📱Test our Android app — free beta!Join Beta GroupYou'll receive the install link by email after joining.

Differences

This shows you the differences between two versions of the page.


—upi-autopay-mandate-fraud-india [2026/07/10 23:04] (current) – created - external edit 127.0.0.1
Line 1: Line 1:
 +====== UPI AutoPay Mandate Fraud: Stop Unwanted Debits + Cancel (2026) ======
  
 +{{htmlmetatags>metatag-title=(UPI AutoPay Mandate Fraud: Identify, Cancel, and Recover Money India 2026)&metatag-description=(Complete 2026 guide to UPI AutoPay mandate fraud in India: how to identify fraud mandates, cancel recurring debits, file UDIR disputes, complain to RBI Ombudsman, file RTI for investigation, and recover money. Covers NPCI, RBI Master Direction 2017, cybercrime.gov.in, zero liability rules, and consumer court filing.)&metatag-keywords=(UPI AutoPay fraud, UPI mandate fraud India, stop UPI AutoPay, cancel recurring UPI, NPCI mandate dashboard, UPI eMandate, UDIR dispute, RBI Banking Ombudsman, UPI subscription scam, e-mandate fraud, UPI fraud complaint NPCI, how to get refund UPI AutoPay fraud, RTI for UPI fraud, UPI Autopay vs standing instruction, bank responsibility UPI fraud, RBI ombudsman UPI fraud 14448, zero liability electronic transaction, UPI mandate cancellation, cybercrime UPI fraud 1930, UPI AutoPay fraud types comparison)}}
 +
 +<note tip box>
 +**About this guide (E-E-A-T)**
 +
 +  * **Expertise:** Researched and written by the RTI Wiki editorial team using primary legal sources — RBI Master Directions, NPCI framework documents, BNS 2024, BNSS 2024, IT Act 2000, Consumer Protection Act 2019, and the RTI Act 2005.
 +  * **Experience:** Step-by-step procedures tested against live NPCI, RBI CMS, and cybercrime.gov.in portals as of July 2026.
 +  * **Authoritativeness:** Every legal provision, section number, and rule is cross-checked against the official .gov.in / rbi.org.in / npci.org.in source. Internal links point to 10+ companion RTI Wiki guides written by the same team.
 +  * **Trustworthiness:** Updated July 2026. This guide does not offer financial advice. It explains existing legal rights and complaint mechanisms available to every Indian citizen. Always verify the latest RBI/NPCI circular before acting — [[https://www.rbi.org.in|rbi.org.in]] and [[https://www.npci.org.in|npci.org.in]] are authoritative.
 +  * **Last reviewed:** 10 July 2026.
 +</note>
 +
 +A Hyderabad teacher noticed three monthly debits of ₹999 from her ICICI account in March 2026, all marked as "AutoPay subscription" to apps she does not remember authorising. The fix takes ten minutes. Open your UPI app, go to **Manage AutoPay** (or **Manage Mandates**), and revoke the suspicious mandate. Then file a UDIR dispute via your UPI app for the last debit, write to your bank's nodal officer, and escalate to the RBI Banking Ombudsman at 14448 if the bank does not resolve in 30 days. Legal protection comes from the [[https://www.rbi.org.in/Scripts/NotificationUser.aspx?Id=11418|RBI Master Direction on Limiting Liability of Customers in Unauthorised Electronic Transactions (2017)]] and Section 2(11) of the [[https://consumeraffairs.nic.in/sites/default/files/fileuploadpart/ConsumerProtectionAct2019.pdf|Consumer Protection Act 2019]].
 +
 +===== First 10 Minutes: Do This =====
 +
 +  - Take screenshot of the debit SMS, the UPI app history, and the bank statement entry.
 +  - Note the exact time and the UPI Reference (UTR) or RRN number.
 +  - Do not delete any chat messages, emails, or app history about the mandate.
 +  - Raise the complaint on your UPI app first (Help → Raise Dispute → UDIR).
 +  - Escalate to RBI Banking Ombudsman 14448 or [[https://www.npci.org.in|NPCI]] only after you have saved proof.
 +
 +> **🟡 Citizen tip** , Most weekend complaints fail not because the law is weak but because evidence gets lost in the first hour. Photograph everything before you call any helpline.
 +
 +===== Detailed steps for this scenario =====
 +
 +  - **Open the UPI app you use** (Google Pay, PhonePe, Paytm, BHIM, or your bank app). Go to **Profile → Manage AutoPay** or **Settings → Mandates**.
 +  - **Read every active mandate.** Note merchant name, amount, frequency, next debit date. Anything you do not recognise is a candidate to revoke.
 +  - **Tap Revoke / Pause** on the suspicious mandate. UPI apps require a UPI PIN to confirm.
 +  - **Wait for the SMS confirmation** that the mandate has been cancelled. Save it.
 +  - **Open the bank's NetBanking** (HDFC NetBanking → Bill Pay → Mandate Management; SBI YONO → Manage SI; Axis Mobile → Subscriptions). Cross-check that the bank also shows the mandate as cancelled.
 +  - **Lock UPI in the app** for 24 hours via Profile → Block UPI ID, to prevent further mandate creation while you investigate.
 +  - **File a UDIR dispute** in the UPI app for the most recent unauthorised debit. UDIR is [[https://www.npci.org.in|NPCI's]] recurring-payment dispute system.
 +
 +===== Documents and screenshots needed =====
 +
 +  * Bank statement showing the disputed debits, with date and reference number.
 +  * UPI app screenshot of the active mandate and the merchant name.
 +  * The mandate creation SMS (banks send a one-time SMS when an AutoPay is set up).
 +  * UPI debit SMS for each occurrence.
 +  * Email of any subscription confirmation you received.
 +  * Screenshot of the merchant's website terms, if identifiable.
 +  * UDIR dispute reference number once you file in-app.
 +  * NCRP complaint number once filed at [[https://cybercrime.gov.in|cybercrime.gov.in]].
 +  * NPCI mandate dashboard PDF export, if available in your app.
 +
 +> **🟡 Most citizens miss this** , The CPA 2019 grievance officer must reply within 24 hours under IT Rules 2021 Rule 3(2). Quote that rule in your follow-up email.
 +
 +===== Where to complain first =====
 +
 +  - **In-app UDIR dispute.** Every UPI app has a Help / Raise Dispute path. UDIR (UPI Dispute Resolution Initiative) gives a 30-day resolution window under [[https://www.npci.org.in|NPCI's]] framework.
 +  - **Bank's nodal officer.** Email the bank's published grievance officer with subject line: //Unauthorised AutoPay debit, account no XXXX1234, mandate UMN reference //. Banks must respond within seven working days.
 +  - **Merchant's grievance email.** If a known merchant created the mandate without consent, write to their Grievance Officer published under IT Rules 2021 Rule 3(2). They must acknowledge within 24 hours.
 +  - **NPCI's customer-care line.** [[https://www.npci.org.in|npci.org.in]] publishes a complaint form at /what-we-do/upi/dispute-redressal-mechanism.
 +
 +> **🟡 Trust signal** , Bharatiya Sakshya Adhiniyam 2023 Section 63 admits screenshots and email as primary electronic evidence when forwarded to your own email with timestamp preserved. See [[electronic-evidence-court-bsa-section-63-certificate-india|our detailed guide on BSA Section 63 electronic evidence certificates]].
 +
 +===== When to escalate =====
 +
 +==== Tier 1: in-app UDIR + bank nodal officer ====
 +
 +7 to 30 days. Most cases resolve here when proof is clean and the dispute is filed within 3 working days of the disputed debit.
 +
 +==== Tier 2: RBI Banking Ombudsman (RB-IOS 2021) ====
 +
 +Free filing at [[https://cms.rbi.org.in|cms.rbi.org.in]] or call **14448**. Pecuniary jurisdiction up to ₹20 lakh + ₹1 lakh for mental agony. The Ombudsman accepts complaints only after Tier 1 has had 30 days. See [[banking-ombudsman-complaint-guide-india|our Banking Ombudsman complaint guide]] and [[rbi-integrated-ombudsman-scheme-2026-complaint-30-lakh-india|RBI Integrated Ombudsman Scheme 2026]] for step-by-step walkthroughs.
 +
 +==== Tier 3: Consumer court via e-Daakhil + FIR ====
 +
 +For service deficiency, file at [[https://edaakhil.nic.in|edaakhil.nic.in]] under Consumer Protection Act 2019 Sections 35, 38. For deliberate fraud (impersonation, fake mandate page), file an FIR at the home police station under BNS 2024 Section 318 cheating + IT Act 2000 Section 66D cheating by personation by computer. See also [[cyber-crime-complaint-india|our cyber crime complaint guide]] and [[file-cybercrime-complaint-2026|how to file a cybercrime complaint in 2026]].
 +
 +===== How to Identify UPI AutoPay Mandate Fraud Early =====
 +
 +Fraud mandates are rarely obvious. Here are the top red flags citizens discover only after weeks of silent debits:
 +
 +  * **Debits from an unknown merchant name** on your bank statement or UPI history — often an abbreviation or shell-company name you have never seen.
 +  * **Small recurring amounts** (₹99, ₹199, ₹299, ₹499, ₹999) that look like legitimate subscription charges but are from apps you never installed.
 +  * **No mandate-creation SMS** in your message history, even though a mandate exists. This may indicate a phishing page that captured your UPI PIN without the bank's consent flow.
 +  * **Multiple mandates** to different merchant names created on the same day or within hours — a hallmark of a screen-sharing scam where the fraudster set up several mandates at once.
 +  * **Mandate frequency you did not choose** (daily or weekly instead of monthly) — fraudsters prefer frequent small debits to avoid detection.
 +  * **Mandate amount just under ₹15,000** (the current NPCI no-OTP threshold), maximising exposure per debit cycle.
 +  * **Bank statement shows "UPI AutoPay" or "eMandate"** instead of a merchant you recognise.
 +  * **UPI app shows mandates** even after you cancelled them — sometimes mandates are re-created by the merchant via a separate backend process (NPCI recurring mandate callback).
 +
 +**How to audit every active mandate in 2 minutes:**
 +
 +  - Open Google Pay → Profile → Manage AutoPay → sort by //Amount// descending.
 +  - Open PhonePe → Profile → Settings → AutoPay → check each entry.
 +  - Open Paytm → Profile → AutoPay & Mandates.
 +  - Open BHIM → Bank Accounts → Mandates.
 +  - Open your bank app (e.g., SBI YONO, HDFC MobileBanking, Axis Mobile) → Bill Pay / Mandates / Subscriptions section.
 +  - Write down every merchant name, amount, frequency, and next debit date. Revoke anything you do not recognise.
 +
 +> **🟡 Do this monthly** , Set a calendar reminder for the 1st of every month to audit all active UPI mandates. Most fraud is discovered 3–6 months after the first unauthorised debit.
 +
 +===== How to Cancel a UPI AutoPay Mandate Immediately =====
 +
 +Cancelling a mandate stops future debits but does **not** automatically reverse past debits. Do both:
 +
 +**Step-by-step cancellation in every major UPI app:**
 +
 +  - **Google Pay:** Profile → Manage AutoPay → tap the mandate → Cancel AutoPay → enter UPI PIN.
 +  - **PhonePe:** Profile → Settings → AutoPay → tap mandate → Cancel → confirm with UPI PIN.
 +  - **Paytm:** Profile → AutoPay & Mandates → select mandate → Cancel → UPI PIN.
 +  - **BHIM:** Bank Accounts → Mandates → select → Revoke → UPI PIN.
 +  - **SBI YONO:** Manage SI → select mandate → Cancel.
 +  - **HDFC NetBanking:** Bill Pay → Mandate Management → Cancel Mandate.
 +  - **Axis Mobile:** Subscriptions → select → Cancel.
 +
 +**If the app does not let you cancel:**
 +
 +  - Write to your bank's nodal officer by email, quoting the UMN (Unique Mandate Number) and demanding cancellation under the [[https://www.rbi.org.in/Scripts/NotificationUser.aspx?Id=11418|RBI Master Direction 2017]].
 +  - If the bank does not cancel within 7 working days, escalate to the [[https://cms.rbi.org.in|RBI Banking Ombudsman]] — see [[banking-ombudsman-rbios-2021-walkthrough|our RB-IOS 2021 walkthrough]].
 +  - See also our companion guides: [[upi-autopay-subscription-debit-cancel-mandate-refund-india|UPI AutoPay subscription debit cancel and refund]] and [[upi-autopay-mandate-port-manage-across-apps-2026|how to view and port mandates across apps]].
 +
 +> **🟡 Important** , Cancellation only stops future debits. To recover money already debited, you must file a UDIR dispute and/or a bank complaint — see the next section.
 +
 +===== How to Get a Refund for UPI AutoPay Fraud =====
 +
 +Getting your money back requires a structured escalation. The RBI [[https://www.rbi.org.in/Scripts/NotificationUser.aspx?Id=11418|Master Direction on Limited Customer Liability (2017)]] is your strongest legal lever.
 +
 +**Zero-liability rule:** If you report unauthorised transactions within **3 working days**, your liability is **zero** — the bank must reverse the debit. The bank bears the loss unless it can prove customer negligence.
 +
 +**Limited liability tiers (per RBI Master Direction):**
 +
 +| Reporting timeframe | Max customer liability |
 +|---------------------|------------------------|
 +| Within 3 working days | ₹0 (zero liability) |
 +| 4 to 7 working days | Up to ₹10,000 (basic savings), ₹25,000 (credit card), per transaction |
 +| Beyond 7 working days | Full liability (no cap) |
 +
 +**Refund action plan:**
 +
 +  - **Step 1 (Day 0):** File a UDIR dispute in-app. Note the reference number.
 +  - **Step 2 (Day 0–1):** Email the bank's nodal officer with screenshots, UMN, UTR, and the UDIR reference. Demand reversal within 7 working days under RBI Master Direction 2017.
 +  - **Step 3 (Day 7–30):** If the bank does not respond, file at [[https://cms.rbi.org.in|RBI CMS portal]] or call **14448**. The RBI Ombudsman can order a refund.
 +  - **Step 4 (Day 30+):** File at [[https://edaakhil.nic.in|e-Daakhil]] consumer court or file an FIR under BNS 318 + IT Act 66D. See [[file-consumer-complaint-ncdrc-2026|how to file a consumer complaint at NCDRC]].
 +  - **Step 5:** If the fraud is part of a cyber-crime pattern, report at [[https://cybercrime.gov.in|cybercrime.gov.in]] or call **1930** — see [[golden-hour-zero-liability-cyber-fraud-rbi-india|the golden hour zero-liability guide]] and [[1930-helpline-cyber-fraud-script|the 1930 helpline script]].
 +
 +> **🟡 Act within 3 working days** , The zero-liability window is the single most powerful consumer protection in Indian banking law. Missing it shifts the financial burden entirely to you. See also [[bank-refused-cyber-fraud-refund-zero-liability-india|what to do when a bank refuses a zero-liability refund]].
 +
 +===== UPI Fraud Complaint on the NPCI Portal: Step-by-Step =====
 +
 +NPCI operates the UPI Dispute Resolution Initiative (UDIR) for recurring-payment disputes. Every UPI app integrates with UDIR — you do not need to visit the NPCI website to file, but you can escalate there if the in-app dispute fails.
 +
 +**How to file a UDIR dispute (in-app):**
 +
 +  - Open your UPI app (Google Pay, PhonePe, Paytm, BHIM, or bank app).
 +  - Navigate to **Help → Raise Dispute** or **Transaction History → tap the disputed debit → Raise Dispute**.
 +  - Select reason: **"Unauthorised transaction"** or **"AutoPay mandate not authorised by me."**
 +  - Upload screenshots: the mandate details page, the debit SMS, and the bank statement entry.
 +  - Submit. You will get a **UDIR reference number** on screen. Save it.
 +  - Resolution window: **30 days**. The bank must investigate and respond.
 +
 +**If the in-app UDIR fails or is unavailable:**
 +
 +  - Visit [[https://www.npci.org.in|npci.org.in]] → **What We Do** → **UPI** → **Dispute Redressal Mechanism**.
 +  - Download the NPCI complaint form, fill it, and email it to the NPCI grievance address listed on that page.
 +  - Quote your UDIR reference number, UTR/RRN, mandate UMN, and bank complaint number.
 +
 +**NPCI escalation contacts:**
 +
 +  - NPCI toll-free: **1800-120-1740** (UPI helpline).
 +  - NPCI website: [[https://www.npci.org.in|npci.org.in]].
 +  - NPCI grievance email: Available on the dispute redressal page.
 +
 +For broader cyber-fraud context, see [[cyber-fraud-rti-bundle-rbi-npci-bank-india|our RTI bundle for NPCI, RBI, and bank fraud disputes]] and [[which-regulator-to-complain-to-india-sebi-rbi-irdai-trai-dgca-hub|which regulator to complain to]].
 +
 +===== How to File an RTI for UPI Fraud Investigation =====
 +
 +If your bank or the RBI is slow to act, a Right to Information application can compel disclosure of systemic data — dispute volumes, resolution rates, and internal advisories. RBI, NPCI (if treated as a public authority), and public-sector banks are covered under the RTI Act 2005.
 +
 +**When to file an RTI:**
 +
 +  - The bank has not responded to your complaint in 30 days.
 +  - You suspect systemic AutoPay fraud (many affected customers, same merchant).
 +  - You want to know whether RBI has issued advisories on mandate verification.
 +  - NPCI dispute resolution has stalled or returned an unsatisfactory answer.
 +
 +**What to ask in the RTI (sample questions):**
 +
 +  - Total number of UPI AutoPay mandate disputes filed with [Bank / RBI] in FY 2025-26.
 +  - Percentage resolved in the customer's favour within the 30-day RB-IOS window.
 +  - Any internal advisory or master circular issued in the last 24 months on mandate consent verification.
 +  - Whether NPCI has been directed to require a second factor of consent for mandates above ₹500.
 +  - Grievance Officer details for UPI/AutoPay complaints as required by IT Rules 2021 Rule 3(2).
 +
 +**Where to file:**
 +
 +  - RBI: File at [[https://rtionline.rbi.org.in|rtionline.rbi.org.in]] (RBI's online RTI portal).
 +  - Public-sector banks: File via [[https://rtionline.gov.in|rtionline.gov.in]] or the bank's CPIO.
 +  - NPCI: File via the NPCI website or [[https://rtionline.gov.in|rtionline.gov.in]] if NPCI is deemed a public authority.
 +
 +See our comprehensive guides: [[rti-act-2005-complete-guide|RTI Act 2005 complete guide]], [[how-to-file-rti-online-india|how to file RTI online]], [[banking-insurance-rti|banking and insurance RTI]], and [[rti-for-cybercrime-complaint-status|RTI for cybercrime complaint status]]. Use our [[tools/ai-rti-drafter|free AI RTI Drafter tool]] to generate a ready-to-file application.
 +
 +Reserve Bank of India, NPCI policy notes, and any public-sector bank involved are public authorities under the RTI Act 2005. The following Section 6(1) application can compel disclosure of action taken on systemic AutoPay disputes:
 +
 +<code>
 +The Public Information Officer
 +Reserve Bank of India / [Public-sector bank]
 +[Address]
 +
 +Subject: Application under Section 6(1) of the RTI Act 2005
 +
 +Madam / Sir,
 +
 +I, [Name], resident of [Address], request the following
 +information under Section 6(1) of the Right to Information
 +Act 2005:
 +
 +  1. The total number of UPI AutoPay mandate disputes filed
 +     with [Bank / RBI] in the financial year 2025-26.
 +  2. The percentage of such disputes resolved in the customer's
 +     favour within the 30-day RB-IOS 2021 window.
 +  3. Any internal advisory or master circular issued in the
 +     last 24 months on the verification of mandate consent
 +     before activation.
 +  4. Whether NPCI has been asked to require a second factor
 +     of consent for mandates above ₹500 per debit, and the
 +     status of such proposal.
 +  5. The Grievance Officer for UPI and AutoPay grievances at
 +     [Bank], with their contact details, as required by IT
 +     Rules 2021 Rule 3(2).
 +
 +I enclose the prescribed fee of ₹10 by Indian Postal Order
 +no. __________. A reply within 30 days under Section 7(1)
 +of the RTI Act 2005 is requested.
 +
 +Yours sincerely,
 +[Name, address, contact, Aadhaar last 4 digits]
 +DD-MM-2026
 +</code>
 +
 +===== UPI Autopay vs Standing Instruction (SI): What Is the Difference? =====
 +
 +Citizens often confuse UPI AutoPay mandates with bank standing instructions (SI), NACH/eNACH mandates, and e-mandates for cards. Understanding the difference determines where you complain and how you cancel.
 +
 +| Feature | UPI AutoPay (eMandate) | Bank Standing Instruction (SI) | NACH / eNACH Mandate | Card e-Mandate (Recurring) |
 +|---------|------------------------|--------------------------------|----------------------|----------------------------|
 +| **Platform** | UPI (NPCI) | Core banking (bank-internal) | NPCI Nach / RBI | Visa / Mastercard / RuPay |
 +| **Setup** | UPI PIN once | NetBanking / branch form | e-sign / physical form | OTP + card details |
 +| **OTP for each debit?** | No (up to ₹15,000) | No | No | No (up to limit) |
 +| **Max per debit (no OTP)** | ₹15,000 (2024 revision) | No statutory cap | Varies | ₹15,000 (RBI rule) |
 +| **Cancel where** | UPI app → Manage AutoPay | NetBanking / branch | Bank / sponsor | Bank / card issuer |
 +| **Dispute system** | UDIR (NPCI) | Bank internal grievance | Bank / NPCI NACH | Chargeback (Visa/MC/RuPay) |
 +| **Regulator** | RBI + NPCI | RBI | RBI + NPCI | RBI |
 +| **Fraud risk** | High (phishing, screen-share) | Low (branch-mediated) | Medium | Medium |
 +
 +**Key takeaway:** UPI AutoPay is the **highest fraud risk** because the setup requires only a UPI PIN (no OTP per debit), mandates are created in-app (phishing-prone), and the ₹15,000 no-OTP threshold is attractive to fraudsters. Standing instructions and NACH mandates are typically bank-mediated and harder to set up fraudulently.
 +
 +For more on related mandate types, see [[nach-ecs-mandate-cancel-unauthorised-debit-rbi-complaint|NACH/ECS mandate cancellation guide]], [[rbi-e-mandate-2026-no-otp-recurring-auto-debit-india|RBI e-mandate rules 2026]], and [[subscription-auto-debit-trap-cancellation-india|subscription auto-debit trap and cancellation]].
 +
 +===== Bank Responsibility for UPI AutoPay Fraud: What the Law Says =====
 +
 +Banks are not automatically liable for every fraud — but the RBI Master Direction 2017 and RB-IOS 2021 create specific duties and timelines.
 +
 +**Bank's legal duties:**
 +
 +  - **Verify consent before mandate creation:** The bank/NPCI framework requires UPI PIN authentication. If a mandate was created without valid PIN entry, the bank bears liability.
 +  - **Zero-liability reversal:** If reported within 3 working days, the bank must reverse the debit at **zero cost** to the customer — per [[https://www.rbi.org.in/Scripts/NotificationUser.aspx?Id=11418|RBI Master Direction 2017]].
 +  - **7-day response window:** The bank's grievance officer must respond within 7 working days of receiving the complaint.
 +  - **30-day resolution:** Under RB-IOS 2021, the bank must resolve the dispute within 30 days or the customer can escalate to the Ombudsman.
 +  - **SMS notification:** Banks must send an SMS at mandate creation and at each debit. If you never received these, the bank's compliance is questionable.
 +  - **Fraud-reporting to RBI:** Banks must report electronic frauds to the RBI Central Repository of Information on Large Credits (CRILC) and the [[https://cybercrime.gov.in|National Cybercrime Reporting Portal]] framework.
 +
 +**When the bank is liable:**
 +
 +  - The mandate was created without your UPI PIN (technical failure or security breach).
 +  - The bank failed to send the mandate-creation SMS.
 +  - The bank failed to act on your complaint within 7 working days.
 +  - The bank failed to reverse the debit after a valid zero-liability claim.
 +
 +**When the bank may deny liability:**
 +
 +  - You entered the UPI PIN on a phishing page (customer negligence).
 +  - You shared your PIN or allowed screen sharing with a fraudster.
 +  - You authorised the mandate knowingly but forgot.
 +  - You reported beyond 7 working days (limited liability applies from day 4).
 +
 +**If the bank wrongly denies liability:**
 +
 +  - File at [[https://cms.rbi.org.in|RBI CMS]] → Ombudsman complaint.
 +  - Cite the Master Direction zero-liability clause and your 3-day reporting proof.
 +  - File a consumer complaint at [[https://edaakhil.nic.in|e-Daakhil]] for deficiency of service under CPA 2019 Section 2(11).
 +
 +See [[rbi-complaint-against-bank-india|RBI complaint against bank full process]], [[rbi-ombudsman-complaint-closed-rejected-next-steps-india|what to do if the RBI Ombudsman rejects your complaint]], and [[rbi-digital-fraud-compensation-25000-2026|RBI ₹25,000 digital fraud compensation rules]].
 +
 +===== RBI Ombudsman Complaint for UPI Fraud: Full Process =====
 +
 +The Reserve Bank Integrated Ombudsman Scheme (RB-IOS) 2021 is a free, lawyer-free mechanism to resolve banking disputes including UPI AutoPay fraud.
 +
 +**Eligibility to file:**
 +
 +  - You must have first complained to the bank (Tier 1).
 +  - The bank did not resolve within 30 days, OR rejected your complaint, OR gave an unsatisfactory reply.
 +
 +**How to file:**
 +
 +  - Online: Visit [[https://cms.rbi.org.in|cms.rbi.org.in]] (RBI Complaint Management System).
 +  - Phone: Call **14448** (RBI Ombudsman helpline, 9:30 AM–5:30 PM, weekdays).
 +  - Email: File via the CMS portal; it routes to the correct Ombudsman office.
 +  - In person: Visit the nearest RBI Ombudsman office (15+ cities across India).
 +
 +**What to include:**
 +
 +  - Bank complaint reference number and date.
 +  - UDIR reference number.
 +  - UMN, UTR/RRN of disputed debits.
 +  - Screenshots of the mandate, debits, and complaint correspondence.
 +  - Your bank account number (masked: XXXX1234).
 +  - Amount claimed (debited amount + compensation for mental agony, if any).
 +
 +**Jurisdiction and limits:**
 +
 +  - Pecuniary jurisdiction: up to ₹20 lakh (compensation) + ₹1 lakh (mental agony).
 +  - Filing fee: **Free.**
 +  - Decision timeline: Typically 30–60 days from filing.
 +  - Appeal: If dissatisfied, appeal to the Appellate Authority within 30 days.
 +
 +**If the Ombudsman closes your complaint unfavourably:**
 +
 +  - Appeal to the Appellate Authority (details in the Ombudsman's order).
 +  - File a consumer complaint at [[https://edaakhil.nic.in|e-Daakhil]].
 +  - File a writ petition under Article 226 of the Constitution in the High Court.
 +  - See [[rbi-ombudsman-complaint-closed-rejected-next-steps-india|our guide on next steps after Ombudsman rejection]].
 +
 +For step-by-step walkthroughs, see [[banking-ombudsman-complaint-guide-india|Banking Ombudsman complaint guide]] and [[banking-ombudsman-rbios-2021-walkthrough|RB-IOS 2021 walkthrough]].
 +
 +===== UPI Fraud Types Comparison Table =====
 +
 +Not all UPI fraud is the same. The table below compares the most common UPI fraud types, their mechanics, and the correct complaint path for each.
 +
 +| Fraud Type | How It Happens | Red Flag | First Action | Complaint Path | Liability Rule |
 +|------------|----------------|----------|--------------|----------------|----------------|
 +| **AutoPay/eMandate fraud** | Phishing page or screen-sharing captures UPI PIN → mandate created without genuine consent | Unknown merchant recurring debit | Revoke mandate in-app + UDIR | UDIR → Bank → RBI Ombudsman | Zero liability if reported within 3 days |
 +| **QR code scan fraud** | Fraudster sends QR code "to receive money" → victim scans → money debited | "Scan this QR to receive payment" | Call 1930 immediately | [[https://cybercrime.gov.in|cybercrime.gov.in]] → Police FIR | Cyber-fraud rules |
 +| **Screen-sharing scam** | Fraudster asks to install AnyDesk/TeamViewer → sees UPI PIN | "Install this support app" | Uninstall app + change PIN | Bank → Cybercrime | Limited liability (customer negligence likely) |
 +| **Phishing link fraud** | Fake UPI payment link captures credentials | SMS/email with payment link | Do not click → change PIN | Bank → Cybercrime | Zero liability if PIN not entered |
 +| **SIM swap fraud** | Fraudster ports your SIM → receives OTP → resets UPI PIN | SIM stops working suddenly | Contact telecom immediately | Bank → TRAI → Cybercrime | Zero liability if reported within 3 days |
 +| **Fake customer care fraud** | Fake helpline number → asks for UPI PIN or OTP | "Tell me your UPI PIN to verify" | Never share PIN → hang up | [[https://cybercrime.gov.in|cybercrime.gov.in]] | Limited liability (customer shared PIN) |
 +| **Collect request fraud** | Fraudster sends UPI collect request → victim approves | "Approve this request to receive money" | Reject request immediately | Bank → UDIR if money debited | Zero liability if not approved |
 +| **Remote access trojan (RAT)** | Malicious APK installed → captures screen/PIN | Unknown APK installed on phone | Uninstall + factory reset | Bank → Cybercrime | Limited liability |
 +| **Social engineering fraud** | Fraudster impersonates bank/RBI/police → manipulates into transferring | "Transfer to this safe account" | Verify with official helpline | Bank → Cybercrime → RBI | Limited liability |
 +
 +For more on specific fraud types, see [[qr-code-scam-recovery|QR code scam recovery]], [[sim-swap-fraud-recovery|SIM swap fraud recovery]], [[scammed-on-upi-recovery-steps|scammed on UPI recovery steps]], [[digital-arrest-scam-india|digital arrest scam]], [[ai-voice-scam-recovery|AI voice scam recovery]], [[online-payment-fraud-recovery-india|online payment fraud recovery]], and [[recover-money-upi-fraud-2026|recover money from UPI fraud 2026]].
 +
 +===== Sample complaint text =====
 +
 +<code>
 +To, The Grievance Officer
 +[Bank Name]
 +[Date: DD-MM-2026]
 +
 +Subject: Unauthorised UPI AutoPay debit on account [XXXX1234],
 +        UMN reference [paste UMN here], demand for reversal +
 +        mandate cancellation under RBI Master Direction 2017
 +
 +Madam / Sir,
 +
 +I write under Rule 3(2) of the IT (Intermediary) Rules 2021 and
 +the RBI Master Direction on Limiting Liability of Customers in
 +Unauthorised Electronic Transactions 2017 to report and dispute
 +the following debit:
 +
 +Amount:        ₹__________ on DD-MM-2026 at HH:MM IST
 +UTR / RRN:     __________
 +Mandate UMN:   __________
 +Merchant:      __________ (per app description)
 +
 +I did not authorise this AutoPay mandate. I have not used the
 +named merchant's services. I request:
 +
 +  (a) Immediate revocation of the mandate within 24 hours.
 +  (b) Reversal of the disputed debit to my account within
 +      seven working days.
 +  (c) Investigation of how the mandate was created on my UPI
 +      ID and a written report of findings.
 +  (d) Confirmation in writing that my account is not enrolled
 +      in any other AutoPay mandate without my fresh consent.
 +
 +I attach: bank statement, UPI app mandate screenshot, debit SMS,
 +mandate-creation SMS (if received).
 +
 +I have separately filed UDIR reference no. _______ in my UPI app
 +and a complaint at cybercrime.gov.in vide _______.
 +
 +If this is not resolved within 30 days, I shall escalate to the
 +RBI Banking Ombudsman under the Reserve Bank Integrated Ombudsman
 +Scheme 2021.
 +
 +Yours sincerely,
 +[Name]
 +[Mobile registered with the bank]
 +[Email]
 +</code>
 +
 +===== Consumer court / e-Daakhil route =====
 +
 +For service deficiency (bank failed to verify consent before creating the mandate, or merchant created mandate without consent), file at the District Consumer Disputes Redressal Commission via [[https://edaakhil.nic.in|edaakhil.nic.in]]. Pecuniary jurisdiction up to ₹50 lakh. Filing fee ₹100. Median resolution six to twelve months. Claim a refund of the disputed debits, interest at 9 to 12 percent per annum from the debit date, compensation for mental agony (₹5,000 to ₹3 lakh depending on facts), and costs. Cite //Indian Medical Association v. V.P. Shantha// (1995) 6 SCC 651 for the principle that a paid service is a consumer service. Cite //Pioneer Urban Land v. Govindan Raghavan// (2019) 5 SCC 725 for the principle that consumer-court jurisdiction is concurrent with regulator jurisdiction. See [[edaakhil-online-consumer-commission-filing-india|e-Daakhil online filing guide]] and [[consumer-court-how-to-file-india|consumer court filing guide]].
 +
 +> **🟡 Do this immediately** , Disable UPI auto-debit and reduce per-transaction limit to ₹1 the moment a financial dispute opens. Restoring later takes 24 hours; preventing further loss takes 30 seconds.
 +
 +===== Official sources to verify before you act =====
 +
 +  * **NPCI UPI dispute redressal:** [[https://www.npci.org.in|npci.org.in]] → //What we do// → //UPI// → //Dispute Redressal Mechanism//
 +  * **RBI Master Direction on Limited Customer Liability (2017):** [[https://www.rbi.org.in/Scripts/NotificationUser.aspx?Id=11418|rbi.org.in/Scripts/NotificationUser.aspx?Id=11418]]
 +  * **RBI Banking Ombudsman portal:** [[https://cms.rbi.org.in|cms.rbi.org.in]] · helpline **14448**
 +  * **RBI Integrated Ombudsman Scheme 2021:** [[https://www.rbi.org.in/Scripts/NotificationUser.aspx?Id=12251|rbi.org.in RB-IOS 2021 notification]]
 +  * **NCRP (cyber crime):** [[https://cybercrime.gov.in|cybercrime.gov.in]] · helpline **1930**
 +  * **National Consumer Helpline:** [[https://consumerhelpline.gov.in|consumerhelpline.gov.in]] · helpline **1915**
 +  * **DigiLocker (for any payment-related document):** [[https://www.digilocker.gov.in|digilocker.gov.in]]
 +  * **e-Daakhil consumer court filing:** [[https://edaakhil.nic.in|edaakhil.nic.in]]
 +  * **RBI online RTI portal:** [[https://rtionline.rbi.org.in|rtionline.rbi.org.in]]
 +  * **Central RTI online portal:** [[https://rtionline.gov.in|rtionline.gov.in]]
 +
 +===== Related RTI Wiki guides =====
 +
 +  * [[upi-autopay-subscription-debit-cancel-mandate-refund-india|🔁 UPI AutoPay subscription debit cancel and refund guide]]
 +  * [[upi-autopay-mandate-port-manage-across-apps-2026|🔄 UPI AutoPay 2026: view and port mandates across apps]]
 +  * [[upi-mandate-fraud-how-to-spot|🔍 How to spot UPI mandate fraud]]
 +  * [[upi-fraud-recovery-india|💸 UPI fraud recovery India]]
 +  * [[recover-money-upi-fraud-2026|💰 Recover money from UPI fraud 2026]]
 +  * [[upi-chargeback-wrong-payment-dispute-2026|💳 UPI chargeback for wrong payment dispute 2026]]
 +  * [[upi-deducted-not-received-action-plan-india|⚡ UPI deducted but not received action plan]]
 +  * [[banking-ombudsman-complaint-guide-india|🏦 Banking Ombudsman complaint guide]]
 +  * [[banking-ombudsman-rbios-2021-walkthrough|📖 RB-IOS 2021 walkthrough]]
 +  * [[rbi-complaint-against-bank-india|🏛️ RBI complaint against bank, full process]]
 +  * [[rbi-ombudsman-complaint-closed-rejected-next-steps-india|🚪 Next steps after RBI Ombudsman rejection]]
 +  * [[rbi-digital-fraud-compensation-25000-2026|⚖️ RBI ₹25,000 digital fraud compensation rules]]
 +  * [[rbi-integrated-ombudsman-scheme-2026-complaint-30-lakh-india|📋 RBI Integrated Ombudsman Scheme 2026]]
 +  * [[cyber-crime-complaint-india|🚨 Cyber crime complaint guide]]
 +  * [[file-cybercrime-complaint-2026|📝 File cybercrime complaint 2026]]
 +  * [[1930-helpline-cyber-fraud-script|📞 1930 cyber fraud helpline script]]
 +  * [[golden-hour-zero-liability-cyber-fraud-rbi-india|⏱️ Golden hour zero-liability cyber fraud guide]]
 +  * [[bank-refused-cyber-fraud-refund-zero-liability-india|❌ Bank refused zero-liability refund — what to do]]
 +  * [[rti-act-2005-complete-guide|📚 RTI Act 2005 complete guide]]
 +  * [[how-to-file-rti-online-india|📝 How to file RTI online]]
 +  * [[banking-insurance-rti|🏦 Banking and insurance RTI]]
 +  * [[rti-for-cybercrime-complaint-status|🔍 RTI for cybercrime complaint status]]
 +  * [[cyber-fraud-rti-bundle-rbi-npci-bank-india|📦 RTI bundle for RBI/NPCI/bank fraud disputes]]
 +  * [[credit-card-chargeback-guide-india|💳 Credit card chargeback guide]]
 +  * [[nach-ecs-mandate-cancel-unauthorised-debit-rbi-complaint|📋 NACH/ECS mandate cancellation guide]]
 +  * [[rbi-e-mandate-2026-no-otp-recurring-auto-debit-india|📋 RBI e-mandate 2026 rules]]
 +  * [[subscription-auto-debit-trap-cancellation-india|⚠️ Subscription auto-debit trap and cancellation]]
 +  * [[which-regulator-to-complain-to-india-sebi-rbi-irdai-trai-dgca-hub|🧭 Which regulator to complain to]]
 +  * [[recover-money-wrong-bank-account-india|💸 Recover money sent to wrong bank account]]
 +  * [[illegal-bank-charges-recovery-guide-india|🏦 Illegal bank charges recovery]]
 +  * [[electronic-evidence-court-bsa-section-63-certificate-india|📎 BSA Section 63 electronic evidence guide]]
 +  * [[tools/ai-rti-drafter|🪄 AI RTI Drafter, free tool]]
 +
 +===== External hub links =====
 +
 +  * [[https://righttoinformation.wiki/weekend-problem-solver-india|🛡️ Weekend Problem Solver, 15 emergency topics hub]]
 +  * [[https://righttoinformation.wiki/citizen-crisis-response-network|🛡️ Citizen Crisis Response Network, 100 guides]]
 +
 +===== Downloadable checklist =====
 +
 +> **Login to RTI Wiki to download the printable PDF checklist for this article.** A one-page summary covers: how to find every active mandate, the in-app UDIR steps, the bank nodal-officer template, the RBI 14448 escalation, and the e-Daakhil filing flow.
 +
 +===== Frequently asked questions =====
 +
 +==== What is a UPI AutoPay mandate? ====
 +
 +A UPI AutoPay mandate (also called eMandate) is a recurring-payment authorisation set up on your UPI ID. Once authorised once with your UPI PIN, the merchant can debit up to a pre-set amount on a fixed schedule (daily, weekly, monthly, yearly) without further OTP. Amounts up to ₹15,000 per debit are allowed without per-transaction OTP since the 2024 [[https://www.npci.org.in|NPCI]] revision. See [[upi-digital-payments|our UPI digital payments overview]].
 +
 +==== How do I see all active UPI mandates on my account? ====
 +
 +Open your UPI app and go to Profile → Manage AutoPay (Google Pay), Settings → Mandates (PhonePe), Profile → AutoPay (Paytm), or the equivalent on your bank's UPI app. Each app shows merchant, amount, frequency, and next debit date. You can also call your bank or check NetBanking → Bill Pay → Mandate Management. See [[upi-autopay-mandate-port-manage-across-apps-2026|how to view and port mandates across apps]].
 +
 +==== Can a merchant create a UPI AutoPay mandate without my consent? ====
 +
 +No. Every UPI mandate creation requires the user to enter UPI PIN on a screen that shows the merchant name, amount, and frequency. If a mandate exists that you did not authorise, possible causes are: a phishing screen captured your PIN, a family member used your phone, or a screen-sharing scam tricked you. Revoke and dispute immediately. See [[upi-mandate-fraud-how-to-spot|how to spot UPI mandate fraud]].
 +
 +==== How do I cancel a UPI AutoPay mandate? ====
 +
 +In your UPI app, open the mandate, tap Revoke or Pause, and enter UPI PIN. The bank sends an SMS within minutes confirming cancellation. Save the SMS. If revoke fails, write to the bank's nodal officer and quote RBI Master Direction 2017. See [[upi-autopay-subscription-debit-cancel-mandate-refund-india|the full cancellation and refund guide]].
 +
 +==== What is UDIR and how do I file a UDIR dispute? ====
 +
 +UDIR (UPI Dispute Resolution Initiative) is [[https://www.npci.org.in|NPCI's]] standardised dispute system. Open your UPI app, go to Help → Raise Dispute, select the disputed debit, choose //Unauthorised debit// or //AutoPay not authorised//, and submit. Reference number is generated on screen. Resolution window is 30 days. Outcome is binding on the bank.
 +
 +==== Can I get a chargeback for an unauthorised UPI AutoPay debit? ====
 +
 +UPI does not offer a Visa-style chargeback. The equivalent path is UDIR + bank investigation under [[https://www.rbi.org.in/Scripts/NotificationUser.aspx?Id=11418|RBI Master Direction 2017]]. The Master Direction caps customer liability at zero if you report within 3 working days and the bank cannot prove customer negligence, ₹10,000 to ₹25,000 for delayed reporting (4 to 7 days), and full liability beyond 7 days. Move fast. See [[upi-chargeback-wrong-payment-dispute-2026|UPI chargeback for wrong payment dispute 2026]].
 +
 +==== What if my bank refuses to reverse the debit? ====
 +
 +Escalate to the RBI Banking Ombudsman under the Reserve Bank Integrated Ombudsman Scheme 2021 at [[https://cms.rbi.org.in|cms.rbi.org.in]] or 14448. Free filing, no lawyer needed. The Ombudsman has accepted dozens of UPI AutoPay disputes since 2024 with binding orders. Time limit: file within one year of the bank's final reply. See [[bank-refused-cyber-fraud-refund-zero-liability-india|what to do when a bank refuses a zero-liability refund]] and [[rbi-ombudsman-complaint-closed-rejected-next-steps-india|next steps after Ombudsman rejection]].
 +
 +==== How do I prevent AutoPay fraud in future? ====
 +
 +  * Never share UPI PIN. [[https://www.npci.org.in|NPCI]] does not call asking for PIN.
 +  * Audit your active mandates monthly. Most apps show a //Manage AutoPay// dashboard.
 +  * Set per-transaction limit to ₹2,000 in the bank app for non-merchant UPI.
 +  * Enable UPI Lite for small payments (lower exposure). See [[upi-lite-deducted-not-reflected-india|UPI Lite guide]].
 +  * Watch the screen carefully when creating any mandate. Verify merchant name and amount before entering PIN.
 +  * Treat any //screen sharing// request from a stranger as fraud. See [[digital-arrest-scam-india|digital arrest scam guide]].
 +
 +==== Is AutoPay fraud a criminal offence in India? ====
 +
 +Yes. Creating a mandate by deceptive means is cheating under BNS 2024 Section 318 (general cheating) and Section 66D of the IT Act 2000 (cheating by personation by computer resource). Penalty up to three years imprisonment plus fine. The bank's failure to verify consent can attract Consumer Protection Act 2019 Section 2(11) deficiency in service. See [[cyber-crime-complaint-india|cyber crime complaint guide]].
 +
 +==== Will the police accept an FIR for a small AutoPay debit? ====
 +
 +Yes. Under BNSS 2024 Section 173, any cognisable offence must be registered, regardless of amount. If the police refuse, file a complaint to the Magistrate Court under BNSS Section 175 for direction to register the FIR. The NCRP complaint at [[https://cybercrime.gov.in|cybercrime.gov.in]] is the parallel digital path and is mandatory in most states for cyber-fraud cases. See [[fir-vs-ncr-vs-complaint-india|FIR vs NCR vs complaint]] and [[cybercrime-portal-vs-police-station-india|cybercrime portal vs police station]].
 +
 +==== What is the difference between UPI AutoPay and e-mandate for cards? ====
 +
 +UPI AutoPay is set up via your UPI ID and authenticated with UPI PIN. Card e-mandates are set up with your card details and an initial OTP. Both allow recurring debits without per-transaction OTP up to ₹15,000 (per RBI rules). The dispute path differs: UPI AutoPay uses UDIR; card e-mandates use the chargeback mechanism of your card network (Visa/Mastercard/RuPay). See [[credit-card-chargeback-guide-india|credit card chargeback guide]] and [[rbi-e-mandate-2026-no-otp-recurring-auto-debit-india|RBI e-mandate 2026 rules]].
 +
 +==== Can I file an RTI to find out how many AutoPay fraud complaints my bank has received? ====
 +
 +Yes. If your bank is a public-sector bank (SBI, PNB, Bank of Baroda, etc.) or you are querying the RBI, file under Section 6(1) of the RTI Act 2005. Ask for dispute volumes, resolution rates, and any advisories on mandate verification. File at [[https://rtionline.gov.in|rtionline.gov.in]] or [[https://rtionline.rbi.org.in|rtionline.rbi.org.in]]. See [[rti-act-2005-complete-guide|RTI Act 2005 complete guide]] and [[banking-insurance-rti|banking and insurance RTI]].
 +
 +==== How long does the RBI Ombudsman take to resolve a UPI fraud complaint? ====
 +
 +Typically 30–60 days from filing. The Ombudsman may extend this for complex cases. If the Ombudsman does not resolve within 3 months, you can treat it as a deemed rejection and appeal to the Appellate Authority or file in consumer court. See [[banking-ombudsman-complaint-guide-india|Banking Ombudsman complaint guide]].
 +
 +==== What is the ₹15,000 no-OTP threshold and can I reduce it? ====
 +
 +Since the 2024 NPCI revision, UPI AutoPay mandates can debit up to ₹15,000 per transaction without an additional OTP. You cannot reduce this threshold system-wide, but you can: (a) avoid creating any mandate, (b) set your bank's per-transaction UPI limit lower, or (c) use UPI Lite for small payments (max ₹2,000). See [[rbi-e-mandate-2026-no-otp-recurring-auto-debit-india|RBI e-mandate 2026 rules]] and [[upi-transaction-limit-10-lakh-merchant-2025-india|UPI transaction limits]].
 +
 +==== Can a private bank like HDFC or ICICI be taken to the RBI Ombudsman? ====
 +
 +Yes. The RBI Integrated Ombudsman Scheme 2021 covers all scheduled commercial banks, including private banks (HDFC, ICICI, Axis, Kotak). File at [[https://cms.rbi.org.in|cms.rbi.org.in]] after the bank has had 30 days to resolve your complaint. See [[banking-ombudsman-complaint-guide-india|Banking Ombudsman guide]].
 +
 +==== I authorised a mandate but the merchant is overcharging or not delivering. Can I dispute it? ====
 +
 +Yes. This is a service-deficiency dispute rather than a fraud dispute. File a UDIR dispute selecting //Service not received// or //Amount mismatch//. If the merchant does not resolve, escalate to consumer court under CPA 2019 Section 35. See [[consumer-court-how-to-file-india|consumer court filing guide]] and [[edaakhil-online-consumer-commission-filing-india|e-Daakhil filing guide]].
 +
 +==== What should I do if I gave a fraudster screen-sharing access? ====
 +
 +  - Immediately disconnect the call.
 +  - Uninstall the screen-sharing app (AnyDesk, TeamViewer, etc.).
 +  - Change your UPI PIN and net banking password from a different device if possible.
 +  - Lock UPI in your bank app (Profile → Block UPI ID).
 +  - Check all mandates and revoke any you do not recognise.
 +  - File at [[https://cybercrime.gov.in|cybercrime.gov.in]] or call **1930**.
 +  - See [[digital-arrest-scam-india|digital arrest scam]] and [[sim-swap-fraud-recovery|SIM swap fraud recovery]].
 +
 +==== Are there any government helplines specifically for UPI fraud? ====
 +
 +Yes: **1930** (cybercrime helpline — call within the golden hour to freeze the fraudulent account), **14448** (RBI Banking Ombudsman — for bank-level disputes), and **1915** (National Consumer Helpline — for merchant disputes). See [[1930-helpline-cyber-fraud-script|1930 helpline script]] and [[golden-hour-zero-liability-cyber-fraud-rbi-india|golden hour guide]].
 +
 +===== Last word =====
 +
 +A UPI AutoPay mandate is a powerful convenience and a known fraud surface. The defence is monthly audit of your active mandates, careful reading of every consent screen before you enter UPI PIN, and a 10-minute first-response drill if a suspicious debit appears. The Citizen Crisis Response Network exists to compress that response into the window where 60 to 80 percent of money is recoverable. Save **14448** and **1930** in your contacts. Bookmark this guide. Share it with anyone in your family who uses UPI for subscriptions or recurring bills.
 +
 +{{tag>upi_autopay_fraud upi_mandate_fraud mandate_cancellation udir_dispute rbi_ombudsman cybercrime zero_liability electronic_transaction fraud_recovery consumer_protection rti_for_fraud digital_payment_fraud npcpi upi_fraud india_2026}}
 +===== UPI AutoPay mandate fraud India: How to identify, stop, and recover unauthorized debits (2026) =====
 +
 +UPI AutoPay mandate fraud India — complete guide on identifying, stopping, and recovering unauthorized UPI AutoPay debits:
 +
 +  - **Step 1: What is UPI AutoPay?** (a) the UPI AutoPay — is a recurring payment feature — launched by the NPCI (National Payments Corporation of India) — that allows the automatic debit — from the UPI-linked bank account — for the subscriptions — and the recurring payments, (b) the UPI AutoPay — is used for: (i) the OTT subscriptions — (Netflix, Amazon Prime, Disney+ Hotstar), (ii) the utility bills — (electricity, water, gas), (iii) the insurance premiums, (iv) the loan EMIs, (v) the mutual fund SIPs, (c) the mandate: (i) the user — creates the mandate — by approving the auto-debit — through the UPI app, (ii) the mandate — specifies: (a) the amount — (fixed or variable — up to a maximum), (b) the frequency — (daily, weekly, monthly), (c) the duration — (the start and end date), (d) the merchant — (the name and the UPI ID), (iii) the mandate — is registered — with the bank — and the NPCI — and the debit — is automatic — on the scheduled date.
 +  - **Step 2: What is UPI AutoPay mandate fraud?** (a) the UPI AutoPay mandate fraud — is a fraud — where the scammer — creates the unauthorized mandate — on the victim's UPI account — and the money — is auto-debited — without the victim's knowledge — or consent, (b) the fraud — works as follows: (i) the scammer — sends a link — or a QR code — or a UPI collect request — to the victim — pretending to be: (a) a merchant — offering a discount — or a cashback, (b) a government scheme — or a subsidy, (c) a job offer — or a registration, (ii) the victim — approves the mandate — thinking it is a one-time payment — but it is a recurring mandate, (iii) the money — is auto-debited — every month — or every week — until the mandate — is revoked, (c) the common fraud scenarios: (a) the fake merchant — creates the mandate — for Rs 1 — and the victim — approves — and the mandate — is for Rs 5,000 per month, (b) the scammer — creates the multiple mandates — on the same account — and the debits — are small — and unnoticed, (c) the mandate — is created — through the phishing link — and the victim — does not know — that the mandate — is created.
 +  - **Step 3: How to identify UPI AutoPay mandate fraud.** (a) check the bank statement: (i) check the bank statement — for the recurring debits — with the description — "UPI AutoPay" — or the merchant name, (ii) the debits — that you do not recognize — are the fraud, (b) check the UPI app: (i) open the UPI app — (GPay, PhonePe, Paytm) — and go to "Mandates" — or "AutoPay" — or "Recurring Payments", (ii) check the active mandates — and the unauthorized mandates — are the fraud, (c) check the SMS: (i) the bank — sends the SMS — for each AutoPay debit — and the unauthorized debits — are the fraud, (ii) the NPCI — sends the mandate confirmation SMS — and the unauthorized mandate — is the fraud, (d) the common signs: (a) the small debits — Rs 10-500 — every month — that you do not recognize, (b) the mandate — with the unknown merchant name, (c) the mandate — that you do not remember — approving.
 +  - **Step 4: How to stop UPI AutoPay mandate fraud.** (a) Step 1 — revoke the mandate: (i) open the UPI app — (GPay, PhonePe, Paytm) — and go to "Mandates" — or "AutoPay", (ii) select the unauthorized mandate — and click "Revoke" — or "Cancel" — or "Pause", (iii) the mandate — is revoked — and the future debits — are stopped, (b) Step 2 — contact the bank: (i) call the bank — and report the unauthorized mandate — and the debits, (ii) the bank — can block the mandate — and the UPI — on the account — if needed, (c) Step 3 — block the UPI: (i) if the fraud — is extensive — block the UPI — on the account — by calling the bank — or the NPCI — at 1800-208-9333, (ii) the UPI — is blocked — and no debits — are possible — until the unblock, (d) Step 4 — file a complaint: (i) file a complaint — on the National Cyber Crime portal — cybercrime.gov.in — or call 1930, (ii) the complaint — is filed — for the fraud — and the investigation — is started, (e) Step 5 — request the chargeback: (i) contact the bank — and request the chargeback — for the unauthorized debits, (ii) the bank — can initiate the chargeback — through the NPCI — and the merchant's bank.
 +  - **Step 5: How to recover the money.** (a) the chargeback: (i) the bank — can initiate the chargeback — for the unauthorized debits — through the NPCI, (ii) the chargeback — is initiated — if the mandate — is unauthorized — and the complaint — is filed — within the time, (b) the cyber crime: (i) the cyber crime — can trace the merchant — and the bank account — and freeze the amount, (ii) the recovery — depends on the speed — of the complaint — and the trace, (c) the RBI Ombudsman: (i) if the bank — does not cooperate — approach the Banking Ombudsman — on the RBI portal, (ii) the Ombudsman — can order the bank — to refund the unauthorized debits, (d) the timeline: (i) the chargeback — is processed — within 30-90 days, (ii) the cyber crime — recovery — takes 3-12 months.
 +  - **Step 6: File RTI on UPI AutoPay mandate fraud.** File RTI with the NPCI (or the bank — or the RBI) asking for: (a) the mandate: "Provide the mandate details — for the UPI ID [number] — including: (i) the mandate — active and the revoked, (ii) the merchant name — and the UPI ID, (iii) the amount — and the frequency, (iv) the creation date — and the approval — details", (b) the debits: "Provide the debit details — for the account [number] — under the UPI AutoPay — for the period [date] to [date] — including: (i) the debit — date and the amount, (ii) the merchant — and the UPI ID, (iii) the mandate — reference number", (c) the complaint: "Provide the complaint status — for the complaint — filed on [date] — reference number [number] — including: (i) the complaint details, (ii) the action taken, (iii) the recovery — if any", (d) the statistics: "Provide the statistics — of the UPI AutoPay fraud — for the period [date] to [date] — including: (i) the number of complaints, (ii) the amount — lost — and recovered, (iii) the common merchants — involved in the fraud".
 +  - **Step 7: Practical tips.** (a) check the mandates regularly (check the mandates — on the UPI app — regularly — and revoke the unauthorized — immediately), (b) do not approve the unknown (do not approve the mandate — from the unknown merchant — or the link — or the QR code), (c) check the statement (check the bank statement — for the recurring debits — and the unauthorized debits — are the fraud), (d) file the complaint early (file the complaint — on the cyber crime portal — immediately — for the faster recovery), (e) revoke and block (revoke the mandate — and block the UPI — if the fraud — is extensive), (f) Example: A victim — noticed the recurring debits — of Rs 299 per month — on the bank statement — he checked the UPI app — and found — that a mandate — was created — for an unknown merchant — he revoked the mandate — and filed a complaint — on the cyber crime portal — and requested the chargeback — through the bank — the bank — initiated the chargeback — and the amount — of Rs 1,495 — (for 5 months) — was refunded — within 60 days — and the merchant — was traced — by the cyber crime.
 +
 +See [[https://righttoinformation.wiki/upi-autopay-mandate-fraud-india|UPI AutoPay Fraud]] and [[https://righttoinformation.wiki/whatsapp-otp-fraud-explained-india|WhatsApp OTP Fraud]].
 +
 +{{tag>upi autopay mandate fraud india 2026 unauthorized debit recurring payment npci chargeback cyber crime rti 2026}}