UPI fraud recovery in India — the 2026 money-back roadmap

UPI fraud recovery in India — the 2026 money-back roadmap — RTI Wiki

Scanned a QR code, got a “collect request” call, or watched money leave your account to a stranger? UPI fraud moves fast, but so does the recovery machinery — if you touch it in the right order. The first hour decides how much comes back; the Right to Information Act decides how fast the police file moves after that.

Quick answer: Call the national cybercrime helpline 1930 immediately and file on cybercrime.gov.in — the Citizen Financial Cyber Fraud module can freeze the money chain while it is still hopping accounts. Report to your bank in writing the same day: RBI's customer-protection rules give you zero liability if you report within three working days, and the bank must make a shadow reversal within 10 working days. After the FIR, an RTI to the police cyber cell keeps the investigation from going to sleep.

Helpline: 1930 — national cybercrime helpline

Report: cybercrime.gov.in — financial-fraud complaint

Zero liability: report to the bank within 3 working days

Shadow reversal: bank must credit back within 10 working days of your complaint

Bank complaint window: resolve and compensate within 90 days

RTI lever: FIR status and case progress from the police cyber cell

The first 60 minutes

  1. Call 1930. It is the helpline run for exactly this. Give the transaction reference, amount and time; the aim is to freeze the receiving account before the money is layered away. The same details go into a written complaint on cybercrime.gov.in — keep the complaint number.
  2. Tell your bank in writing — the app's complaint button plus an email to the bank's official complaint id, with the UPI transaction id, date, counterparty UPI id or Virtual Payment Address, and amount. A written trail starts the RBI clock.
  3. Do not delete anything. Screenshots of the collect request, the QR, the SMS, the caller's number — all of it is evidence for the bank and the police.
  4. Lodge the police complaint. Many states take cyber-fraud FIRs online; our download FIR copy online guide lists the state portals. Quote the 1930 and cybercrime.gov.in reference numbers in it.

The full telephonic script for the 1930 call, with what to say when the “bank verification officer” is really the fraudster, is in the 1930 helpline guide.

The RBI liability ladder — what the bank must return

The controlling rule is RBI's circular of 6 July 2017 — Customer Protection: Limiting Liability of Customers in Unauthorised Electronic Banking Transactions (RBI/2017-18/15). It works in three steps:

  • Reported within 3 working days of the bank's communication: zero liability — the customer loses nothing, wherever the fault lies in the system.
  • Reported within 4 to 7 working days (third-party fraud): your exposure is capped per transaction at the transaction value or the Table-1 ceiling, whichever is lower — ₹5,000 for Basic Savings Bank Deposit accounts, ₹10,000 for most other savings accounts, prepaid instruments and MSME current accounts, ₹25,000 for larger current, cash-credit and overdraft accounts and high-limit credit cards.
  • Beyond 7 working days: liability falls to be decided under the bank's Board-approved policy — which the bank must publish.

Two force-multipliers sit in the same circular: once you notify the bank, it must make a shadow reversal within 10 working days of the notification, and it must resolve the complaint and pay any compensation within 90 days — if it cannot decide by then, the compensation is paid anyway. And the burden of proving that you were at fault sits on the bank, not on you.

Where the money left by a failed-but-debited UPI transaction — no fraudster at all, just a debit with no service — the RBI turn-around-time rules apply instead: T+5 resolution and ₹100-a-day compensation, the same machinery explained in our ATM cash-not-dispensed guide.

Where RTI comes in

The bank money and the police case run on separate tracks, and the police track is the one that stalls. RTI fixes that:

  • Police cyber cell / investigating officer — an RTI under §6(1) asking for FIR status, chargesheet progress and the freezing status of the fraudster's account is the classic prod. Police are public authorities; the application costs ₹10.
  • Public-sector banks (SBI, PNB, Bank of Baroda and the rest) are public authorities too — an RTI to the CPIO asks for the fraud-investigation file status and the internal report on your complaint, things a branch will never volunteer.
  • Private banks and payment apps are not public authorities under the Act. Your levers there are the bank's own grievance hierarchy and the RBI Integrated Ombudsman — file at the RBI complaint portal after 30 days of an unsatisfactory bank reply, per our banking ombudsman guide.
To: The Public Information Officer,
[Police station / Cyber police station, city].

Subject: Information under §6(1), RTI Act 2005 —
FIR No. [___] dated [___] (UPI fraud ₹[___])

Kindly provide:
1. Present status of investigation of FIR No. [___] —
   stage, sections invoked, and officer responsible.
2. Status of the freeze/lien reported on the suspect
   accounts named in the FIR, and of funds recalled.
3. Date till which the chargesheet or final report is
   committed under §173 CrPC / §193 BNSS.
4. Copies of the final report or correspondence with
   the bank's nodal officer on fund recall.

Fee of ₹10 enclosed by [IPO/DD no. ___].

Real-life example

Kashvi Pathak, 21, Pune — a “delivery agent” sent a ₹50 collect request on a phone-recharge pretext, then talked her through raising the PIN prompt twice: ₹18,500 gone in four minutes. She called 1930 within twenty minutes and filed on cybercrime.gov.in the same evening; the receiving account was frozen with ₹11,200 still in it. Her written complaint to the bank went in next morning — day 1 of the RBI clock. The bank shadow-reversed ₹18,500 on day 9. The police file then sat unallocated for six weeks; one RTI asking for investigation status and the chargesheet date moved it to a chargesheet-bound stage inside a month. Total recovery: full amount. Total cost: ₹10 RTI fee and one registered letter.

Frequently asked questions

Is there really a golden hour for UPI fraud?

Yes, in practice. The 1930-cum-portal report works by freezing the receiving account chain; the sooner it is flagged, the more money is still sitting there when the freeze lands. After the money is layered out or withdrawn, recovery depends on the police recall process.

The bank says UPI fraud is my own fault for sharing the PIN. Do I still get zero liability?

If the transaction was unauthorised and you notified the bank within three working days of its communication, the circular gives you zero liability, and the burden of proving customer liability is on the bank. PIN-sharing that genuinely authorised the payment is a different case — expect the bank to rely on its Board policy there.

Can I complain to RBI directly?

First complain to the bank. If the reply is unsatisfactory or 30 days pass without one, the RBI Integrated Ombudsman route opens — the step-by-step is in our banking ombudsman guide.

Does RTI work against PhonePe, Google Pay or Paytm?

No — they are not public authorities. The RTI levers are the police investigating your FIR and, for public-sector banks, the bank's own CPIO. For everything else it is the app's grievance channel, the bank, and the Ombudsman.

What if the fraud was an AePS withdrawal from an Aadhaar-linked micro-ATM?

That is a cousin fraud with its own fingerprint trail — see our AePS fraud guide for the UIDAI-bank escalation route.

Sources

Last reviewed: 27 August 2026. The 2017 RBI circular's numbers — 3-working-day zero liability, the ₹5,000/₹10,000/₹25,000 caps, 10-working-day shadow reversal, 90-day resolution — were read from the circular PDF itself, not from secondary round-ups. 1930 and cybercrime.gov.in verified live.

, , , , , , , , ,

Reader signal

Was this article useful?

Tap once if it helped you. These counters show other citizens which pages are worth reading.

- views