UPI AutoPay Mandate Fraud: Cancel and Stop Debits 2026

An illustrative case (not a named person): a teacher noticed three monthly debits of ₹999 from her bank account in March 2026, all marked as “AutoPay subscription” to apps she does not remember authorising. The fix takes ten minutes. Open your UPI app, go to Manage AutoPay (or Manage Mandates), and revoke the suspicious mandate. Then file a UDIR dispute via your UPI app for the last debit, write to your bank's nodal officer, and escalate to the RBI Ombudsman at 14448 if the bank does not resolve in 30 days. Legal protection comes from the RBI circular on Customer Protection – Limiting Liability of Customers in Unauthorised Electronic Banking Transactions (6 July 2017) and Section 2(11) of the Consumer Protection Act 2019.

1. Take screenshot of the debit SMS, the UPI app history, and the bank statement entry.
2. Note the exact time and the UPI Reference (UTR) or RRN number.
3. Do not delete any chat messages, emails, or app history about the mandate.
4. Raise the complaint on your UPI app first (Help → Raise Dispute → UDIR).
5. Escalate to RBI Ombudsman 14448 or NPCI only after you have saved proof.

1. Open the UPI app you use (Google Pay, PhonePe, Paytm, BHIM, or your bank app). Go to Profile → Manage AutoPay or Settings → Mandates.
2. Read every active mandate. Note merchant name, amount, frequency, next debit date. Anything you do not recognise is a candidate to revoke.
3. Tap Revoke / Pause on the suspicious mandate. UPI apps require a UPI PIN to confirm.
4. Wait for the SMS confirmation that the mandate has been cancelled. Save it.
5. Open the bank's NetBanking (HDFC NetBanking → Bill Pay → Mandate Management; SBI YONO → Manage SI; Axis Mobile → Subscriptions). Cross-check that the bank also shows the mandate as cancelled.
6. Lock UPI in the app for 24 hours via Profile → Block UPI ID, to prevent further mandate creation while you investigate.
7. File a UDIR dispute in the UPI app for the most recent unauthorised debit. UDIR is NPCI's recurring-payment dispute system.

• Bank statement showing the disputed debits, with date and reference number.
• UPI app screenshot of the active mandate and the merchant name.
• The mandate creation SMS (banks send a one-time SMS when an AutoPay is set up).
• UPI debit SMS for each occurrence.
• Email of any subscription confirmation you received.
• Screenshot of the merchant's website terms, if identifiable.
• UDIR dispute reference number once you file in-app.
• NCRP complaint number once filed at cybercrime.gov.in.

1. In-app UDIR dispute. Every UPI app has a Help / Raise Dispute path. UDIR (UPI Dispute Resolution Initiative) gives a 30-day resolution window under NPCI's framework.
2. Bank's nodal officer. Email the bank's published grievance officer with subject line: Unauthorised AutoPay debit, account no XXXX1234, mandate UMN reference . The bank must acknowledge the complaint immediately and credit (shadow-reverse) the disputed amount within 10 working days.
3. Merchant's grievance email. If a known merchant created the mandate without consent, write to their Grievance Officer published under IT Rules 2021 Rule 3(2). They must acknowledge within 24 hours.
4. NPCI's customer-care line. npci.org.in publishes a complaint form at /what-we-do/upi/dispute-redressal-mechanism.

7 to 30 days. Most cases resolve here when proof is clean and the dispute is filed within 3 working days of the disputed debit.

Free filing at cms.rbi.org.in or call 14448. Under the Reserve Bank - Integrated Ombudsman Scheme, 2026 (in force 1 July 2026), compensation jurisdiction is up to ₹30 lakh for consequential loss plus up to ₹3 lakh for mental agony, time, and expense. The Ombudsman accepts complaints only after Tier 1 has had 30 days. See our Banking Ombudsman complaint guide and RBI Integrated Ombudsman Scheme 2026 for step-by-step walkthroughs.

For service deficiency, file at e-jagriti.gov.in under Consumer Protection Act 2019 Sections 35, 38. For deliberate fraud (impersonation, fake mandate page), file an FIR at the home police station under BNS 2023 Section 318 cheating + IT Act 2000 Section 66D cheating by personation by computer resource. See also our cyber crime complaint guide and how to file a cybercrime complaint in 2026.

Fraud mandates are rarely obvious. Here are the top red flags citizens discover only after weeks of silent debits:

• Debits from an unknown merchant name on your bank statement or UPI history — often an abbreviation or shell-company name you have never seen.
• Small recurring amounts (₹99, ₹199, ₹299, ₹499, ₹999) that look like legitimate subscription charges but are from apps you never installed.
• No mandate-creation SMS in your message history, even though a mandate exists. This may indicate a phishing page that captured your UPI PIN without the bank's consent flow.
• Multiple mandates to different merchant names created on the same day or within hours — a hallmark of a screen-sharing scam where the fraudster set up several mandates at once.
• Mandate frequency you did not choose (daily or weekly instead of monthly) — fraudsters prefer frequent small debits to avoid detection.
• Mandate amount just under ₹15,000 (the current NPCI no-additional-OTP threshold for standard UPI AutoPay), maximising exposure per debit cycle.
• Bank statement shows “UPI AutoPay” or “eMandate” instead of a merchant you recognise.
• UPI app shows mandates even after you cancelled them — sometimes mandates are re-created by the merchant via a separate backend process.

How to audit every active mandate in 2 minutes:

1. Open Google Pay → Profile → Manage AutoPay → sort by Amount descending.
2. Open PhonePe → Profile → Settings → AutoPay → check each entry.
3. Open Paytm → Profile → AutoPay & Mandates.
4. Open BHIM → Bank Accounts → Mandates.
5. Open your bank app (e.g., SBI YONO, HDFC MobileBanking, Axis Mobile) → Bill Pay / Mandates / Subscriptions section.
6. Write down every merchant name, amount, frequency, and next debit date. Revoke anything you do not recognise.

Cancelling a mandate stops future debits but does not automatically reverse past debits. Do both:

Step-by-step cancellation in every major UPI app:

1. Google Pay: Profile → Manage AutoPay → tap the mandate → Cancel AutoPay → enter UPI PIN.
2. PhonePe: Profile → Settings → AutoPay → tap mandate → Cancel → confirm with UPI PIN.
3. Paytm: Profile → AutoPay & Mandates → select mandate → Cancel → UPI PIN.
4. BHIM: Bank Accounts → Mandates → select → Revoke → UPI PIN.
5. SBI YONO: Manage SI → select mandate → Cancel.
6. HDFC NetBanking: Bill Pay → Mandate Management → Cancel Mandate.
7. Axis Mobile: Subscriptions → select → Cancel.

If the app does not let you cancel:

1. Write to your bank's nodal officer by email, quoting the UMN (Unique Mandate Number) and demanding cancellation under the RBI customer-liability circular, 2017.
2. If the bank does not cancel the mandate, escalate to the RBI Ombudsman under RB-IOS 2026 once the bank has had 30 days.
3. See also our companion guide: how to view and port mandates across apps.

Getting your money back requires a structured escalation. The RBI RBI Customer Protection circular on limiting customer liability in unauthorised electronic transactions (6 July 2017) is your strongest legal lever.

Zero-liability rule: Where the unauthorised transaction is caused by the bank's negligence, a technical failure, or a third-party breach, you have zero liability if you report it to the bank within 3 working days of receiving the bank's communication about the debit. The bank must reverse (shadow-reverse) the amount within 10 working days.

Limited liability tiers (per the RBI 2017 circular, Table 1): Where neither the bank nor you are at fault but the breach is elsewhere in the system, your per-transaction liability is capped (lower of the transaction value or the cap below), based on the account type and the reporting delay:

If the loss is due to your own negligence (you shared the PIN, fell for a phishing page), you bear the entire loss until you report it; the bank bears anything lost after you report. The burden of proving customer negligence lies on the bank.

Refund action plan:

1. Step 1 (Day 0): File a UDIR dispute in-app. Note the reference number.
2. Step 2 (Day 0–1): Email the bank's nodal officer with screenshots, UMN, UTR, and the UDIR reference. Demand reversal (shadow reversal) within 10 working days under the RBI customer-liability circular 2017.
3. Step 3 (Day 7–30): If the bank does not respond, file at RBI CMS portal or call 14448. The RBI Ombudsman can order a refund.
4. Step 4 (Day 30+): File at e-Daakhil consumer court or file an FIR under BNS 2023 Section 318 + IT Act 66D. See how to file a consumer complaint at NCDRC.
5. Step 5: If the fraud is part of a cyber-crime pattern, report at cybercrime.gov.in or call 1930 — see the golden hour zero-liability guide and the 1930 helpline script.

NPCI operates the UPI Dispute Resolution Initiative (UDIR) for recurring-payment disputes. Every UPI app integrates with UDIR — you do not need to visit the NPCI website to file, but you can escalate there if the in-app dispute fails.

How to file a UDIR dispute (in-app):

1. Open your UPI app (Google Pay, PhonePe, Paytm, BHIM, or bank app).
2. Navigate to Help → Raise Dispute or Transaction History → tap the disputed debit → Raise Dispute.
3. Select reason: “Unauthorised transaction” or “AutoPay mandate not authorised by me.”
4. Upload screenshots: the mandate details page, the debit SMS, and the bank statement entry.
5. Submit. You will get a UDIR reference number on screen. Save it.
6. Resolution window: 30 days. The bank must investigate and respond.

If the in-app UDIR fails or is unavailable:

1. Visit npci.org.in → What We Do → UPI → Dispute Redressal Mechanism.
2. Download the NPCI complaint form, fill it, and email it to the NPCI grievance address listed on that page.
3. Quote your UDIR reference number, UTR/RRN, mandate UMN, and bank complaint number.

NPCI escalation contacts:

1. NPCI toll-free UPI helpline: the current number is published at npci.org.in under Get in touch / UPI Complaint.
2. NPCI website: npci.org.in.
3. NPCI grievance email: Available on the dispute redressal page.

For broader cyber-fraud context, see our RTI bundle for NPCI, RBI, and bank fraud disputes and which regulator to complain to.

If your bank or the RBI is slow to act, a Right to Information application can compel disclosure of systemic data — dispute volumes, resolution rates, and internal advisories. RBI, NPCI (if treated as a public authority), and public-sector banks are covered under the RTI Act 2005.

When to file an RTI:

1. The bank has not responded to your complaint in 30 days.
2. You suspect systemic AutoPay fraud (many affected customers, same merchant).
3. You want to know whether RBI has issued advisories on mandate verification.
4. NPCI dispute resolution has stalled or returned an unsatisfactory answer.

What to ask in the RTI (sample questions):

1. Total number of UPI AutoPay mandate disputes filed with [Bank / RBI] in FY 2025-26.
2. Percentage resolved in the customer's favour within the 30-day RBI Ombudsman window.
3. Any internal advisory or master circular issued in the last 24 months on mandate consent verification.
4. Grievance Officer details for UPI/AutoPay complaints as required by IT Rules 2021 Rule 3(2).

Where to file:

1. RBI: File at rtionline.gov.in — RBI is covered by the central RTI online portal.
2. Public-sector banks: File via rtionline.gov.in or the bank's CPIO.
3. NPCI: File via the NPCI website or rtionline.gov.in if NPCI is deemed a public authority.

See our comprehensive guides: RTI Act 2005 complete guide, how to file RTI online, banking and insurance RTI, and RTI for cybercrime complaint status. Use the AI RTI Drafter to generate a ready-to-file application.

Reserve Bank of India and any public-sector bank involved are public authorities under the RTI Act 2005. The following Section 6(1) application can compel disclosure of action taken on systemic AutoPay disputes:

The Public Information Officer
Reserve Bank of India / [Public-sector bank]
[Address]

Subject: Application under Section 6(1) of the RTI Act 2005

Madam / Sir,

I, [Name], resident of [Address], request the following
information under Section 6(1) of the Right to Information
Act 2005:

  1. The total number of UPI AutoPay mandate disputes filed
     with [Bank / RBI] in the financial year 2025-26.
  2. The percentage of such disputes resolved in the customer's
     favour within the 30-day RBI Ombudsman window.
  3. Any internal advisory or master circular issued in the
     last 24 months on the verification of mandate consent
     before activation.
  4. The Grievance Officer for UPI and AutoPay grievances at
     [Bank], with their contact details, as required by IT
     Rules 2021 Rule 3(2).

I enclose the prescribed fee of ₹10 by Indian Postal Order
no. __________. A reply within 30 days under Section 7(1)
of the RTI Act 2005 is requested.

Yours sincerely,
[Name, address, contact]
DD-MM-2026

Citizens often confuse UPI AutoPay mandates with bank standing instructions (SI), NACH/eNACH mandates, and e-mandates for cards. Understanding the difference determines where you complain and how you cancel.

Key takeaway: UPI AutoPay is the highest fraud risk of the recurring-payment options because the setup requires only a UPI PIN, mandates are created in-app (phishing-prone), and the no-additional-OTP threshold is attractive to fraudsters. Standing instructions and NACH mandates are typically bank-mediated and harder to set up fraudulently.

For more on related mandate types, see NACH/ECS mandate cancellation guide, RBI e-mandate rules 2026, and subscription auto-debit trap and cancellation.

Banks are not automatically liable for every fraud — but the RBI customer-liability circular 2017 and the Reserve Bank - Integrated Ombudsman Scheme 2026 create specific duties and timelines.

Bank's legal duties:

1. Verify consent before mandate creation: The UPI/NPCI framework requires UPI PIN authentication. If a mandate was created without valid PIN entry, the bank bears liability.
2. Zero-liability reversal: If the unauthorised transaction is the bank's fault or a third-party breach reported within 3 working days, the bank must reverse the debit (shadow reversal) within 10 working days — per RBI customer-liability circular 2017.
3. 10-working-day shadow reversal: The bank must credit (shadow-reverse) the disputed amount within 10 working days of your complaint, and resolve it within 90 days.
4. 90-day resolution cap: The bank must resolve the complaint and establish liability within 90 days; otherwise the customer is paid compensation as prescribed.
5. SMS notification: Banks must send an SMS at mandate creation and at each debit. If you never received these, the bank's compliance is questionable.
6. Fraud reporting to RBI: Banks must report frauds to the RBI under its fraud risk management directions (which superseded the Frauds Classification and Reporting directions) and comply with the National Cybercrime Reporting Portal framework for digital frauds.

When the bank is liable:

1. The mandate was created without your UPI PIN (technical failure or security breach).
2. The bank failed to send the mandate-creation SMS.
3. The bank failed to shadow-reverse the disputed debit within 10 working days of your complaint.
4. The bank failed to reverse the debit after a valid zero-liability claim.

When the bank may deny liability:

1. You entered the UPI PIN on a phishing page (customer negligence).
2. You shared your PIN or allowed screen sharing with a fraudster.
3. You authorised the mandate knowingly but forgot.
4. You reported beyond 7 working days, so liability falls to be decided under the bank's Board-approved customer-protection policy.

If the bank wrongly denies liability:

1. File at RBI CMS → Ombudsman complaint under RB-IOS 2026.
2. Cite the circular's zero-liability clause and your 3-day reporting proof.
3. File a consumer complaint at e-Daakhil for deficiency of service under CPA 2019 Section 2(11).

See RBI complaint against bank full process, what to do if the RBI Ombudsman rejects your complaint, and RBI ₹25,000 digital fraud compensation rules.

The Reserve Bank - Integrated Ombudsman Scheme 2026 (RB-IOS 2026, in force 1 July 2026) is a free, lawyer-free mechanism to resolve banking disputes including UPI AutoPay fraud. It replaced the 2021 scheme.

Eligibility to file:

1. You must have first complained to the bank (Tier 1).
2. The bank did not resolve within 30 days, OR rejected your complaint, OR gave an unsatisfactory reply.

How to file:

1. Online: Visit cms.rbi.org.in (RBI Complaint Management System).
2. Phone: Call 14448 (RBI Ombudsman helpline, 9:30 AM–5:30 PM, weekdays).
3. Email: File via the CMS portal; it routes to the correct Ombudsman office. You can also write to [email protected].
4. In person: Visit the nearest RBI Ombudsman office.

What to include:

1. Bank complaint reference number and date.
2. UDIR reference number.
3. UMN, UTR/RRN of disputed debits.
4. Screenshots of the mandate, debits, and complaint correspondence.
5. Your bank account number (masked: XXXX1234).
6. Amount claimed (debited amount + compensation for mental agony, if any).

Jurisdiction and limits (RB-IOS 2026):

1. Compensation: up to ₹30 lakh for consequential loss, plus up to ₹3 lakh for mental agony, time, and expense.
2. Filing fee: Free.
3. Decision timeline: Typically 30–60 days from filing.
4. Appeal: If dissatisfied, appeal to the Appellate Authority within 30 days of the Award.

If the Ombudsman closes your complaint unfavourably:

1. Appeal to the Appellate Authority (details in the Ombudsman's order).
2. File a consumer complaint at e-Daakhil.
3. File a writ petition under Article 226 of the Constitution in the High Court.
4. See our guide on next steps after Ombudsman rejection.

For step-by-step walkthroughs, see Banking Ombudsman complaint guide and RBI Integrated Ombudsman Scheme 2026.

Not all UPI fraud is the same. The table below compares the most common UPI fraud types, their mechanics, and the correct complaint path for each.

For more on specific fraud types, see QR code scam recovery, SIM swap fraud recovery, scammed on UPI recovery steps, digital arrest scam, AI voice scam recovery, online payment fraud recovery, and recover money from UPI fraud 2026.

To, The Grievance Officer
[Bank Name]
[Date: DD-MM-2026]

Subject: Unauthorised UPI AutoPay debit on account [XXXX1234],
        UMN reference [paste UMN here], demand for reversal +
        mandate cancellation under the RBI customer-liability circular 2017

Madam / Sir,

I write under Rule 3(2) of the IT (Intermediary) Rules 2021 and
the RBI Customer Protection circular of 6 July 2017 (Limiting
Liability of Customers in Unauthorised Electronic Banking
Transactions) to report and dispute
the following debit:

Amount:        ₹__________ on DD-MM-2026 at HH:MM IST
UTR / RRN:     __________
Mandate UMN:   __________
Merchant:      __________ (per app description)

I did not authorise this AutoPay mandate. I have not used the
named merchant's services. I request:

  (a) Immediate revocation of the mandate within 24 hours.
  (b) Reversal (shadow reversal) of the disputed debit to my account within
      ten working days.
  (c) Investigation of how the mandate was created on my UPI
      ID and a written report of findings.
  (d) Confirmation in writing that my account is not enrolled
      in any other AutoPay mandate without my fresh consent.

I attach: bank statement, UPI app mandate screenshot, debit SMS,
mandate-creation SMS (if received).

I have separately filed UDIR reference no. _______ in my UPI app
and a complaint at cybercrime.gov.in vide _______.

If this is not resolved within 30 days, I shall escalate to the
RBI Ombudsman under the Reserve Bank - Integrated Ombudsman
Scheme 2026.

Yours sincerely,
[Name]
[Mobile registered with the bank]
[Email]

For service deficiency (bank failed to verify consent before creating the mandate, or merchant created mandate without consent), file at the District Consumer Disputes Redressal Commission via e-jagriti.gov.in. Under the Consumer Protection (Jurisdiction of the District/State/National Commission) Rules, 2021, the District Commission hears claims up to ₹50 lakh, the State Commission ₹50 lakh to ₹2 crore, and the National Commission above ₹2 crore. Claim a refund of the disputed debits, interest at 9 to 12 percent per annum from the debit date, compensation for mental agony, and costs. Cite Indian Medical Association v. V.P. Shantha (1995) 6 SCC 651 for the principle that a paid service is a consumer service. See e-Daakhil online filing guide and consumer court filing guide.

• NPCI UPI dispute redressal: npci.org.in → What we do → UPI → Dispute Redressal Mechanism
• RBI Customer Protection circular – Limited Customer Liability (6 July 2017): rbi.org.in/Scripts/NotificationUser.aspx?Id=11040
• RBI Ombudsman portal (RB-IOS 2026): cms.rbi.org.in · helpline 14448
• NCRP (cyber crime): cybercrime.gov.in · helpline 1930
• National Consumer Helpline: consumerhelpline.gov.in · helpline 1915
• DigiLocker (for any payment-related document): digilocker.gov.in
• e-Daakhil consumer court filing: e-jagriti.gov.in
• RBI RTI (central portal): rtionline.gov.in
• Central RTI online portal: rtionline.gov.in

Step 1: The lure WhatsApp message, SMS, or email with urgent text: “Your Aadhaar KYC will expire in 24 hours—complete e-KYC now,” “Unclaimed parcel—pay ₹5 delivery fee,” “You won ₹50,000 cashback—verify UPI to claim.”

Step 2: The fake payment page You tap the link; it opens a lookalike UPI intent screen branded with RBI or UIDAI logos. The collect-request says “Verification ₹1” or “Refundable security ₹10.”

Step 3: The hidden checkbox Buried in fine print below the amount field: “I authorise recurring debits for service activation.” The checkbox is pre-ticked or rendered in 6pt grey text on white background. NPCI's UPI operating rules require explicit user consent for mandates, but fraudsters either lie about the amount or chain multiple smaller mandates.

Step 4: PIN entry You enter your six-digit UPI PIN believing it is a one-time payment. In reality, you just approved a standing instruction. The fraudster's app (often registered as a rogue merchant via a shadow payment aggregator) now holds a valid mandate ID.

Step 5: Silent debits Every day, week, or month the mandate auto-executes. Your bank sends SMS: “₹4,999 debited to XYZ Services.” By the time you investigate, five debits have occurred.

Step 6: Roadblocks to revocation Some scam merchants change their merchant category codes (MCC) to exempt categories (education, insurance) where banks hesitate to chargeback. Others register the mandate on a different VPA than your primary handle, so you don't see it in your main app.

Most citizens miss this — UPI apps group mandates under AutoPay, Recurring Payments, or Manage Mandates; if you use multiple apps (Google Pay, PhonePe, Paytm), check all of them—a mandate planted via one app can debit any linked bank account.

Bharatiya Nyaya Sanhita 2023 - Section 318(4): Cheating and dishonestly inducing delivery of property—the fraudster deceives you into handing over money (successor to IPC section 420). Punishment: imprisonment up to seven years + fine. - Section 319(2): Cheating by personation—impersonating a government body or trusted entity to induce payment. Punishment: imprisonment up to five years, or fine, or both. - Section 316: Criminal breach of trust—if the fraudster was a payment aggregator or merchant onboarded by a Payment Service Provider (PSP), their misuse of mandate infrastructure may constitute breach of trust.

Information Technology Act 2000 - Section 66D: Punishment for cheating by personation using computer resource—imprisonment up to three years + fine up to ₹1 lakh. - Section 43: Penalty for damage to computer, computer system, computer network—liable to pay damages by way of compensation (civil remedy).

Payment and Settlement Systems Act 2007 - Sections 17–18 and 26: RBI can issue binding directions to payment-system participants, and operating a payment system without RBI authorisation is penal; this is the lever NPCI and PSP banks use against rogue merchants, not a citizen-facing charge.

Consumer Protection Act 2019 - Section 2(11): Deficiency in service—bank's failure to block a fraudulent mandate or delay in chargeback is actionable. - 2021 Rules: District Consumer Commission where consideration paid does not exceed ₹50 lakh; State Commission more than ₹50 lakh up to ₹2 crore. - Section 41: Appeal from a District Commission order lies to the State Commission within 45 days (extendable for sufficient cause).

RBI circular on Customer Protection, 6 July 2017 (the operative liability rule) - Zero liability if an unauthorised transaction is reported within three working days; limited liability of ₹5,000 / ₹10,000 / ₹25,000 by account type (or the transaction value, if lower) if reported within 4–7 working days; later reporting falls to the bank's board-approved policy. - The bank must give the zero-liability credit within 10 working days of its decision.

Citizen tip — If your loss exceeds ₹1 lakh, file both FIR (criminal) and consumer complaint (civil + compensation); a criminal conviction strengthens your consumer case, and you can seek punitive damages in addition to actual loss.

NPCI complaint procedure 1. Visit https://www.npci.org.in/what-we-do/grievance-redressal 2. Click “Register Grievance” → select UPI → sub-category Unauthorised Transaction / Fraudulent Mandate. 3. Fill form: Transaction date, UPI Ref No (from SMS), amount, brief description, upload FIR copy + screenshots. 4. NPCI issues ticket number within 24 hours. 5. NPCI forwards complaint to your Payment Service Provider (PSP bank / UPI app issuer) and the fraudulent merchant's PSP. 6. The PSP bank is expected to respond within the turnaround time NPCI publishes for UPI complaints. 7. If no resolution, NPCI escalates to PSP's nodal officer; final NPCI decision within 30 days.

Bank nodal officer escalation - RBI mandates every bank publish nodal officer name, email, phone on their website (homepage → Grievance Redressal). - Email subject: “Zero-Liability Claim & Chargeback Request: Unauthorised UPI Mandate—Account [Number]” - Body: Attach FIR acknowledgement, NPCI ticket number, transaction list, timeline, statutory basis (RBI customer-protection circular of 6 July 2017), demand for provisional credit within 10 working days. - Ask the bank to acknowledge in writing and conclude within 30 days; 30 days of silence makes you eligible to file free at cms.rbi.org.in under the Reserve Bank – Integrated Ombudsman Scheme, 2026.

Banking Ombudsman (RBI Integrated Ombudsman Scheme, 2026) - File online: https://cms.rbi.org.in (Complaints Management System) - Eligibility: Complaint to bank's nodal officer made, 30 days elapsed without resolution OR bank rejected claim. - The Ombudsman can award up to ₹30 lakh for consequential loss, plus up to ₹3 lakh for time, expenses and harassment. - The Ombudsman's award binds the bank unless the bank appeals within 30 days.

Consumer forum parallel track - District Consumer Forum: File within two years of cause of action (CPA 2019 section 69). - Costs: Filing fee is nil for claims up to ₹5 lakh and ₹200 for claims of ₹5–10 lakh; no lawyer is mandatory. - Compensation: Actual loss + mental agony + litigation cost (often 10–20 % of claim amount). - Timeline: Most forums decide within 90–180 days at district level (though delays are common).

Most citizens miss this — You can run parallel tracks—FIR (criminal), NPCI complaint (regulatory), Banking Ombudsman (quasi-judicial), consumer forum (civil)—they do not bar each other; final compensation may come from whichever resolves first.

Regulatory position on burden of proof Under the RBI customer-protection framework (6 July 2017), once you report an unauthorised transaction within the prescribed time, it is for the bank to show either your negligence or that you really authorised the transaction. Mere system logs showing “successful PIN authentication” do not by themselves prove you knowingly created a recurring mandate; the bank must rule out phishing, malware or social engineering before holding you liable.

What good practice looks like NPCI and PSP banks regularly warn UPI users against “verify KYC” scams; in practice you should expect to see the mandate details (frequency, amount, merchant name) before PIN entry, an SMS alert when a mandate is created, and a way to revoke mandates inside the UPI app. - If any of these safeguards is missing, treat it as a red flag and say so in your complaint.

RBI (Commercial Banks – Digital Payment Security Controls) Directions, 2026 These directions govern how banks secure digital payments, including additional factor of authentication; the customer-liability slabs themselves come from the 6 July 2017 circular above. - Rogue merchants and their aggregators are dealt with under RBI's payment-operator directions and NPCI's risk rules—raise the merchant VPA in your NPCI complaint so it reaches that process.

I4C (Indian Cyber Crime Coordination Centre) — verified 2024 figures In 2024 the National Cyber Crime Reporting Portal (cybercrime.gov.in) received about 36.4 lakh cyber-crime complaints reporting losses of about ₹22,845 crore, of which roughly ₹1,100 crore was recovered. Report at once on 1930 or cybercrime.gov.in—early reporting is what makes freezing of mule accounts possible.

Freezing the fraud proceeds — the real route Police can seize property under BNSS, 2023 section 106, and attach or forfeit proceeds of crime under section 107 with the Superintendent of Police's approval; ask the investigating officer in writing to freeze the mule accounts receiving your mandate debits.

Trust signal — Courts consistently hold that the timing of your complaint is decisive; even a one-day delay beyond the three-day window can shift liability, so treat the clock as a hard deadline, not a guideline.

Three possibilities: 1. The mandate was created on a different VPA linked to the same bank account (e.g., you use PhonePe primary, but fraudster registered mandate via your Paytm VPA). 2. The merchant disguised the mandate under an innocuous name (“Insurance Premium,” “Donation”) that you may have scrolled past. 3. The mandate was created at the bank level (e-NACH / e-Mandate via net-banking session hijack, not UPI app), so it won't appear in UPI app—check net-banking → Standing Instructions or Mandates.

Solution: Log into net-banking, go to Mandates / Standing Instructions, revoke all, call bank helpline, request detailed merchant onboarding data for every debit RRN.

NPCI's UPI ecosystem is India-only; however, some fraudsters use Indian shell merchants onboarded by rogue payment aggregators. If the VPA ends in @paytm, @ybl (Yes Bank), @oksbi (SBI), @icici, the merchant is ultimately onboarded by an Indian PSP, so NPCI has jurisdiction. File NPCI complaint; NPCI will serve notice to that PSP and suspend the merchant VPA. If the merchant is genuinely offshore (rare in UPI), escalate to the Cyber Crime Police and the Ministry of Home Affairs via the I4C route; India has mutual legal assistance arrangements with a number of countries for cyber-crime cooperation.

• UPI AutoPay subscription debit cancel and refund guide
• UPI AutoPay 2026: view and port mandates across apps
• UPI fraud recovery India
• Recover money from UPI fraud 2026
• UPI chargeback for wrong payment dispute 2026
• UPI deducted but not received action plan
• Banking Ombudsman complaint guide
• RBI Integrated Ombudsman Scheme 2026
• RBI complaint against bank, full process
• Next steps after RBI Ombudsman rejection
• RBI ₹25,000 digital fraud compensation rules
• Cyber crime complaint guide
• File cybercrime complaint 2026
• 1930 cyber fraud helpline script
• Golden hour zero-liability cyber fraud guide
• Bank refused zero-liability refund — what to do
• RTI Act 2005 complete guide
• How to file RTI online
• Banking and insurance RTI
• RTI for cybercrime complaint status
• RTI bundle for RBI/NPCI/bank fraud disputes
• Credit card chargeback guide
• NACH/ECS mandate cancellation guide
• RBI e-mandate 2026 rules
• Subscription auto-debit trap and cancellation
• Which regulator to complain to
• Recover money sent to wrong bank account
• Illegal bank charges recovery
• BSA Section 63 electronic evidence guide
• The RTI Playbook

A UPI AutoPay mandate (also called eMandate) is a recurring-payment authorisation set up on your UPI ID. Once authorised once with your UPI PIN, the merchant can debit up to a pre-set amount on a fixed schedule (daily, weekly, monthly, yearly) without further OTP. Standard recurring payments are allowed up to ₹15,000 per debit without per-transaction OTP under the current NPCI framework; the threshold is raised to ₹1 lakh for credit-card bill payments, mutual fund SIPs, and insurance premiums. See our UPI digital payments overview.

Open your UPI app and go to Profile → Manage AutoPay (Google Pay), Settings → Mandates (PhonePe), Profile → AutoPay (Paytm), or the equivalent on your bank's UPI app. Each app shows merchant, amount, frequency, and next debit date. You can also call your bank or check NetBanking → Bill Pay → Mandate Management. See how to view and port mandates across apps.

No. Every UPI mandate creation requires the user to enter UPI PIN on a screen that shows the merchant name, amount, and frequency. If a mandate exists that you did not authorise, possible causes are: a phishing screen captured your PIN, a family member used your phone, or a screen-sharing scam tricked you. Revoke and dispute immediately. See how to spot UPI mandate fraud.

In your UPI app, open the mandate, tap Revoke or Pause, and enter UPI PIN. The bank sends an SMS within minutes confirming cancellation. Save the SMS. If revoke fails, write to the bank's nodal officer and quote the RBI customer-liability circular, 6 July 2017. See the full cancellation and refund guide.

UDIR (UPI Dispute Resolution Initiative) is NPCI's standardised dispute system. Open your UPI app, go to Help → Raise Dispute, select the disputed debit, choose Unauthorised debit or AutoPay not authorised, and submit. Reference number is generated on screen. Resolution window is 30 days.

UPI does not offer a Visa-style chargeback. The equivalent path is UDIR + bank investigation under the RBI customer-liability circular 2017. Under that circular, where the breach is not your fault your liability is zero if you report within 3 working days; for a 4–7 day delay it is capped per your account type (₹5,000 for BSBD accounts, ₹10,000 for most savings and credit cards up to ₹5 lakh limit, ₹25,000 for higher-limit credit cards). Move fast. See UPI chargeback for wrong payment dispute 2026.

Escalate to the RBI Ombudsman under the Reserve Bank - Integrated Ombudsman Scheme 2026 at cms.rbi.org.in or 14448. Free filing, no lawyer needed. Time limit: file within 90 days of the bank's last reply (RB-IOS 2026). See what to do when a bank refuses a zero-liability refund and next steps after Ombudsman rejection.

• Never share UPI PIN. NPCI does not call asking for PIN.
• Audit your active mandates monthly. Most apps show a Manage AutoPay dashboard.
• Enable UPI Lite for small payments (lower exposure). See UPI Lite guide.
• Watch the screen carefully when creating any mandate. Verify merchant name and amount before entering PIN.
• Treat any screen sharing request from a stranger as fraud. See digital arrest scam guide.

Yes. Creating a mandate by deceptive means is cheating under BNS 2023 Section 318 (general cheating) and Section 66D of the IT Act 2000 (cheating by personation by computer resource). The bank's failure to verify consent can attract Consumer Protection Act 2019 Section 2(11) deficiency in service. See cyber crime complaint guide.

Yes. Under BNSS 2023 Section 173, information disclosing a cognisable offence must be recorded. If the police refuse, file a complaint to the Magistrate under BNSS Section 175(3) for a direction to investigate. The NCRP complaint at cybercrime.gov.in is the parallel digital path and is mandatory in most states for cyber-fraud cases. See FIR vs NCR vs complaint and cybercrime portal vs police station.

UPI AutoPay is set up via your UPI ID and authenticated with UPI PIN. Card e-mandates are set up with your card details and an initial OTP. Both allow recurring debits without per-transaction OTP up to ₹15,000 (₹1 lakh for credit-card bills, mutual fund SIPs, and insurance) under the RBI e-mandate framework. The dispute path differs: UPI AutoPay uses UDIR; card e-mandates use the chargeback mechanism of your card network (Visa/Mastercard/RuPay). See credit card chargeback guide and RBI e-mandate 2026 rules.

Yes. If your bank is a public-sector bank (SBI, PNB, Bank of Baroda, etc.) or you are querying the RBI, file under Section 6(1) of the RTI Act 2005. Ask for dispute volumes, resolution rates, and any advisories on mandate verification. File at rtionline.gov.in (the central RTI portal covers the RBI). See RTI Act 2005 complete guide and banking and insurance RTI.

Typically 30–60 days from filing. The Ombudsman may extend this for complex cases. If the Ombudsman does not resolve within 3 months, you can treat it as a deemed rejection and appeal to the Appellate Authority or file in consumer court. See Banking Ombudsman complaint guide.

Under the RBI e-mandate framework (as implemented by NPCI for UPI AutoPay), standard recurring payments can debit up to ₹15,000 per transaction without an additional OTP; the threshold is ₹1 lakh for credit-card bills, mutual fund SIPs, and insurance. You cannot reduce this threshold system-wide, but you can: (a) avoid creating any mandate, (b) set your bank's per-transaction UPI limit lower, or © use UPI Lite for small payments (max ₹1,000 per transaction, ₹5,000 total balance). See RBI e-mandate 2026 rules and UPI transaction limits.

Yes. RB-IOS 2026 covers all scheduled commercial banks, including private banks (HDFC, ICICI, Axis, Kotak), certain NBFCs, and PPI issuers. File at cms.rbi.org.in after the bank has had 30 days to resolve your complaint. See Banking Ombudsman guide.

Yes. This is a service-deficiency dispute rather than a fraud dispute. File a UDIR dispute selecting Service not received or Amount mismatch. If the merchant does not resolve, escalate to consumer court under CPA 2019 Section 35. See consumer court filing guide and e-Daakhil filing guide.

1. Immediately disconnect the call.
2. Uninstall the screen-sharing app (AnyDesk, TeamViewer, etc.).
3. Change your UPI PIN and net banking password from a different device if possible.
4. Lock UPI in your bank app (Profile → Block UPI ID).
5. Check all mandates and revoke any you do not recognise.
6. File at cybercrime.gov.in or call 1930.
7. See digital arrest scam and SIM swap fraud recovery.

Yes: 1930 (cybercrime helpline — call within the golden hour to freeze the fraudulent account), 14448 (RBI Ombudsman — for bank-level disputes), and 1915 (National Consumer Helpline — for merchant disputes). See 1930 helpline script and golden hour guide.

Last reviewed: 1 September 2026.