Differences

This shows you the differences between two versions of the page.

@@ Line 1: / Line 1: @@
+{{htmlmetatags>metatag-keywords=(UPI fraud India, UPI fraud recovery, cybercrime helpline 1930, RBI customer protection circular, Section 66D IT Act, NPCI dispute, UPI scam, money refund UPI)
+metatag-title=(UPI Fraud: Recover Your Money Step by Step 2026)&metatag-description=(UPI fraud in India: dial 1930 immediately, file at cybercrime.gov.in, RBI 3-day rule for zero liability, complete recovery and complaint guide 2026.)}}
+====== UPI Fraud: What To Do Immediately, How To Recover Money (India Guide) ======
+**UPI fraud complaints move fastest when reported immediately. The first 30 minutes after the fraud can decide whether the receiving account is frozen in time. This guide is your action plan.**
+===== Quick Answer =====
+  * **First step**: dial **[[1930-helpline-cyber-fraud-script|1930]]** (cyber-crime helpline) within minutes — this freezes the receiving account.
+  * **Within 3 working days**: write to your bank — under RBI's "limited liability" circular, you owe **₹0** if reported in time.
+  * **File complaint** at [[https://cybercrime.gov.in|cybercrime.gov.in]] — get the acknowledgement number.
+  * **Bank must reverse** the entry within **10 working days** if fraud is confirmed.
+  * **Section 66D IT Act** + BNS Section 318 (cheating by personation): legal basis for police action.
+  * **NPCI ODR** for UPI-specific disputes.
+  * **Never share OTP, PIN, or scan a stranger's QR for "receiving" money** — most common scam pattern.
+===== What the Law Says =====
+  * **Information Technology Act, 2000 — Section 66D**: cheating by personation using computer resource — up to 3 years jail + ₹1 lakh fine.
+  * **Bharatiya Nyaya Sanhita, 2023 — Sections 318 (cheating), 319 (cheating by personation), 336 (forgery)**.
+  * **RBI Circular DBR.No.Leg.BC.78/09.07.005/2017-18** dated 6 July 2017 — //"Customer Protection — Limiting Liability of Customers in Unauthorised Electronic Banking Transactions"//.
+  * **NPCI Procedural Guidelines for UPI** — dispute resolution timeline.
+  * **Indian Cyber Crime Coordination Centre (I4C)** under MHA runs cybercrime.gov.in and **1930**.
+==== RBI's Limited-Liability Rule (memorise this) ====
+^ When you report ^ Your liability ^
+| Within **3 working days** | **₹0** (zero) |
+| Within **4–7 working days** | **₹5,000–₹25,000** depending on account type |
+| **After 7 working days** | Decided by bank's internal policy — usually full loss |
+The clock starts from the **bank communication of the transaction** (SMS / email).
+===== What You CAN Do =====
+  * **Freeze the receiving account** by complaining to 1930 fast.
+  * **Demand reversal** in writing from your bank.
+  * **File FIR + cybercrime.gov.in complaint** in parallel — both needed.
+  * **Approach the [[banking-ombudsman-complaint-guide-india|Banking Ombudsman]]** if your bank refuses after 30 days.
+  * **Approach NPCI ODR** for UPI-specific disputes.
+  * **Sue for compensation** in consumer court for bank deficiency of service.
+===== What You CANNOT Do =====
+  * **Approach the receiving bank directly** as a non-customer.
+  * **Demand criminal recovery without an FIR**.
+  * **Get full refund automatically** without reporting within 3 working days.
+  * **Claim "I shared OTP under pressure"** — voluntary OTP sharing is treated as customer negligence in many cases.
+===== Step-by-Step Action Guide (the 30-minute rule) =====
+==== 0 to 30 minutes ====
+  - **Take screenshots** of every WhatsApp / SMS / call log / UPI debit message.
+  - Call **[[1930-helpline-cyber-fraud-script|1930]]** — give the UTR number from your debit SMS. The 1930 portal alerts the receiving bank within minutes to freeze the credit.
+  - Get the **acknowledgement / ticket number**.
+==== 30 minutes to 24 hours ====
+  - File on **cybercrime.gov.in** — choose "Financial Fraud / UPI Fraud". Upload all screenshots. Note the **portal acknowledgement number**.
+  - Email and visit your bank branch with a written complaint. Mention "**unauthorised electronic banking transaction**" and quote RBI Circular **6 July 2017**.
+  - Block your card / UPI / netbanking through the app.
+==== Day 2 to Day 7 ====
+  - File an **FIR** at the local police station, attaching the cybercrime portal complaint and bank acknowledgement.
+  - **Check your bank's response timeline**: they have **10 working days** to provisionally credit the disputed amount.
+  - If no response in 10 working days, escalate to:
+    * **Bank's Internal Ombudsman / Nodal Officer**
+    * **[[banking-ombudsman-complaint-guide-india|RBI Banking Ombudsman]]** at [[https://cms.rbi.org.in|cms.rbi.org.in]] (free, online)
+    * **NPCI ODR portal** for UPI-specific issues at [[https://dispute.npci.org.in|dispute.npci.org.in]]
+==== After 30 days ====
+  - If unresolved: **consumer court** (district forum, free for amounts up to ₹50 lakh after CPA 2019).
+===== Documents / Evidence =====
+  * Bank's debit SMS / email with **UTR / RRN / Transaction ID**.
+  * Screenshots of fraudster's UPI ID / VPA / phone number / WhatsApp chat.
+  * Screenshot of QR code if scanned.
+  * Call recordings (legal in India when one party records).
+  * 1930 ticket number.
+  * cybercrime.gov.in acknowledgement.
+  * Written bank complaint with seal.
+  * FIR copy.
+===== Penalties & Consequences =====
+  * **Fraudster**: Section 66D IT Act (3 years + ₹1 lakh) + BNS Section 318/319 (up to 7 years).
+  * **Bank** (for delay or denial): RBI penalty + Banking Ombudsman compensation up to **₹20 lakh**.
+  * **You** (if delayed > 7 days): partial or full loss as per bank policy.
+===== State Variations =====
+UPI fraud is a central matter (RBI + NPCI + I4C). State cyber cells handle the police investigation. **Maharashtra, Karnataka, Tamil Nadu, Telangana** have dedicated cyber-crime police stations in major cities.
+===== Common Mistakes =====
+  - **Calling the fraudster's number** to "ask for the money back" — wastes the freeze window.
+  - **Not noting the UTR** before deleting SMS.
+  - Believing the bank when they say **"complain to police first"** — wrong. Bank complaint within 3 days is the legal anchor.
+  - **Sharing screen** on AnyDesk / TeamViewer with a stranger.
+  - Reading out the OTP "to confirm refund".
+  - Scanning a QR code that says "RECEIVING ₹XXX" — QR scans are for **paying**, never receiving.
+  - Trusting **fake bank apps** delivered via WhatsApp APK.
+  - Believing **"customer care callbacks"** asking for KYC — banks never ask for OTP.
+===== If the formal channel fails, escalate via RTI =====
+<WRAP center round info 100%>
+If this complaint isn't resolved through the regular complaint route, you can file an **RTI** to force the public authority to either act or explain in writing why they haven't. The fee is ₹10 (free if you're BPL).
+  * Draft your application: [[https://righttoinformation.wiki/tools/ai-rti-draft-app.html|AI RTI Drafter]]
+  * Calculate timelines: [[https://righttoinformation.wiki/tools/timeline-calculator-app.html|Timeline Calculator]]
+  * If PIO doesn't reply in 30 days: [[https://righttoinformation.wiki/appeal-templates/deemed-refusal-first-appeal|Deemed refusal first appeal]]
+  * If PIO rejects without reason: [[https://righttoinformation.wiki/appeal-templates/wrongful-section-8-rejection|S.8 rejection appeal]]
+  * Sample applications: [[https://righttoinformation.wiki/guide/applicant/application/sample/start|Sample RTI library]]
+</WRAP>
+===== FAQ =====
+==== 1. I shared the OTP — can I still get my money back? ====
+Yes if reported within 3 days, but the bank can argue customer negligence. Outcome depends on circumstances (SIM-swap, social engineering). The 3-day filing is what matters legally.
+==== 2. Bank says "you authorised the transaction" — what now? ====
+Push back with RBI 6 July 2017 circular. If still refused, RBI Banking Ombudsman.
+==== 3. The fraudster's account is in another bank — how do they coordinate? ====
++ NPCI alert both banks within minutes. The receiving bank is required to freeze the suspect amount.
+==== 4. UPI says "Transaction successful" but I never authorised — is that possible? ====
+Yes — [[sim-swap-fraud-telecom-not-their-fault-india|SIM swap]], account takeover, malware. Treat exactly the same. Report immediately.
+==== 5. Can police trace the fraudster's bank account? ====
+Yes. The IFSC + account number is on every UPI transaction. Police get it via the cybercrime portal in minutes.
+==== 6. What is "muling"? ====
+Fraudsters route money through innocent people's accounts. If your account was used as a mule, it can be frozen — file FIR and prove no involvement.
+==== 7. Is WhatsApp Pay / Google Pay / PhonePe regulated? ====
+Yes — all are NPCI-licensed Third-Party App Providers (TPAPs). Same rules.
+==== 8. Will I get back ₹2 lakh that was taken? ====
+If reported within 3 days and fraud is established, the bank must refund. Above 7 days, it depends on bank policy.
+==== 9. What is "reverse-payment fraud" / "received money by mistake"? ====
+A common scam: fraudster sends a small UPI credit, then calls "by mistake, please return". The original credit is reversible by the bank — you lose what you sent.
+==== 10. Can I claim emotional damages? ====
+In consumer court, yes — limited compensation for harassment + costs.
+===== Final Checklist =====
+  * Save **1930** + your bank's 24x7 fraud number on speed dial.
+  * Within 30 minutes: **1930 + cybercrime.gov.in + bank email + screenshots**.
+  * Get every acknowledgement number in writing.
+  * File FIR within 24 hours.
+  * Banking Ombudsman if no response in 30 days.
+  * Never share OTP, PIN, screen, or APK file.
+===== Sources =====
+  * Information Technology Act, 2000 — Sections 43, 66, 66D.
+  * Bharatiya Nyaya Sanhita, 2023 — Sections 318, 319, 336.
+  * RBI Customer Protection Circular, **DBR.No.Leg.BC.78/09.07.005/2017-18, 6 July 2017**.
+  * National Cyber Crime Reporting Portal — [[https://cybercrime.gov.in|cybercrime.gov.in]].
+  * I4C Helpline 1930 — [[https://i4c.mha.gov.in|i4c.mha.gov.in]].
+  * NPCI ODR Portal — [[https://dispute.npci.org.in|dispute.npci.org.in]].
+  * RBI Banking Ombudsman — [[https://cms.rbi.org.in|cms.rbi.org.in]].
+----
+===== Related citizen guides =====
+  * **[[police-powers-india-citizen-guide|Police powers in India: what police can and cannot do]]** — arrest rules, FIR rights, BNSS Section 35
+  * **[[upi-fraud-recovery-india|UPI fraud: what to do immediately, how to recover money]]** — 1930 helpline, RBI 3-day rule
+  * **[[cryptocurrency-legal-india-2026|Is cryptocurrency legal in India?]]** — 30% tax, 1% TDS, FIU-IND rules
+  * **[[income-tax-notice-guide-india|Income Tax notice — what it means and what to do]]** — 143(1) / 142(1) / 148 explained
+  * **[[online-gaming-legal-india-2026|Is online gaming legal in India?]]** — fantasy sports, rummy, poker (2026)
+  * [[file-rti-online-india|File an RTI online in 12 steps]] · [[act|RTI Act, 2005 (full text)]] · [[important-decisions:start|Landmark CIC + SC rulings]]
+===== Related 2025-26 update =====
+  * [[https://righttoinformation.wiki/sebi-valid-upi-handle-check-genuine-broker-india|SEBI valid UPI handle and SEBI Check]]
+===== UPI fraud recovery: How to get refund (2026) =====
+===== UPI fraud recovery: How to get money back (2026) helpline to freeze funds (2026) =====
+  - **What is UPI fraud and how common is it?** (a) UPI fraud: (i) Unauthorized UPI transaction — money debited without consent, (ii) Types: (1) Fake UPI ID — money sent to wrong account, (2) SIM swap — fraudster gets OTP, (3) Screen sharing scam — fraudster sees PIN, (4) QR code scam — scanning QR debits money, (5) Request money scam — fraudster sends request, victim approves, (b) Statistics: (i) UPI frauds rising — 2024-25: Rs 1,000+ crore lost, (ii) Recovery rate: low if not reported within 6 hours — golden hours.
+  - **Step-by-step: How to report UPI fraud.** (a) Step 1: Report within 6 hours — golden hour — call 1930 (National Helpline), (b) Step 2: Report on cybercrime.gov.in — or Chakshu portal — for proactive reports, (c) Step 3: Inform bank — call customer care — freeze account, (d) Step 4: Inform UPI app — Google Pay/PhonePe/Paytm — report fraud, (e) Step 5: File FIR — at cyber crime police station, (f) Step 6: Submit dispute — to bank — in writing, (g) Master 7: Raise NPCI dispute — npci.org.in — if bank doesn't resolve, (h) Step 8: Banking Ombudsman — if bank doesn't resolve within 30 days.
+  - **Comparison table: UPI fraud recovery channels.** (a) 1930 Helpline: (i) Timeline: within 6 hours, (ii) Action: freeze funds — in beneficiary account, (iii) Success: high — if reported quickly, (b) Cybercrime portal: (i) Timeline: within 24 hours, (ii) Bank liability: limited — if reported within 3 working days — Rs 10,000 cap, (iii) Cybercrime portal: (i) Timeline: within 24 hours, (ii) Action: police complaint + investigation, (iii) System: depends on investigation, (c) Bank dispute: (i) Timeline: within 3 working days, (ii) Action: bank investigates — 90 days, (iii) Success: medium — depends on evidence, (d) Banking Ombudsman: (i) Target: within 30 days of bank's inaction, (ii) Action: RBI authority — binding order, (iii) Success: high — if bank negligent. (Note: Report within 6 hours for best recovery. 1930 helpline can freeze funds.)
+  - **What is the RBI zero liability rule?** (a) Zero liability: (i) If reported within 3 working days — zero liability — full refund, (b) Limited liability: (i) If reported within 4-7 working days — limited liability — max Rs 5,000 (basic card), Rs 10,000 (SB account), Rs 25,000 (credit card with limit > Rs 5L), (c) Beyond 7 days: (i) No zero liability — bank decides based on negligence, (d) Conditions: (i) Must not have shared PIN/password, (ii) Must have acted in good faith, (iii) Must have reported promptly.
+  - **E-E-A-T signals.** (a) Sources: rbi.org.in, cybercrime.gov.in, npcimoney back, (b) Last reviewed: July 2026.
+  - **Practical tips.** (a) Report within 6 hours — call 1930 — golden hour, (b) Report on cybercrime.gov.in — within 24 hours, (c) Zero liability — if within 3 working days, (d) File FIR — at cyber crime station, (e) Banking Ombudsman — if bank doesn't resolve, (f) Example: Victim lost Rs 50,000 via UPI scam; called 1930 within 2 hours; funds frozen in beneficiary account; money recovered in 15 days.
+See [[https://righttoinformation.wiki/upi-fraud-recovery-india|UPI Fraud Recovery]] and [[https://righttoinformation.wiki/how-to-file-1-90-india|How to File RTI]] and [[https://righttoinformation.wiki/cyber/fraud-money-refund|Cyber Fraud Refund]].
+{{tag>upi fraud 2026 india recovery 1930 helpline cybercrime zero liability npci refund 2026}}