UPI AutoPay Mandate Fraud: Stop Unwanted Debits + Cancel (2026)

A Hyderabad teacher noticed three monthly debits of ₹999 from her ICICI account in March 2026, all marked as “AutoPay subscription” to apps she does not remember authorising. The fix takes ten minutes. Open your UPI app, go to Manage AutoPay (or Manage Mandates), and revoke the suspicious mandate. Then file a UDIR dispute via your UPI app for the last debit, write to your bank's nodal officer, and escalate to the RBI Banking Ombudsman at 14448 if the bank does not resolve in 30 days. Legal protection comes from the RBI 2017 Master Direction on Limited Liability and Section 2(11) of the Consumer Protection Act 2019.

1. Take screenshot of the debit SMS, the UPI app history, and the bank statement entry.
2. Note the exact time and the UPI Reference (UTR) or RRN number.
3. Do not delete any chat messages, emails, or app history about the mandate.
4. Raise the complaint on your UPI app first (Help → Raise Dispute → UDIR).
5. Escalate to RBI Banking Ombudsman 14448 or NPCI only after you have saved proof.

🟡 Citizen tip , Most weekend complaints fail not because the law is weak but because evidence gets lost in the first hour. Photograph everything before you call any helpline.

1. Open the UPI app you use (Google Pay, PhonePe, Paytm, BHIM, or your bank app). Go to Profile → Manage AutoPay or Settings → Mandates.
2. Read every active mandate. Note merchant name, amount, frequency, next debit date. Anything you do not recognise is a candidate to revoke.
3. Tap Revoke / Pause on the suspicious mandate. UPI apps require a UPI PIN to confirm.
4. Wait for the SMS confirmation that the mandate has been cancelled. Save it.
5. Open the bank's NetBanking (HDFC NetBanking → Bill Pay → Mandate Management; SBI YONO → Manage SI; Axis Mobile → Subscriptions). Cross-check that the bank also shows the mandate as cancelled.
6. Lock UPI in the app for 24 hours via Profile → Block UPI ID, to prevent further mandate creation while you investigate.
7. File a UDIR dispute in the UPI app for the most recent unauthorised debit. UDIR is NPCI's recurring-payment dispute system.

• Bank statement showing the disputed debits, with date and reference number.
• UPI app screenshot of the active mandate and the merchant name.
• The mandate creation SMS (banks send a one-time SMS when an AutoPay is set up).
• UPI debit SMS for each occurrence.
• Email of any subscription confirmation you received.
• Screenshot of the merchant's website terms, if identifiable.
• UDIR dispute reference number once you file in-app.
• NCRP complaint number once filed at cybercrime.gov.in.
• NPCI mandate dashboard PDF export, if available in your app.

🟡 Most citizens miss this , The CPA 2019 grievance officer must reply within 24 hours under IT Rules 2021 Rule 3(2). Quote that rule in your follow-up email.

1. In-app UDIR dispute. Every UPI app has a Help / Raise Dispute path. UDIR (UPI Dispute Resolution Initiative) gives a 30-day resolution window under NPCI's framework.
2. Bank's nodal officer. Email the bank's published grievance officer with subject line: Unauthorised AutoPay debit, account no XXXX1234, mandate UMN reference . Banks must respond within seven working days.
3. Merchant's grievance email. If a known merchant created the mandate without consent, write to their Grievance Officer published under IT Rules 2021 Rule 3(2). They must acknowledge within 24 hours.
4. NPCI's customer-care line. npci.org.in publishes a complaint form at /what-we-do/upi/dispute-redressal-mechanism.

🟡 Trust signal , Bharatiya Sakshya Adhiniyam 2023 Section 63 admits screenshots and email as primary electronic evidence when forwarded to your own email with timestamp preserved.

7 to 30 days. Most cases resolve here when proof is clean and the dispute is filed within 3 working days of the disputed debit.

Free filing at cms.rbi.org.in or call 14448. Pecuniary jurisdiction up to ₹20 lakh + ₹1 lakh for mental agony. The Ombudsman accepts complaints only after Tier 1 has had 30 days.

For service deficiency, file at edaakhil.nic.in under Consumer Protection Act 2019 Sections 35, 38. For deliberate fraud (impersonation, fake mandate page), file an FIR at the home police station under BNS 2024 Section 318 cheating + IT Act 2000 Section 66D cheating by personation by computer.

To, The Grievance Officer
[Bank Name]
[Date: DD-MM-2026]

Subject: Unauthorised UPI AutoPay debit on account [XXXX1234],
        UMN reference [paste UMN here], demand for reversal +
        mandate cancellation under RBI Master Direction 2017

Madam / Sir,

I write under Rule 3(2) of the IT (Intermediary) Rules 2021 and
the RBI Master Direction on Limiting Liability of Customers in
Unauthorised Electronic Transactions 2017 to report and dispute
the following debit:

Amount:        ₹__________ on DD-MM-2026 at HH:MM IST
UTR / RRN:     __________
Mandate UMN:   __________
Merchant:      __________ (per app description)

I did not authorise this AutoPay mandate. I have not used the
named merchant's services. I request:

  (a) Immediate revocation of the mandate within 24 hours.
  (b) Reversal of the disputed debit to my account within
      seven working days.
  (c) Investigation of how the mandate was created on my UPI
      ID and a written report of findings.
  (d) Confirmation in writing that my account is not enrolled
      in any other AutoPay mandate without my fresh consent.

I attach: bank statement, UPI app mandate screenshot, debit SMS,
mandate-creation SMS (if received).

I have separately filed UDIR reference no. _______ in my UPI app
and a complaint at cybercrime.gov.in vide _______.

If this is not resolved within 30 days, I shall escalate to the
RBI Banking Ombudsman under the Reserve Bank Integrated Ombudsman
Scheme 2021.

Yours sincerely,
[Name]
[Mobile registered with the bank]
[Email]

Reserve Bank of India, NPCI policy notes, and any public-sector bank involved are public authorities under the RTI Act 2005. The following Section 6(1) application can compel disclosure of action taken on systemic AutoPay disputes:

The Public Information Officer
Reserve Bank of India / [Public-sector bank]
[Address]

Subject: Application under Section 6(1) of the RTI Act 2005

Madam / Sir,

I, [Name], resident of [Address], request the following
information under Section 6(1) of the Right to Information
Act 2005:

  1. The total number of UPI AutoPay mandate disputes filed
     with [Bank / RBI] in the financial year 2025-26.
  2. The percentage of such disputes resolved in the customer's
     favour within the 30-day RB-IOS 2021 window.
  3. Any internal advisory or master circular issued in the
     last 24 months on the verification of mandate consent
     before activation.
  4. Whether NPCI has been asked to require a second factor
     of consent for mandates above ₹500 per debit, and the
     status of such proposal.
  5. The Grievance Officer for UPI and AutoPay grievances at
     [Bank], with their contact details, as required by IT
     Rules 2021 Rule 3(2).

I enclose the prescribed fee of ₹10 by Indian Postal Order
no. __________. A reply within 30 days under Section 7(1)
of the RTI Act 2005 is requested.

Yours sincerely,
[Name, address, contact, Aadhaar last 4 digits]
DD-MM-2026

For service deficiency (bank failed to verify consent before creating the mandate, or merchant created mandate without consent), file at the District Consumer Disputes Redressal Commission via edaakhil.nic.in. Pecuniary jurisdiction up to ₹50 lakh. Filing fee ₹100. Median resolution six to twelve months. Claim a refund of the disputed debits, interest at 9 to 12 percent per annum from the debit date, compensation for mental agony (₹5,000 to ₹3 lakh depending on facts), and costs. Cite Indian Medical Association v. V.P. Shantha (1995) 6 SCC 651 for the principle that a paid service is a consumer service. Cite Pioneer Urban Land v. Govindan Raghavan (2019) 5 SCC 725 for the principle that consumer-court jurisdiction is concurrent with regulator jurisdiction.

🟡 Do this immediately , Disable UPI auto-debit and reduce per-transaction limit to ₹1 the moment a financial dispute opens. Restoring later takes 24 hours; preventing further loss takes 30 seconds.

• NPCI UPI dispute redressal: npci.org.in → What we do → UPI → Dispute Redressal Mechanism
• RBI Banking Ombudsman portal: cms.rbi.org.in · helpline 14448
• NCRP (cyber crime): cybercrime.gov.in · helpline 1930
• National Consumer Helpline: consumerhelpline.gov.in · helpline 1915
• DigiLocker (for any payment-related document): digilocker.gov.in
• e-Daakhil consumer court filing: edaakhil.nic.in

• 🛡️ Weekend Problem Solver, 15 emergency topics hub
• 🛡️ Citizen Crisis Response Network, 100 guides
• 💸 UPI deducted but not received, first 10-minute action plan
• 🏦 Banking Ombudsman + RBI complaint route
• 🏦 RBI complaint against bank, full process
• 💸 Recover money sent to wrong bank account
• 💳 Credit card chargeback guide
• 🏦 Illegal bank charges recovery
• 📚 RTI application format and full guide
• 🪄 AI RTI Drafter, free tool

Login to RTI Wiki to download the printable PDF checklist for this article. A one-page summary covers: how to find every active mandate, the in-app UDIR steps, the bank nodal-officer template, the RBI 14448 escalation, and the e-Daakhil filing flow.

A UPI AutoPay mandate (also called eMandate) is a recurring-payment authorisation set up on your UPI ID. Once authorised once with your UPI PIN, the merchant can debit up to a pre-set amount on a fixed schedule (daily, weekly, monthly, yearly) without further OTP. Amounts up to ₹15,000 per debit are allowed without per-transaction OTP since the 2024 NPCI revision.

Open your UPI app and go to Profile → Manage AutoPay (Google Pay), Settings → Mandates (PhonePe), Profile → AutoPay (Paytm), or the equivalent on your bank's UPI app. Each app shows merchant, amount, frequency, and next debit date. You can also call your bank or check NetBanking → Bill Pay → Mandate Management.

No. Every UPI mandate creation requires the user to enter UPI PIN on a screen that shows the merchant name, amount, and frequency. If a mandate exists that you did not authorise, possible causes are: a phishing screen captured your PIN, a family member used your phone, or a screen-sharing scam tricked you. Revoke and dispute immediately.

In your UPI app, open the mandate, tap Revoke or Pause, and enter UPI PIN. The bank sends an SMS within minutes confirming cancellation. Save the SMS. If revoke fails, write to the bank's nodal officer and quote RBI Master Direction 2017.

UDIR (UPI Dispute Resolution Initiative) is NPCI's standardised dispute system. Open your UPI app, go to Help → Raise Dispute, select the disputed debit, choose Unauthorised debit or AutoPay not authorised, and submit. Reference number is generated on screen. Resolution window is 30 days. Outcome is binding on the bank.

UPI does not offer a Visa-style chargeback. The equivalent path is UDIR + bank investigation under RBI Master Direction 2017. The Master Direction caps customer liability at zero if you report within 3 working days and the bank cannot prove customer negligence, ₹10,000 to ₹25,000 for delayed reporting (4 to 7 days), and full liability beyond 7 days. Move fast.

Escalate to the RBI Banking Ombudsman under the Reserve Bank Integrated Ombudsman Scheme 2021 at cms.rbi.org.in or 14448. Free filing, no lawyer needed. The Ombudsman has accepted dozens of UPI AutoPay disputes since 2024 with binding orders. Time limit: file within one year of the bank's final reply.

• Never share UPI PIN. NPCI does not call asking for PIN.
• Audit your active mandates monthly. Most apps show a Manage AutoPay dashboard.
• Set per-transaction limit to ₹2,000 in the bank app for non-merchant UPI.
• Enable UPI Lite for small payments (lower exposure).
• Watch the screen carefully when creating any mandate. Verify merchant name and amount before entering PIN.
• Treat any screen sharing request from a stranger as fraud.

Yes. Creating a mandate by deceptive means is cheating under BNS 2024 Section 318 (general cheating) and Section 66D of the IT Act 2000 (cheating by personation by computer resource). Penalty up to three years imprisonment plus fine. The bank's failure to verify consent can attract Consumer Protection Act 2019 Section 2(11) deficiency in service.

Yes. Under BNSS 2024 Section 173, any cognisable offence must be registered, regardless of amount. If the police refuse, file a complaint to the Magistrate Court under BNSS Section 175 for direction to register the FIR. The NCRP complaint at cybercrime.gov.in is the parallel digital path and is mandatory in most states for cyber-fraud cases.

A UPI AutoPay mandate is a powerful convenience and a known fraud surface. The defence is monthly audit of your active mandates, careful reading of every consent screen before you enter UPI PIN, and a 10-minute first-response drill if a suspicious debit appears. The Citizen Crisis Response Network exists to compress that response into the window where 60 to 80 percent of money is recoverable. Save 14448 in your contacts. Bookmark this guide. Share it with anyone in your family who uses UPI for subscriptions or recurring bills.

• Loan Against Shares: New 60% LTV Cap From April 2026
• UPI Autopay 2026: View and Port Your Mandates Across Apps