UPI AutoPay Mandate Fraud: Stop Unwanted Debits + Cancel (2026)

A Hyderabad teacher noticed three monthly debits of ₹999 from her ICICI account in March 2026, all marked as “AutoPay subscription” to apps she does not remember authorising. The fix takes ten minutes. Open your UPI app, go to Manage AutoPay (or Manage Mandates), and revoke the suspicious mandate. Then file a UDIR dispute via your UPI app for the last debit, write to your bank's nodal officer, and escalate to the RBI Banking Ombudsman at 14448 if the bank does not resolve in 30 days. Legal protection comes from the RBI Master Direction on Limiting Liability of Customers in Unauthorised Electronic Transactions (2017) and Section 2(11) of the Consumer Protection Act 2019.

1. Take screenshot of the debit SMS, the UPI app history, and the bank statement entry.
2. Note the exact time and the UPI Reference (UTR) or RRN number.
3. Do not delete any chat messages, emails, or app history about the mandate.
4. Raise the complaint on your UPI app first (Help → Raise Dispute → UDIR).
5. Escalate to RBI Banking Ombudsman 14448 or NPCI only after you have saved proof.

🟡 Citizen tip , Most weekend complaints fail not because the law is weak but because evidence gets lost in the first hour. Photograph everything before you call any helpline.

1. Open the UPI app you use (Google Pay, PhonePe, Paytm, BHIM, or your bank app). Go to Profile → Manage AutoPay or Settings → Mandates.
2. Read every active mandate. Note merchant name, amount, frequency, next debit date. Anything you do not recognise is a candidate to revoke.
3. Tap Revoke / Pause on the suspicious mandate. UPI apps require a UPI PIN to confirm.
4. Wait for the SMS confirmation that the mandate has been cancelled. Save it.
5. Open the bank's NetBanking (HDFC NetBanking → Bill Pay → Mandate Management; SBI YONO → Manage SI; Axis Mobile → Subscriptions). Cross-check that the bank also shows the mandate as cancelled.
6. Lock UPI in the app for 24 hours via Profile → Block UPI ID, to prevent further mandate creation while you investigate.
7. File a UDIR dispute in the UPI app for the most recent unauthorised debit. UDIR is NPCI's recurring-payment dispute system.

• Bank statement showing the disputed debits, with date and reference number.
• UPI app screenshot of the active mandate and the merchant name.
• The mandate creation SMS (banks send a one-time SMS when an AutoPay is set up).
• UPI debit SMS for each occurrence.
• Email of any subscription confirmation you received.
• Screenshot of the merchant's website terms, if identifiable.
• UDIR dispute reference number once you file in-app.
• NCRP complaint number once filed at cybercrime.gov.in.
• NPCI mandate dashboard PDF export, if available in your app.

🟡 Most citizens miss this , The CPA 2019 grievance officer must reply within 24 hours under IT Rules 2021 Rule 3(2). Quote that rule in your follow-up email.

1. In-app UDIR dispute. Every UPI app has a Help / Raise Dispute path. UDIR (UPI Dispute Resolution Initiative) gives a 30-day resolution window under NPCI's framework.
2. Bank's nodal officer. Email the bank's published grievance officer with subject line: Unauthorised AutoPay debit, account no XXXX1234, mandate UMN reference . Banks must respond within seven working days.
3. Merchant's grievance email. If a known merchant created the mandate without consent, write to their Grievance Officer published under IT Rules 2021 Rule 3(2). They must acknowledge within 24 hours.
4. NPCI's customer-care line. npci.org.in publishes a complaint form at /what-we-do/upi/dispute-redressal-mechanism.

🟡 Trust signal , Bharatiya Sakshya Adhiniyam 2023 Section 63 admits screenshots and email as primary electronic evidence when forwarded to your own email with timestamp preserved. See our detailed guide on BSA Section 63 electronic evidence certificates.

7 to 30 days. Most cases resolve here when proof is clean and the dispute is filed within 3 working days of the disputed debit.

Free filing at cms.rbi.org.in or call 14448. Pecuniary jurisdiction up to ₹20 lakh + ₹1 lakh for mental agony. The Ombudsman accepts complaints only after Tier 1 has had 30 days. See our Banking Ombudsman complaint guide and RBI Integrated Ombudsman Scheme 2026 for step-by-step walkthroughs.

For service deficiency, file at edaakhil.nic.in under Consumer Protection Act 2019 Sections 35, 38. For deliberate fraud (impersonation, fake mandate page), file an FIR at the home police station under BNS 2024 Section 318 cheating + IT Act 2000 Section 66D cheating by personation by computer. See also our cyber crime complaint guide and how to file a cybercrime complaint in 2026.

Fraud mandates are rarely obvious. Here are the top red flags citizens discover only after weeks of silent debits:

• Debits from an unknown merchant name on your bank statement or UPI history — often an abbreviation or shell-company name you have never seen.
• Small recurring amounts (₹99, ₹199, ₹299, ₹499, ₹999) that look like legitimate subscription charges but are from apps you never installed.
• No mandate-creation SMS in your message history, even though a mandate exists. This may indicate a phishing page that captured your UPI PIN without the bank's consent flow.
• Multiple mandates to different merchant names created on the same day or within hours — a hallmark of a screen-sharing scam where the fraudster set up several mandates at once.
• Mandate frequency you did not choose (daily or weekly instead of monthly) — fraudsters prefer frequent small debits to avoid detection.
• Mandate amount just under ₹15,000 (the current NPCI no-OTP threshold), maximising exposure per debit cycle.
• Bank statement shows “UPI AutoPay” or “eMandate” instead of a merchant you recognise.
• UPI app shows mandates even after you cancelled them — sometimes mandates are re-created by the merchant via a separate backend process (NPCI recurring mandate callback).

How to audit every active mandate in 2 minutes:

1. Open Google Pay → Profile → Manage AutoPay → sort by Amount descending.
2. Open PhonePe → Profile → Settings → AutoPay → check each entry.
3. Open Paytm → Profile → AutoPay & Mandates.
4. Open BHIM → Bank Accounts → Mandates.
5. Open your bank app (e.g., SBI YONO, HDFC MobileBanking, Axis Mobile) → Bill Pay / Mandates / Subscriptions section.
6. Write down every merchant name, amount, frequency, and next debit date. Revoke anything you do not recognise.

🟡 Do this monthly , Set a calendar reminder for the 1st of every month to audit all active UPI mandates. Most fraud is discovered 3–6 months after the first unauthorised debit.

Cancelling a mandate stops future debits but does not automatically reverse past debits. Do both:

Step-by-step cancellation in every major UPI app:

1. Google Pay: Profile → Manage AutoPay → tap the mandate → Cancel AutoPay → enter UPI PIN.
2. PhonePe: Profile → Settings → AutoPay → tap mandate → Cancel → confirm with UPI PIN.
3. Paytm: Profile → AutoPay & Mandates → select mandate → Cancel → UPI PIN.
4. BHIM: Bank Accounts → Mandates → select → Revoke → UPI PIN.
5. SBI YONO: Manage SI → select mandate → Cancel.
6. HDFC NetBanking: Bill Pay → Mandate Management → Cancel Mandate.
7. Axis Mobile: Subscriptions → select → Cancel.

If the app does not let you cancel:

1. Write to your bank's nodal officer by email, quoting the UMN (Unique Mandate Number) and demanding cancellation under the RBI Master Direction 2017.
2. If the bank does not cancel within 7 working days, escalate to the RBI Banking Ombudsman — see our RB-IOS 2021 walkthrough.
3. See also our companion guides: UPI AutoPay subscription debit cancel and refund and how to view and port mandates across apps.

🟡 Important , Cancellation only stops future debits. To recover money already debited, you must file a UDIR dispute and/or a bank complaint — see the next section.

Getting your money back requires a structured escalation. The RBI Master Direction on Limited Customer Liability (2017) is your strongest legal lever.

Zero-liability rule: If you report unauthorised transactions within 3 working days, your liability is zero — the bank must reverse the debit. The bank bears the loss unless it can prove customer negligence.

Limited liability tiers (per RBI Master Direction):

Refund action plan:

1. Step 1 (Day 0): File a UDIR dispute in-app. Note the reference number.
2. Step 2 (Day 0–1): Email the bank's nodal officer with screenshots, UMN, UTR, and the UDIR reference. Demand reversal within 7 working days under RBI Master Direction 2017.
3. Step 3 (Day 7–30): If the bank does not respond, file at RBI CMS portal or call 14448. The RBI Ombudsman can order a refund.
4. Step 4 (Day 30+): File at e-Daakhil consumer court or file an FIR under BNS 318 + IT Act 66D. See how to file a consumer complaint at NCDRC.
5. Step 5: If the fraud is part of a cyber-crime pattern, report at cybercrime.gov.in or call 1930 — see the golden hour zero-liability guide and the 1930 helpline script.

🟡 Act within 3 working days , The zero-liability window is the single most powerful consumer protection in Indian banking law. Missing it shifts the financial burden entirely to you. See also what to do when a bank refuses a zero-liability refund.

NPCI operates the UPI Dispute Resolution Initiative (UDIR) for recurring-payment disputes. Every UPI app integrates with UDIR — you do not need to visit the NPCI website to file, but you can escalate there if the in-app dispute fails.

How to file a UDIR dispute (in-app):

1. Open your UPI app (Google Pay, PhonePe, Paytm, BHIM, or bank app).
2. Navigate to Help → Raise Dispute or Transaction History → tap the disputed debit → Raise Dispute.
3. Select reason: “Unauthorised transaction” or “AutoPay mandate not authorised by me.”
4. Upload screenshots: the mandate details page, the debit SMS, and the bank statement entry.
5. Submit. You will get a UDIR reference number on screen. Save it.
6. Resolution window: 30 days. The bank must investigate and respond.

If the in-app UDIR fails or is unavailable:

1. Visit npci.org.in → What We Do → UPI → Dispute Redressal Mechanism.
2. Download the NPCI complaint form, fill it, and email it to the NPCI grievance address listed on that page.
3. Quote your UDIR reference number, UTR/RRN, mandate UMN, and bank complaint number.

NPCI escalation contacts:

1. NPCI toll-free: 1800-120-1740 (UPI helpline).
2. NPCI website: npci.org.in.
3. NPCI grievance email: Available on the dispute redressal page.

For broader cyber-fraud context, see our RTI bundle for NPCI, RBI, and bank fraud disputes and which regulator to complain to.

If your bank or the RBI is slow to act, a Right to Information application can compel disclosure of systemic data — dispute volumes, resolution rates, and internal advisories. RBI, NPCI (if treated as a public authority), and public-sector banks are covered under the RTI Act 2005.

When to file an RTI:

1. The bank has not responded to your complaint in 30 days.
2. You suspect systemic AutoPay fraud (many affected customers, same merchant).
3. You want to know whether RBI has issued advisories on mandate verification.
4. NPCI dispute resolution has stalled or returned an unsatisfactory answer.

What to ask in the RTI (sample questions):

1. Total number of UPI AutoPay mandate disputes filed with [Bank / RBI] in FY 2025-26.
2. Percentage resolved in the customer's favour within the 30-day RB-IOS window.
3. Any internal advisory or master circular issued in the last 24 months on mandate consent verification.
4. Whether NPCI has been directed to require a second factor of consent for mandates above ₹500.
5. Grievance Officer details for UPI/AutoPay complaints as required by IT Rules 2021 Rule 3(2).

Where to file:

1. RBI: File at rtionline.rbi.org.in (RBI's online RTI portal).
2. Public-sector banks: File via rtionline.gov.in or the bank's CPIO.
3. NPCI: File via the NPCI website or rtionline.gov.in if NPCI is deemed a public authority.

See our comprehensive guides: RTI Act 2005 complete guide, how to file RTI online, banking and insurance RTI, and RTI for cybercrime complaint status. Use our free AI RTI Drafter tool to generate a ready-to-file application.

Reserve Bank of India, NPCI policy notes, and any public-sector bank involved are public authorities under the RTI Act 2005. The following Section 6(1) application can compel disclosure of action taken on systemic AutoPay disputes:

The Public Information Officer
Reserve Bank of India / [Public-sector bank]
[Address]

Subject: Application under Section 6(1) of the RTI Act 2005

Madam / Sir,

I, [Name], resident of [Address], request the following
information under Section 6(1) of the Right to Information
Act 2005:

  1. The total number of UPI AutoPay mandate disputes filed
     with [Bank / RBI] in the financial year 2025-26.
  2. The percentage of such disputes resolved in the customer's
     favour within the 30-day RB-IOS 2021 window.
  3. Any internal advisory or master circular issued in the
     last 24 months on the verification of mandate consent
     before activation.
  4. Whether NPCI has been asked to require a second factor
     of consent for mandates above ₹500 per debit, and the
     status of such proposal.
  5. The Grievance Officer for UPI and AutoPay grievances at
     [Bank], with their contact details, as required by IT
     Rules 2021 Rule 3(2).

I enclose the prescribed fee of ₹10 by Indian Postal Order
no. __________. A reply within 30 days under Section 7(1)
of the RTI Act 2005 is requested.

Yours sincerely,
[Name, address, contact, Aadhaar last 4 digits]
DD-MM-2026

Citizens often confuse UPI AutoPay mandates with bank standing instructions (SI), NACH/eNACH mandates, and e-mandates for cards. Understanding the difference determines where you complain and how you cancel.

Key takeaway: UPI AutoPay is the highest fraud risk because the setup requires only a UPI PIN (no OTP per debit), mandates are created in-app (phishing-prone), and the ₹15,000 no-OTP threshold is attractive to fraudsters. Standing instructions and NACH mandates are typically bank-mediated and harder to set up fraudulently.

For more on related mandate types, see NACH/ECS mandate cancellation guide, RBI e-mandate rules 2026, and subscription auto-debit trap and cancellation.

Banks are not automatically liable for every fraud — but the RBI Master Direction 2017 and RB-IOS 2021 create specific duties and timelines.

Bank's legal duties:

1. Verify consent before mandate creation: The bank/NPCI framework requires UPI PIN authentication. If a mandate was created without valid PIN entry, the bank bears liability.
2. Zero-liability reversal: If reported within 3 working days, the bank must reverse the debit at zero cost to the customer — per RBI Master Direction 2017.
3. 7-day response window: The bank's grievance officer must respond within 7 working days of receiving the complaint.
4. 30-day resolution: Under RB-IOS 2021, the bank must resolve the dispute within 30 days or the customer can escalate to the Ombudsman.
5. SMS notification: Banks must send an SMS at mandate creation and at each debit. If you never received these, the bank's compliance is questionable.
6. Fraud-reporting to RBI: Banks must report electronic frauds to the RBI Central Repository of Information on Large Credits (CRILC) and the National Cybercrime Reporting Portal framework.

When the bank is liable:

1. The mandate was created without your UPI PIN (technical failure or security breach).
2. The bank failed to send the mandate-creation SMS.
3. The bank failed to act on your complaint within 7 working days.
4. The bank failed to reverse the debit after a valid zero-liability claim.

When the bank may deny liability:

1. You entered the UPI PIN on a phishing page (customer negligence).
2. You shared your PIN or allowed screen sharing with a fraudster.
3. You authorised the mandate knowingly but forgot.
4. You reported beyond 7 working days (limited liability applies from day 4).

If the bank wrongly denies liability:

1. File at RBI CMS → Ombudsman complaint.
2. Cite the Master Direction zero-liability clause and your 3-day reporting proof.
3. File a consumer complaint at e-Daakhil for deficiency of service under CPA 2019 Section 2(11).

See RBI complaint against bank full process, what to do if the RBI Ombudsman rejects your complaint, and RBI ₹25,000 digital fraud compensation rules.

The Reserve Bank Integrated Ombudsman Scheme (RB-IOS) 2021 is a free, lawyer-free mechanism to resolve banking disputes including UPI AutoPay fraud.

Eligibility to file:

1. You must have first complained to the bank (Tier 1).
2. The bank did not resolve within 30 days, OR rejected your complaint, OR gave an unsatisfactory reply.

How to file:

1. Online: Visit cms.rbi.org.in (RBI Complaint Management System).
2. Phone: Call 14448 (RBI Ombudsman helpline, 9:30 AM–5:30 PM, weekdays).
3. Email: File via the CMS portal; it routes to the correct Ombudsman office.
4. In person: Visit the nearest RBI Ombudsman office (15+ cities across India).

What to include:

1. Bank complaint reference number and date.
2. UDIR reference number.
3. UMN, UTR/RRN of disputed debits.
4. Screenshots of the mandate, debits, and complaint correspondence.
5. Your bank account number (masked: XXXX1234).
6. Amount claimed (debited amount + compensation for mental agony, if any).

Jurisdiction and limits:

1. Pecuniary jurisdiction: up to ₹20 lakh (compensation) + ₹1 lakh (mental agony).
2. Filing fee: Free.
3. Decision timeline: Typically 30–60 days from filing.
4. Appeal: If dissatisfied, appeal to the Appellate Authority within 30 days.

If the Ombudsman closes your complaint unfavourably:

1. Appeal to the Appellate Authority (details in the Ombudsman's order).
2. File a consumer complaint at e-Daakhil.
3. File a writ petition under Article 226 of the Constitution in the High Court.
4. See our guide on next steps after Ombudsman rejection.

For step-by-step walkthroughs, see Banking Ombudsman complaint guide and RB-IOS 2021 walkthrough.

Not all UPI fraud is the same. The table below compares the most common UPI fraud types, their mechanics, and the correct complaint path for each.

For more on specific fraud types, see QR code scam recovery, SIM swap fraud recovery, scammed on UPI recovery steps, digital arrest scam, AI voice scam recovery, online payment fraud recovery, and recover money from UPI fraud 2026.

To, The Grievance Officer
[Bank Name]
[Date: DD-MM-2026]

Subject: Unauthorised UPI AutoPay debit on account [XXXX1234],
        UMN reference [paste UMN here], demand for reversal +
        mandate cancellation under RBI Master Direction 2017

Madam / Sir,

I write under Rule 3(2) of the IT (Intermediary) Rules 2021 and
the RBI Master Direction on Limiting Liability of Customers in
Unauthorised Electronic Transactions 2017 to report and dispute
the following debit:

Amount:        ₹__________ on DD-MM-2026 at HH:MM IST
UTR / RRN:     __________
Mandate UMN:   __________
Merchant:      __________ (per app description)

I did not authorise this AutoPay mandate. I have not used the
named merchant's services. I request:

  (a) Immediate revocation of the mandate within 24 hours.
  (b) Reversal of the disputed debit to my account within
      seven working days.
  (c) Investigation of how the mandate was created on my UPI
      ID and a written report of findings.
  (d) Confirmation in writing that my account is not enrolled
      in any other AutoPay mandate without my fresh consent.

I attach: bank statement, UPI app mandate screenshot, debit SMS,
mandate-creation SMS (if received).

I have separately filed UDIR reference no. _______ in my UPI app
and a complaint at cybercrime.gov.in vide _______.

If this is not resolved within 30 days, I shall escalate to the
RBI Banking Ombudsman under the Reserve Bank Integrated Ombudsman
Scheme 2021.

Yours sincerely,
[Name]
[Mobile registered with the bank]
[Email]

For service deficiency (bank failed to verify consent before creating the mandate, or merchant created mandate without consent), file at the District Consumer Disputes Redressal Commission via edaakhil.nic.in. Pecuniary jurisdiction up to ₹50 lakh. Filing fee ₹100. Median resolution six to twelve months. Claim a refund of the disputed debits, interest at 9 to 12 percent per annum from the debit date, compensation for mental agony (₹5,000 to ₹3 lakh depending on facts), and costs. Cite Indian Medical Association v. V.P. Shantha (1995) 6 SCC 651 for the principle that a paid service is a consumer service. Cite Pioneer Urban Land v. Govindan Raghavan (2019) 5 SCC 725 for the principle that consumer-court jurisdiction is concurrent with regulator jurisdiction. See e-Daakhil online filing guide and consumer court filing guide.

🟡 Do this immediately , Disable UPI auto-debit and reduce per-transaction limit to ₹1 the moment a financial dispute opens. Restoring later takes 24 hours; preventing further loss takes 30 seconds.

• NPCI UPI dispute redressal: npci.org.in → What we do → UPI → Dispute Redressal Mechanism
• RBI Master Direction on Limited Customer Liability (2017): rbi.org.in/Scripts/NotificationUser.aspx?Id=11418
• RBI Banking Ombudsman portal: cms.rbi.org.in · helpline 14448
• RBI Integrated Ombudsman Scheme 2021: rbi.org.in RB-IOS 2021 notification
• NCRP (cyber crime): cybercrime.gov.in · helpline 1930
• National Consumer Helpline: consumerhelpline.gov.in · helpline 1915
• DigiLocker (for any payment-related document): digilocker.gov.in
• e-Daakhil consumer court filing: edaakhil.nic.in
• RBI online RTI portal: rtionline.rbi.org.in
• Central RTI online portal: rtionline.gov.in

• 🔁 UPI AutoPay subscription debit cancel and refund guide
• 🔄 UPI AutoPay 2026: view and port mandates across apps
• 🔍 How to spot UPI mandate fraud
• 💸 UPI fraud recovery India
• 💰 Recover money from UPI fraud 2026
• 💳 UPI chargeback for wrong payment dispute 2026
• ⚡ UPI deducted but not received action plan
• 🏦 Banking Ombudsman complaint guide
• 📖 RB-IOS 2021 walkthrough
• 🏛️ RBI complaint against bank, full process
• 🚪 Next steps after RBI Ombudsman rejection
• ⚖️ RBI ₹25,000 digital fraud compensation rules
• 📋 RBI Integrated Ombudsman Scheme 2026
• 🚨 Cyber crime complaint guide
• 📝 File cybercrime complaint 2026
• 📞 1930 cyber fraud helpline script
• ⏱️ Golden hour zero-liability cyber fraud guide
• ❌ Bank refused zero-liability refund — what to do
• 📚 RTI Act 2005 complete guide
• 📝 How to file RTI online
• 🏦 Banking and insurance RTI
• 🔍 RTI for cybercrime complaint status
• 📦 RTI bundle for RBI/NPCI/bank fraud disputes
• 💳 Credit card chargeback guide
• 📋 NACH/ECS mandate cancellation guide
• 📋 RBI e-mandate 2026 rules
• ⚠️ Subscription auto-debit trap and cancellation
• 🧭 Which regulator to complain to
• 💸 Recover money sent to wrong bank account
• 🏦 Illegal bank charges recovery
• 📎 BSA Section 63 electronic evidence guide
• 🪄 AI RTI Drafter, free tool

• 🛡️ Weekend Problem Solver, 15 emergency topics hub
• 🛡️ Citizen Crisis Response Network, 100 guides

Login to RTI Wiki to download the printable PDF checklist for this article. A one-page summary covers: how to find every active mandate, the in-app UDIR steps, the bank nodal-officer template, the RBI 14448 escalation, and the e-Daakhil filing flow.

A UPI AutoPay mandate (also called eMandate) is a recurring-payment authorisation set up on your UPI ID. Once authorised once with your UPI PIN, the merchant can debit up to a pre-set amount on a fixed schedule (daily, weekly, monthly, yearly) without further OTP. Amounts up to ₹15,000 per debit are allowed without per-transaction OTP since the 2024 NPCI revision. See our UPI digital payments overview.

Open your UPI app and go to Profile → Manage AutoPay (Google Pay), Settings → Mandates (PhonePe), Profile → AutoPay (Paytm), or the equivalent on your bank's UPI app. Each app shows merchant, amount, frequency, and next debit date. You can also call your bank or check NetBanking → Bill Pay → Mandate Management. See how to view and port mandates across apps.

No. Every UPI mandate creation requires the user to enter UPI PIN on a screen that shows the merchant name, amount, and frequency. If a mandate exists that you did not authorise, possible causes are: a phishing screen captured your PIN, a family member used your phone, or a screen-sharing scam tricked you. Revoke and dispute immediately. See how to spot UPI mandate fraud.

In your UPI app, open the mandate, tap Revoke or Pause, and enter UPI PIN. The bank sends an SMS within minutes confirming cancellation. Save the SMS. If revoke fails, write to the bank's nodal officer and quote RBI Master Direction 2017. See the full cancellation and refund guide.

UDIR (UPI Dispute Resolution Initiative) is NPCI's standardised dispute system. Open your UPI app, go to Help → Raise Dispute, select the disputed debit, choose Unauthorised debit or AutoPay not authorised, and submit. Reference number is generated on screen. Resolution window is 30 days. Outcome is binding on the bank.

UPI does not offer a Visa-style chargeback. The equivalent path is UDIR + bank investigation under RBI Master Direction 2017. The Master Direction caps customer liability at zero if you report within 3 working days and the bank cannot prove customer negligence, ₹10,000 to ₹25,000 for delayed reporting (4 to 7 days), and full liability beyond 7 days. Move fast. See UPI chargeback for wrong payment dispute 2026.

Escalate to the RBI Banking Ombudsman under the Reserve Bank Integrated Ombudsman Scheme 2021 at cms.rbi.org.in or 14448. Free filing, no lawyer needed. The Ombudsman has accepted dozens of UPI AutoPay disputes since 2024 with binding orders. Time limit: file within one year of the bank's final reply. See what to do when a bank refuses a zero-liability refund and next steps after Ombudsman rejection.

• Never share UPI PIN. NPCI does not call asking for PIN.
• Audit your active mandates monthly. Most apps show a Manage AutoPay dashboard.
• Set per-transaction limit to ₹2,000 in the bank app for non-merchant UPI.
• Enable UPI Lite for small payments (lower exposure). See UPI Lite guide.
• Watch the screen carefully when creating any mandate. Verify merchant name and amount before entering PIN.
• Treat any screen sharing request from a stranger as fraud. See digital arrest scam guide.

Yes. Creating a mandate by deceptive means is cheating under BNS 2024 Section 318 (general cheating) and Section 66D of the IT Act 2000 (cheating by personation by computer resource). Penalty up to three years imprisonment plus fine. The bank's failure to verify consent can attract Consumer Protection Act 2019 Section 2(11) deficiency in service. See cyber crime complaint guide.

Yes. Under BNSS 2024 Section 173, any cognisable offence must be registered, regardless of amount. If the police refuse, file a complaint to the Magistrate Court under BNSS Section 175 for direction to register the FIR. The NCRP complaint at cybercrime.gov.in is the parallel digital path and is mandatory in most states for cyber-fraud cases. See FIR vs NCR vs complaint and cybercrime portal vs police station.

UPI AutoPay is set up via your UPI ID and authenticated with UPI PIN. Card e-mandates are set up with your card details and an initial OTP. Both allow recurring debits without per-transaction OTP up to ₹15,000 (per RBI rules). The dispute path differs: UPI AutoPay uses UDIR; card e-mandates use the chargeback mechanism of your card network (Visa/Mastercard/RuPay). See credit card chargeback guide and RBI e-mandate 2026 rules.

Yes. If your bank is a public-sector bank (SBI, PNB, Bank of Baroda, etc.) or you are querying the RBI, file under Section 6(1) of the RTI Act 2005. Ask for dispute volumes, resolution rates, and any advisories on mandate verification. File at rtionline.gov.in or rtionline.rbi.org.in. See RTI Act 2005 complete guide and banking and insurance RTI.

Typically 30–60 days from filing. The Ombudsman may extend this for complex cases. If the Ombudsman does not resolve within 3 months, you can treat it as a deemed rejection and appeal to the Appellate Authority or file in consumer court. See Banking Ombudsman complaint guide.

Since the 2024 NPCI revision, UPI AutoPay mandates can debit up to ₹15,000 per transaction without an additional OTP. You cannot reduce this threshold system-wide, but you can: (a) avoid creating any mandate, (b) set your bank's per-transaction UPI limit lower, or © use UPI Lite for small payments (max ₹2,000). See RBI e-mandate 2026 rules and UPI transaction limits.

Yes. The RBI Integrated Ombudsman Scheme 2021 covers all scheduled commercial banks, including private banks (HDFC, ICICI, Axis, Kotak). File at cms.rbi.org.in after the bank has had 30 days to resolve your complaint. See Banking Ombudsman guide.

Yes. This is a service-deficiency dispute rather than a fraud dispute. File a UDIR dispute selecting Service not received or Amount mismatch. If the merchant does not resolve, escalate to consumer court under CPA 2019 Section 35. See consumer court filing guide and e-Daakhil filing guide.

1. Immediately disconnect the call.
2. Uninstall the screen-sharing app (AnyDesk, TeamViewer, etc.).
3. Change your UPI PIN and net banking password from a different device if possible.
4. Lock UPI in your bank app (Profile → Block UPI ID).
5. Check all mandates and revoke any you do not recognise.
6. File at cybercrime.gov.in or call 1930.
7. See digital arrest scam and SIM swap fraud recovery.

Yes: 1930 (cybercrime helpline — call within the golden hour to freeze the fraudulent account), 14448 (RBI Banking Ombudsman — for bank-level disputes), and 1915 (National Consumer Helpline — for merchant disputes). See 1930 helpline script and golden hour guide.

A UPI AutoPay mandate is a powerful convenience and a known fraud surface. The defence is monthly audit of your active mandates, careful reading of every consent screen before you enter UPI PIN, and a 10-minute first-response drill if a suspicious debit appears. The Citizen Crisis Response Network exists to compress that response into the window where 60 to 80 percent of money is recoverable. Save 14448 and 1930 in your contacts. Bookmark this guide. Share it with anyone in your family who uses UPI for subscriptions or recurring bills.

UPI AutoPay mandate fraud India — complete guide on identifying, stopping, and recovering unauthorized UPI AutoPay debits:

1. Step 1: What is UPI AutoPay? (a) the UPI AutoPay — is a recurring payment feature — launched by the NPCI (National Payments Corporation of India) — that allows the automatic debit — from the UPI-linked bank account — for the subscriptions — and the recurring payments, (b) the UPI AutoPay — is used for: (i) the OTT subscriptions — (Netflix, Amazon Prime, Disney+ Hotstar), (ii) the utility bills — (electricity, water, gas), (iii) the insurance premiums, (iv) the loan EMIs, (v) the mutual fund SIPs, © the mandate: (i) the user — creates the mandate — by approving the auto-debit — through the UPI app, (ii) the mandate — specifies: (a) the amount — (fixed or variable — up to a maximum), (b) the frequency — (daily, weekly, monthly), © the duration — (the start and end date), (d) the merchant — (the name and the UPI ID), (iii) the mandate — is registered — with the bank — and the NPCI — and the debit — is automatic — on the scheduled date.
2. Step 2: What is UPI AutoPay mandate fraud? (a) the UPI AutoPay mandate fraud — is a fraud — where the scammer — creates the unauthorized mandate — on the victim's UPI account — and the money — is auto-debited — without the victim's knowledge — or consent, (b) the fraud — works as follows: (i) the scammer — sends a link — or a QR code — or a UPI collect request — to the victim — pretending to be: (a) a merchant — offering a discount — or a cashback, (b) a government scheme — or a subsidy, © a job offer — or a registration, (ii) the victim — approves the mandate — thinking it is a one-time payment — but it is a recurring mandate, (iii) the money — is auto-debited — every month — or every week — until the mandate — is revoked, © the common fraud scenarios: (a) the fake merchant — creates the mandate — for Rs 1 — and the victim — approves — and the mandate — is for Rs 5,000 per month, (b) the scammer — creates the multiple mandates — on the same account — and the debits — are small — and unnoticed, © the mandate — is created — through the phishing link — and the victim — does not know — that the mandate — is created.
3. Step 3: How to identify UPI AutoPay mandate fraud. (a) check the bank statement: (i) check the bank statement — for the recurring debits — with the description — “UPI AutoPay” — or the merchant name, (ii) the debits — that you do not recognize — are the fraud, (b) check the UPI app: (i) open the UPI app — (GPay, PhonePe, Paytm) — and go to “Mandates” — or “AutoPay” — or “Recurring Payments”, (ii) check the active mandates — and the unauthorized mandates — are the fraud, © check the SMS: (i) the bank — sends the SMS — for each AutoPay debit — and the unauthorized debits — are the fraud, (ii) the NPCI — sends the mandate confirmation SMS — and the unauthorized mandate — is the fraud, (d) the common signs: (a) the small debits — Rs 10-500 — every month — that you do not recognize, (b) the mandate — with the unknown merchant name, © the mandate — that you do not remember — approving.
4. Step 4: How to stop UPI AutoPay mandate fraud. (a) Step 1 — revoke the mandate: (i) open the UPI app — (GPay, PhonePe, Paytm) — and go to “Mandates” — or “AutoPay”, (ii) select the unauthorized mandate — and click “Revoke” — or “Cancel” — or “Pause”, (iii) the mandate — is revoked — and the future debits — are stopped, (b) Step 2 — contact the bank: (i) call the bank — and report the unauthorized mandate — and the debits, (ii) the bank — can block the mandate — and the UPI — on the account — if needed, © Step 3 — block the UPI: (i) if the fraud — is extensive — block the UPI — on the account — by calling the bank — or the NPCI — at 1800-208-9333, (ii) the UPI — is blocked — and no debits — are possible — until the unblock, (d) Step 4 — file a complaint: (i) file a complaint — on the National Cyber Crime portal — cybercrime.gov.in — or call 1930, (ii) the complaint — is filed — for the fraud — and the investigation — is started, (e) Step 5 — request the chargeback: (i) contact the bank — and request the chargeback — for the unauthorized debits, (ii) the bank — can initiate the chargeback — through the NPCI — and the merchant's bank.
5. Step 5: How to recover the money. (a) the chargeback: (i) the bank — can initiate the chargeback — for the unauthorized debits — through the NPCI, (ii) the chargeback — is initiated — if the mandate — is unauthorized — and the complaint — is filed — within the time, (b) the cyber crime: (i) the cyber crime — can trace the merchant — and the bank account — and freeze the amount, (ii) the recovery — depends on the speed — of the complaint — and the trace, © the RBI Ombudsman: (i) if the bank — does not cooperate — approach the Banking Ombudsman — on the RBI portal, (ii) the Ombudsman — can order the bank — to refund the unauthorized debits, (d) the timeline: (i) the chargeback — is processed — within 30-90 days, (ii) the cyber crime — recovery — takes 3-12 months.
6. Step 6: File RTI on UPI AutoPay mandate fraud. File RTI with the NPCI (or the bank — or the RBI) asking for: (a) the mandate: “Provide the mandate details — for the UPI ID [number] — including: (i) the mandate — active and the revoked, (ii) the merchant name — and the UPI ID, (iii) the amount — and the frequency, (iv) the creation date — and the approval — details”, (b) the debits: “Provide the debit details — for the account [number] — under the UPI AutoPay — for the period [date] to [date] — including: (i) the debit — date and the amount, (ii) the merchant — and the UPI ID, (iii) the mandate — reference number”, © the complaint: “Provide the complaint status — for the complaint — filed on [date] — reference number [number] — including: (i) the complaint details, (ii) the action taken, (iii) the recovery — if any”, (d) the statistics: “Provide the statistics — of the UPI AutoPay fraud — for the period [date] to [date] — including: (i) the number of complaints, (ii) the amount — lost — and recovered, (iii) the common merchants — involved in the fraud”.
7. Step 7: Practical tips. (a) check the mandates regularly (check the mandates — on the UPI app — regularly — and revoke the unauthorized — immediately), (b) do not approve the unknown (do not approve the mandate — from the unknown merchant — or the link — or the QR code), © check the statement (check the bank statement — for the recurring debits — and the unauthorized debits — are the fraud), (d) file the complaint early (file the complaint — on the cyber crime portal — immediately — for the faster recovery), (e) revoke and block (revoke the mandate — and block the UPI — if the fraud — is extensive), (f) Example: A victim — noticed the recurring debits — of Rs 299 per month — on the bank statement — he checked the UPI app — and found — that a mandate — was created — for an unknown merchant — he revoked the mandate — and filed a complaint — on the cyber crime portal — and requested the chargeback — through the bank — the bank — initiated the chargeback — and the amount — of Rs 1,495 — (for 5 months) — was refunded — within 60 days — and the merchant — was traced — by the cyber crime.

See UPI AutoPay Fraud and WhatsApp OTP Fraud.