173 CrPC / §193 BNSS.
4. Copies of the final report or correspondence with
   the bank's nodal officer on fund recall.

Fee of ₹10 enclosed by [IPO/DD no. ___].

• Auto-draft it: AI RTI Drafter
• Deadline arithmetic: Timeline Tracker

Yes, in practice. The 1930-cum-portal report works by freezing the receiving account chain; the sooner it is flagged, the more money is still sitting there when the freeze lands. After the money is layered out or withdrawn, recovery depends on the police recall process.

If the transaction was unauthorised and you notified the bank within three working days of its communication, the circular gives you zero liability, and the burden of proving customer liability is on the bank. PIN-sharing that genuinely authorised the payment is a different case — expect the bank to rely on its Board policy there.

First complain to the bank. If the reply is unsatisfactory or 30 days pass without one, the RBI Integrated Ombudsman route opens — the step-by-step is in our banking ombudsman guide.

No — they are not public authorities. The RTI levers are the police investigating your FIR and, for public-sector banks, the bank's own CPIO. For everything else it is the app's grievance channel, the bank, and the Ombudsman.

That is a cousin fraud with its own fingerprint trail — see our AePS fraud guide for the UIDAI-bank escalation route.

• 1930 helpline — the exact call script
• Download FIR copy online
• ATM cash not dispensed — T+5 and ₹100/day
• Banking ombudsman complaint guide
• How to file RTI online — the 12-step guide
• The RTI Playbook book

• National Cyber Crime Reporting Portal — helpline 1930 and the financial-fraud complaint module, verified live 27 August 2026
• RBI circular RBI/2017-18/15, 6 July 2017 — Customer Protection: Limiting Liability of Customers in Unauthorised Electronic Banking Transactions — liability ladder, shadow reversal and 90-day clauses verified against the full text
• State FIR portals on RTI Wiki

Last reviewed: 27 August 2026. The 2017 RBI circular's numbers — 3-working-day zero liability, the ₹5,000/₹10,000/₹25,000 caps, 10-working-day shadow reversal, 90-day resolution — were read from the circular PDF itself, not from secondary round-ups. 1930 and cybercrime.gov.in verified live.