UPI Fraud: What To Do Immediately, How To Recover Money (India Guide)

UPI fraud complaints move fastest when reported immediately. The first 30 minutes after the fraud can decide whether the receiving account is frozen in time. This guide is your action plan.

• First step: dial 1930 (cyber-crime helpline) within minutes — this freezes the receiving account.
• Within 3 working days: write to your bank — under RBI's “limited liability” circular, you owe ₹0 if reported in time.
• File complaint at cybercrime.gov.in — get the acknowledgement number.
• Bank must reverse the entry within 10 working days if fraud is confirmed.
• Section 66D IT Act + BNS Section 318 (cheating by personation): legal basis for police action.
• NPCI ODR for UPI-specific disputes.
• Never share OTP, PIN, or scan a stranger's QR for “receiving” money — most common scam pattern.

• Information Technology Act, 2000 — Section 66D: cheating by personation using computer resource — up to 3 years jail + ₹1 lakh fine.
• Bharatiya Nyaya Sanhita, 2023 — Sections 318 (cheating), 319 (cheating by personation), 336 (forgery).
• RBI Circular DBR.No.Leg.BC.78/09.07.005/2017-18 dated 6 July 2017 — “Customer Protection — Limiting Liability of Customers in Unauthorised Electronic Banking Transactions”.
• NPCI Procedural Guidelines for UPI — dispute resolution timeline.
• Indian Cyber Crime Coordination Centre (I4C) under MHA runs cybercrime.gov.in and 1930.

The clock starts from the bank communication of the transaction (SMS / email).

• Freeze the receiving account by complaining to 1930 fast.
• Demand reversal in writing from your bank.
• File FIR + cybercrime.gov.in complaint in parallel — both needed.
• Approach the Banking Ombudsman if your bank refuses after 30 days.
• Approach NPCI ODR for UPI-specific disputes.
• Sue for compensation in consumer court for bank deficiency of service.

• Approach the receiving bank directly as a non-customer.
• Demand criminal recovery without an FIR.
• Get full refund automatically without reporting within 3 working days.
• Claim “I shared OTP under pressure” — voluntary OTP sharing is treated as customer negligence in many cases.

1. Take screenshots of every WhatsApp / SMS / call log / UPI debit message.
2. Call 1930 — give the UTR number from your debit SMS. The 1930 portal alerts the receiving bank within minutes to freeze the credit.
3. Get the acknowledgement / ticket number.

1. File on cybercrime.gov.in — choose “Financial Fraud / UPI Fraud”. Upload all screenshots. Note the portal acknowledgement number.
2. Email and visit your bank branch with a written complaint. Mention “unauthorised electronic banking transaction” and quote RBI Circular 6 July 2017.
3. Block your card / UPI / netbanking through the app.

1. File an FIR at the local police station, attaching the cybercrime portal complaint and bank acknowledgement.
2. Check your bank's response timeline: they have 10 working days to provisionally credit the disputed amount.
3. If no response in 10 working days, escalate to:
   • Bank's Internal Ombudsman / Nodal Officer
   • RBI Banking Ombudsman at cms.rbi.org.in (free, online)
   • NPCI ODR portal for UPI-specific issues at dispute.npci.org.in

1. If unresolved: consumer court (district forum, free for amounts up to ₹50 lakh after CPA 2019).

• Bank's debit SMS / email with UTR / RRN / Transaction ID.
• Screenshots of fraudster's UPI ID / VPA / phone number / WhatsApp chat.
• Screenshot of QR code if scanned.
• Call recordings (legal in India when one party records).
• 1930 ticket number.
• cybercrime.gov.in acknowledgement.
• Written bank complaint with seal.
• FIR copy.

• Fraudster: Section 66D IT Act (3 years + ₹1 lakh) + BNS Section 318/319 (up to 7 years).
• Bank (for delay or denial): RBI penalty + Banking Ombudsman compensation up to ₹20 lakh.
• You (if delayed > 7 days): partial or full loss as per bank policy.

UPI fraud is a central matter (RBI + NPCI + I4C). State cyber cells handle the police investigation. Maharashtra, Karnataka, Tamil Nadu, Telangana have dedicated cyber-crime police stations in major cities.

1. Calling the fraudster's number to “ask for the money back” — wastes the freeze window.
2. Not noting the UTR before deleting SMS.
3. Believing the bank when they say “complain to police first” — wrong. Bank complaint within 3 days is the legal anchor.
4. Sharing screen on AnyDesk / TeamViewer with a stranger.
5. Reading out the OTP “to confirm refund”.
6. Scanning a QR code that says “RECEIVING ₹XXX” — QR scans are for paying, never receiving.
7. Trusting fake bank apps delivered via WhatsApp APK.
8. Believing “customer care callbacks” asking for KYC — banks never ask for OTP.

Yes if reported within 3 days, but the bank can argue customer negligence. Outcome depends on circumstances (SIM-swap, social engineering). The 3-day filing is what matters legally.

Push back with RBI 6 July 2017 circular. If still refused, RBI Banking Ombudsman.

1930 + NPCI alert both banks within minutes. The receiving bank is required to freeze the suspect amount.

Yes — SIM swap, account takeover, malware. Treat exactly the same. Report immediately.

Yes. The IFSC + account number is on every UPI transaction. Police get it via the cybercrime portal in minutes.

Fraudsters route money through innocent people's accounts. If your account was used as a mule, it can be frozen — file FIR and prove no involvement.

Yes — all are NPCI-licensed Third-Party App Providers (TPAPs). Same rules.

If reported within 3 days and fraud is established, the bank must refund. Above 7 days, it depends on bank policy.

A common scam: fraudster sends a small UPI credit, then calls “by mistake, please return”. The original credit is reversible by the bank — you lose what you sent.

In consumer court, yes — limited compensation for harassment + costs.

• Save 1930 + your bank's 24×7 fraud number on speed dial.
• Within 30 minutes: 1930 + cybercrime.gov.in + bank email + screenshots.
• Get every acknowledgement number in writing.
• File FIR within 24 hours.
• Banking Ombudsman if no response in 30 days.
• Never share OTP, PIN, screen, or APK file.

• Information Technology Act, 2000 — Sections 43, 66, 66D.
• Bharatiya Nyaya Sanhita, 2023 — Sections 318, 319, 336.
• RBI Customer Protection Circular, DBR.No.Leg.BC.78/09.07.005/2017-18, 6 July 2017.
• National Cyber Crime Reporting Portal — cybercrime.gov.in.
• I4C Helpline 1930 — i4c.mha.gov.in.
• NPCI ODR Portal — dispute.npci.org.in.
• RBI Banking Ombudsman — cms.rbi.org.in.

• Police powers in India: what police can and cannot do — arrest rules, FIR rights, BNSS Section 35
• UPI fraud: what to do immediately, how to recover money — 1930 helpline, RBI 3-day rule
• Is cryptocurrency legal in India? — 30% tax, 1% TDS, FIU-IND rules
• Income Tax notice — what it means and what to do — 143(1) / 142(1) / 148 explained
• Is online gaming legal in India? — fantasy sports, rummy, poker (2026)
• File an RTI online in 12 steps · RTI Act, 2005 (full text) · Landmark CIC + SC rulings

• SEBI valid UPI handle and SEBI Check

1. What is UPI fraud and how common is it? (a) UPI fraud: (i) Unauthorized UPI transaction — money debited without consent, (ii) Types: (1) Fake UPI ID — money sent to wrong account, (2) SIM swap — fraudster gets OTP, (3) Screen sharing scam — fraudster sees PIN, (4) QR code scam — scanning QR debits money, (5) Request money scam — fraudster sends request, victim approves, (b) Statistics: (i) UPI frauds rising — 2024-25: Rs 1,000+ crore lost, (ii) Recovery rate: low if not reported within 6 hours — golden hours.

1. Step-by-step: How to report UPI fraud. (a) Step 1: Report within 6 hours — golden hour — call 1930 (National Helpline), (b) Step 2: Report on cybercrime.gov.in — or Chakshu portal — for proactive reports, © Step 3: Inform bank — call customer care — freeze account, (d) Step 4: Inform UPI app — Google Pay/PhonePe/Paytm — report fraud, (e) Step 5: File FIR — at cyber crime police station, (f) Step 6: Submit dispute — to bank — in writing, (g) Master 7: Raise NPCI dispute — npci.org.in — if bank doesn't resolve, (h) Step 8: Banking Ombudsman — if bank doesn't resolve within 30 days.

1. Comparison table: UPI fraud recovery channels. (a) 1930 Helpline: (i) Timeline: within 6 hours, (ii) Action: freeze funds — in beneficiary account, (iii) Success: high — if reported quickly, (b) Cybercrime portal: (i) Timeline: within 24 hours, (ii) Bank liability: limited — if reported within 3 working days — Rs 10,000 cap, (iii) Cybercrime portal: (i) Timeline: within 24 hours, (ii) Action: police complaint + investigation, (iii) System: depends on investigation, © Bank dispute: (i) Timeline: within 3 working days, (ii) Action: bank investigates — 90 days, (iii) Success: medium — depends on evidence, (d) Banking Ombudsman: (i) Target: within 30 days of bank's inaction, (ii) Action: RBI authority — binding order, (iii) Success: high — if bank negligent. (Note: Report within 6 hours for best recovery. 1930 helpline can freeze funds.)

1. What is the RBI zero liability rule? (a) Zero liability: (i) If reported within 3 working days — zero liability — full refund, (b) Limited liability: (i) If reported within 4-7 working days — limited liability — max Rs 5,000 (basic card), Rs 10,000 (SB account), Rs 25,000 (credit card with limit > Rs 5L), © Beyond 7 days: (i) No zero liability — bank decides based on negligence, (d) Conditions: (i) Must not have shared PIN/password, (ii) Must have acted in good faith, (iii) Must have reported promptly.

1. E-E-A-T signals. (a) Sources: rbi.org.in, cybercrime.gov.in, npcimoney back, (b) Last reviewed: July 2026.

1. Practical tips. (a) Report within 6 hours — call 1930 — golden hour, (b) Report on cybercrime.gov.in — within 24 hours, © Zero liability — if within 3 working days, (d) File FIR — at cyber crime station, (e) Banking Ombudsman — if bank doesn't resolve, (f) Example: Victim lost Rs 50,000 via UPI scam; called 1930 within 2 hours; funds frozen in beneficiary account; money recovered in 15 days.

See UPI Fraud Recovery and How to File RTI and Cyber Fraud Refund.