Lost money to a UPI scam? The first 3 days could decide how much you can recover

A UPI fraud can drain a bank account in minutes. A scammer posing as a bank official, a fake customer-care number, a fraudulent payment request or a screen-sharing app can trick a person into losing money before they even notice it.

But losing money to a UPI scam does not automatically mean the customer has to bear the entire loss. The Reserve Bank of India (RBI) has a framework that protects customers against unauthorised electronic banking transactions. In certain cases, customers can even have zero liability.

However, the protection depends on how the fraud happened, whether the customer shared their credentials or approved the transaction, and how quickly the bank was informed.


So, if money has been fraudulently debited from your account, what should you do first? When is the bank required to compensate you, and what can you do if it refuses to refund the money?

UPI fraud: Does your bank have to refund the money?

The first thing to understand is that not every UPI scam is treated as an unauthorised transaction under RBI's customer protection framework.

Under RBI's framework on limiting liability of customers in unauthorised electronic banking transactions, customers can have zero liability in certain situations.

If the unauthorised transaction happens because of the bank's negligence, fraud or deficiency, the customer has zero liability, irrespective of when the transaction is reported.

Similarly, if the breach is attributable to a third party and neither the bank nor the customer is at fault, the customer can have zero liability if the transaction is reported within three working days of receiving communication from the bank about it.

The framework places the responsibility of establishing customer liability on the bank. RBI also requires banks to provide provisional credit in eligible cases within 10 working days, while the complaint must be resolved within 90 days, explains Rohit Mahajan, Founder and CEO, Plutos ONE.

But there is an important catch.

Shared UPI PIN or approved a collect request? Who bears the loss?

Suppose a fraudster calls you pretending to be a bank representative and tells you that your account needs to be verified. You are asked to enter your UPI PIN or approve a payment request. You follow the instructions, and money is debited from your account.

In such cases, the bank may treat the transaction as customer-authorised because the payment was authenticated using your credentials.

When a customer intentionally enters a UPI PIN, shares an OTP or approves a fraudulent collection request, the bank may classify the transaction as one resulting from customer negligence, says Mandar Patil, EVP at Cyble.

Under RBI's framework, if the loss is due to the customer's negligence, such as sharing payment credentials, the customer generally bears the loss until the fraud is reported to the bank. Any further loss after the report is received is borne by the bank.

However, this does not automatically absolve the bank of responsibility.

If the transaction resulted from a system failure, security lapse or another deficiency on the bank's part, the liability may change. The circumstances and evidence of each complaint need to be examined, points out Patil.

This is why customers should not assume that a bank can reject every claim simply because a UPI PIN or OTP was used.

There is also a basic safety rule worth remembering: you do not need to enter your UPI PIN to receive money. A PIN is used to authorise a debit from your account. Never enter it to claim a refund, receive a payment or verify that money has been credited.

The three-working-day rule: When does the clock start?

“Reporting within 03 working days matters under RBI’s customer liability norms. For unauthorised transactions caused by a third-party breach, a prompt report generally limits your liability to zero. Delays can shift part of the loss to the customer,” says Dr. Raj P. Narayanam, Founder & Executive Chairman, Zaggle.

But the clock does not start from the date the fraudulent transaction takes place.

“ It is counted from the date the customer receives communication from the bank about the unauthorised transaction. The date of receiving that communication is excluded, and working days are calculated according to the working schedule of the customer's home branch,” says Mahajan.

If the customer reports the fraud within three working days, zero liability may apply in eligible cases.

The maximum liability depends on the type of bank account:

Type of account	Maximum customer liability
Basic Savings Bank Deposit account	₹5,000
Specified savings and other eligible accounts	₹10,000
Other specified current, credit and overdraft accounts	₹25,000

Source: plutos ONE

If the customer reports the transaction after seven working days, the liability is determined according to the bank's board-approved customer protection policy.

These timelines should not be treated as a reason to wait. Report the fraud immediately. The sooner you alert the bank and the authorities, the better the chances of stopping the money from moving further.

UPI fraud: What should you do in the first few hours?

Speed is critical because fraudsters can transfer the stolen money through multiple accounts before the victim realises what has happened.

Here is what you should do:

1. Contact your bank immediately

Call your bank's official helpline and report the fraudulent transaction. Ask the bank to block or disable UPI transactions and take steps to prevent further unauthorised debits. If necessary, ask it to block the linked account or other affected banking channels.

Do not use a phone number sent by the caller or found in an unsolicited message. Use the number on the bank's official website, app or debit card.

2. Call the cybercrime helpline 1930

Report the fraud to the national cybercrime helpline 1930 as soon as possible. You can also file a complaint through the National Cyber Crime Reporting Portal at cybercrime.gov.in.

Keep the acknowledgement or complaint reference number. A prompt report can help the authorities alert the receiving bank and attempt to stop the money from being withdrawn or transferred further. Recovery is not guaranteed, but speed can improve the chances.

3. Raise a complaint through your UPI app

Report the transaction through the UPI app used to make the payment. Use its dispute or complaint facility and retain the reference number.

However, do not rely only on the app's complaint mechanism. You should also report the fraud directly to your bank.

4. File a written complaint and preserve evidence

Send a written complaint to your bank and retain the acknowledgement. Keep the UPI transaction ID or UTR, bank statements, SMS alerts, screenshots, call details and messages exchanged with the fraudster.

If you spoke to someone claiming to be a bank official or customer-care representative, preserve the phone number and any other details that could help establish what happened.

Dr Narayanam stresses that customers should maintain a record of when they reported the fraud to the bank, the cybercrime helpline and the UPI app. This timeline can become important if the bank later disputes the complaint.

Didn't share your PIN or OTP? What evidence can help your refund claim?

A customer may lose money even without knowingly sharing their UPI PIN or OTP. In such cases, the bank should examine the complaint and the available transaction evidence rather than reject it merely because the payment was authenticated.

Patil advises customers to submit the UPI transaction ID, bank statement, SMS alerts, screenshots, details of their interaction with the fraudster and the cybercrime complaint acknowledgement.

The customer should clearly state that they neither shared their credentials nor authorised the transaction.

The bank should examine the transaction details, device information and other relevant records to investigate how the fraud took place. As per RBI's framework, the responsibility of establishing customer liability rests with the bank.

This makes it important to give the bank a complete account of events and retain copies of every document submitted.

Bank rejected your UPI fraud complaint? Here's how to escalate it

A bank's rejection does not necessarily mean that the customer has no further recourse.

First, ask the bank for its decision in writing, along with the reasons for rejecting the claim. Request the complaint reference number, transaction details, investigation findings and the authentication records showing how the payment was approved.

You can then escalate the matter through the bank's grievance redressal mechanism, including its grievance redressal officer and principal nodal officer.

If the bank does not resolve the complaint within 30 days, or you are dissatisfied with its response, you can approach the RBI Integrated Ombudsman under the RBI Integrated Ombudsman Scheme, 2021, through cms.rbi.org.in.

The scheme provides a free complaint-redressal mechanism for eligible complaints against regulated entities. The complaint generally needs to be filed within one year of receiving the bank's reply. If the bank does not respond, the applicable time limit is one year and 30 days from the date of the complaint to the bank.

You should keep the bank complaint acknowledgement, its written response, transaction records, cybercrime complaint details and supporting evidence ready.

Dr Narayanam says customers should also ask the bank for its investigation findings and the authentication record. These documents can help them understand why the bank rejected the claim and support their case during escalation.

The Ombudsman may direct appropriate redressal or compensation where the complaint is covered by the scheme and the facts support the customer's claim. However, a refund is not automatic, particularly where the customer knowingly approved the payment or shared credentials.

When it comes to UPI fraud, the first few hours can matter as much as the three-working-day reporting window.