UPI Fraud Complaint: Report to 1930 and Understand RBI Liability Rules

The first response: stop further loss and report

If money has just left your account, act before spending time arguing with the caller. Contact your bank through its official app, website or verified helpline and report the disputed transactions. Ask for appropriate protection of the account or payment channel. Do not use a customer-care number supplied by the suspected fraudster or taken from an unverified search advertisement.

Call 1930 for financial cyber fraud and use the National Cybercrime Reporting Portal at cybercrime.gov.in. Keep the acknowledgement and follow the instructions for completing the complaint. If one channel is temporarily unavailable, continue with the bank and available official reporting routes rather than waiting passively. Speed can help attempts to trace and restrain money before it is moved further.

Use a safe device if yours may be controlled through remote-access software. Do not provide another OTP, approve a fresh collect request or pay a fee to release a refund. Tell the bank if credentials, the SIM or device access may be compromised. Reporting is an urgent step, not a promise that the bank or police can automatically reverse every payment.

What to include in the bank and cybercrime complaints

Prepare your name, contact details, bank, account details requested through the secure process, transaction references, amounts and times. Add the recipient UPI ID, phone numbers, messages, links and screenshots available to you. Identify which entries are disputed. For multiple transfers, list each separately rather than reporting only a combined total that cannot be matched to bank records.

Describe what actually happened. Say whether you entered a UPI PIN, shared credentials, installed an app, approved a request or discovered a transfer you did not initiate. Those details may feel embarrassing, but they are important for investigation and liability assessment. Do not describe a payment you knowingly authorised as a completely unknown transaction simply because the recipient deceived you.

Keep separate acknowledgement numbers for the bank, app provider and cybercrime complaint. The official financial-fraud instructions describe completing the portal registration after a helpline acknowledgement; follow that prompt immediately, including any stated completion period. A phone call alone should not be treated as completing every police, banking and portal step. Save confirmation messages and a copy of your submitted narrative.

Need help with this? Read our guide to Cyber crime complaint | Advocate Help.

The RBI 2017 circular: when zero liability may apply

The RBI circular dated 6 July 2017, Customer Protection – Limiting Liability of Customers in Unauthorised Electronic Banking Transactions, addresses specified banks and unauthorised electronic transactions. It is not a blanket insurance policy for all online scams. First identify the account provider and whether the disputed debit falls within the applicable framework.

The circular provides zero customer liability where the unauthorised transaction results from contributory fraud, negligence or deficiency on the bank’s part, irrespective of whether the customer reports it. It also provides zero liability for a third-party breach where the deficiency lies neither with the bank nor the customer but elsewhere in the system, if the customer reports within three working days of receiving the bank’s communication.

Those are different grounds. A timely report does not by itself prove that the case is a qualifying third-party breach or bank deficiency. Ask the bank to explain its classification and reasons in writing. Preserve transaction alerts and the time of your report, since the relevant reporting period runs from receipt of the communication, not simply from when you later decide to review a statement.

Customer negligence, delayed reports and authorised scams

Where loss results from customer negligence, such as sharing payment credentials, the circular makes the customer bear the loss until reporting to the bank. Losses occurring after reporting are borne by the bank under that framework. This makes immediate reporting important even if you believe you made a mistake. Do not let embarrassment cause further delay.

For a qualifying third-party breach reported within four to seven working days, liability is limited according to the circular’s table and account category, subject to the transaction value. Beyond seven working days, the bank’s board-approved policy applies. Do not quote one rupee cap as if it covers every account or every fact pattern. Ask for the relevant policy and category.

A scam in which you intentionally authorised a transfer after deception can raise a different issue from an unauthorised debit. The bank may dispute the circular’s application. That does not make reporting pointless: tracing, police investigation and a properly supported service complaint may still matter. Explain the deception precisely and obtain advice rather than assuming either automatic reimbursement or automatic absence of any remedy.

Provisional credit and the difference between deadlines

For cases within its scope, the circular requires a shadow reversal within ten working days of notification, without waiting for settlement of an insurance claim, and value dating to the unauthorised transaction date. The liability determination and complaint resolution should occur within the bank’s policy period, not exceeding ninety days from receipt of the complaint.

These provisions should not be advertised as a guaranteed refund within ten days for every UPI scam. Applicability, the nature of the transaction and the liability category can be disputed. Ask the bank to state whether provisional credit has been given and, if refused, the reasons. A provisional entry is not necessarily the same as a final determination of your legal entitlement.

The circular places the burden of proving customer liability in an unauthorised electronic banking transaction on the bank. Request a reasoned response rather than accepting a generic message saying the transaction was successful. Success on the payment network and authorisation by the customer are not identical questions. Keep the complaint focused on the precise debit, notification time and disputed basis for liability.

Evidence that helps tracing and assessment

Keep the original SMS alerts, bank statement, app history and transaction reference. Export relevant conversations where possible and preserve links, profile identifiers and phone numbers. Screenshots are useful, but they should not be your only record. Avoid cropping away dates or sender details. Explain any missing information honestly and add later evidence through the appropriate channel.

Create a short chronology: first contact, requested action, transfer, discovery, bank notification, helpline report and portal submission. Record what the bank told you and when. If you installed software, note its name and the permissions requested without reopening a dangerous link. A clear timeline helps distinguish the fraud itself from failures that may have occurred after the bank was notified.

Do not publish full account numbers, identity documents or other victims’ information while asking for help online. Never send OTPs or PINs to someone claiming to verify the complaint. Fraudsters may impersonate investigators or recovery agents after an initial loss. Genuine follow-up should be checked through known official channels, especially before transferring money or providing remote access to your device.

Escalating a rejected or unanswered complaint

Begin with a written complaint to the regulated entity and use its grievance escalation process. Include the reference number, relevant transactions, reporting times and the specific service failure alleged. Ask for the reasons for rejection and the policy relied on. Sending repeated messages without the original reference can fragment the record and make the dispute harder to follow.

If the response is unsatisfactory or absent, check eligibility and current procedural requirements for the RBI Ombudsman route through official RBI channels. Scheme rules, coverage, waiting requirements and time limits must be read as applicable to the complaint. Do not assume that a police complaint replaces the required complaint to the bank, or that every app operator is independently covered in the same way.

An advocate can also assess whether a consumer complaint or another proceeding is appropriate for an alleged service deficiency. Coordinate remedies: overlapping proceedings may affect admissibility or strategy. A claim against a bank requires an identifiable legal or service failure, not simply proof that a criminal deceived you. Ask about costs, evidence, jurisdiction and realistic outcomes before starting litigation.

What recovery realistically depends on

Tracing may reveal that funds have already passed through several accounts or have been withdrawn. A reported or frozen amount is not necessarily money available for immediate release to you. Investigation, verification and directions from the appropriate authority may be needed. Keep following up through the reference numbers rather than treating an informal message as final recovery confirmation.

If only part of the loss is traced, update your advocate and the bank about any amount actually returned. Avoid double-counting a provisional credit, recovered amount and claimed loss. Maintain one ledger showing the original debit, subsequent credits and outstanding dispute. Accurate figures support both negotiations and any later proceeding.

A useful first consultation includes the transaction list, all acknowledgements, the bank’s replies and a truthful account of your actions. LawLine can connect you with an independent advocate for complaint drafting or advice on escalation. No legitimate adviser can guarantee recovery merely because you reported within a particular number of hours or paid a recovery fee in advance.

Frequently asked questions