If money has just left your account through a UPI or bank fraud, the next hour matters more than anything else. UPI fraud recovery in India turns on speed, because stolen money is quickly moved through layers of mule accounts, and on a Reserve Bank of India rule that can put the loss back on the bank if you report promptly. This guide sets out, step by step, what to do in the first hour, how the RBI limited-liability rule works, and how to escalate if the bank drags its feet.
Two facts drive everything below. First, banks are required to give you a way to report an unauthorised transaction around the clock. Second, the burden of proving that you were negligent, so that you should bear the loss, sits on the bank, not on you. Reporting fast is what lets you use both of these to get your money back.
How UPI fraud recovery works in India
UPI fraud recovery rests on two moving parts working together. The first is operational: a fast alert to the police and the bank so the stolen money can be frozen in the accounts it landed in before it is withdrawn. The second is legal: the Reserve Bank's rule that limits how much of an unauthorised transaction a customer must bear, and shifts the loss to the bank when the customer reports in time. You use the first to stop the money moving and the second to fix responsibility for whatever cannot be recovered. Neither works well on its own, and both reward reporting the fraud immediately rather than after a day or two of worry.
The first hour: call 1930, report online, tell the bank in writing
Treat a fraud like an emergency, because the fraudster is already moving your money. Do all three of these as fast as you can.
- Call 1930, the national cyber-crime helpline run by the Indian Cyber Crime Coordination Centre. Reporting here can trigger a freeze on the receiving accounts before the money is withdrawn.
- Report on cybercrime.gov.in, the National Cyber Crime Reporting Portal, under the financial-fraud category. You will get an acknowledgement number. Keep it safe.
- Inform your bank in writing, not only by phone. Use the bank's 24x7 fraud-reporting channel, then follow up by email so there is a dated record of exactly when you notified it. Ask the bank to block the card or UPI handle and to register a dispute.
Do not wait for office hours, and do not assume a phone call alone is enough. The date and time you notify the bank is the single most important fact in the whole process, so put it in writing and keep the proof.
Preserve everything: transaction IDs, UPI reference numbers, SMS alerts, screenshots and any messages or call numbers from the fraudster. This is your evidence, both for the bank and for the police.
The RBI limited-liability rule for unauthorised transactions
The key protection is the Reserve Bank's circular on Customer Protection - Limiting Liability of Customers in Unauthorised Electronic Banking Transactions, issued in 2017. It sets out when you bear zero liability and when your liability is limited, and it turns heavily on how quickly you report.
In broad terms, you bear no loss where the fraud is due to the bank's own fault or a deficiency in the banking system, irrespective of whether you reported it. You also bear no loss in a third-party breach, where the fault lies neither with the bank nor with you but elsewhere in the system, provided you notify the bank within the short reporting window in the circular. Where the loss is due to your own negligence, for example if you shared your PIN, password or OTP, you bear the loss until you report, after which further loss shifts to the bank. For delayed reporting of a third-party breach, your liability is capped at the amounts set out in the circular, which vary by the type and size of account.
| When you report the unauthorised transaction | Who bears the loss (broad principle) |
|---|---|
| Bank's own fault or a system deficiency | The bank, whether or not you reported |
| Third-party breach, reported within the early window in the RBI circular | Zero liability on you |
| Third-party breach, reported after a short delay | Your liability capped at the amount in the circular, based on account type and size |
| Your own negligence (shared OTP, PIN, password) | You bear loss until you report; the bank bears further loss after you report |
| Reported after a longer delay | As per the bank's board-approved policy |
The exact number of working days for each band, and the exact rupee caps, are set out in the RBI circular and by your bank's board-approved policy. Because those figures can be revised, check the current circular and your bank's policy rather than relying on a number from memory. The principle to hold on to is simple: the sooner you report, the more the loss shifts away from you, and prompt reporting can mean zero liability.
The burden of proving that a customer was negligent lies on the bank. You are not required to prove you were careful; the bank is required to prove you were not. That is a strong position, and it is why a clean, dated report matters so much.
Two more protections are worth knowing. Once you notify the bank, it is required to credit the disputed amount to your account on a shadow-reversal basis within a set number of working days, and to resolve the complaint within the timeline in the circular. Ask for this credit expressly.
The golden window for freezing mule accounts
Fraud money does not sit still. It is split and passed through a chain of "mule" accounts within minutes, then withdrawn or spent. This is why the first report, especially the call to 1930 and the entry on cybercrime.gov.in, is described as the golden hour. A quick report lets the system flag and freeze the receiving accounts before the money is emptied. Every minute of delay lowers the chance of recovery, so report before you do anything else, including before you finish gathering every screenshot.
Chargebacks and the dispute process
For card transactions, ask your card issuer to raise a chargeback, which is a formal dispute through the card network to reverse an unauthorised or disputed payment. For UPI, you can raise a dispute inside the payment app and through the dispute-redressal mechanism operated for UPI, in addition to the report you have already made to your bank. Keep the complaint or dispute reference numbers. If the bank rejects the dispute, ask for the reasons in writing, because you will need them if you escalate.
Escalating to the banking ombudsman
If the bank does not resolve your complaint, rejects it wrongly, or does not reply within thirty days, you can escalate to the Reserve Bank's ombudsman under the Integrated Ombudsman Scheme, 2021. The scheme runs on a "one nation, one ombudsman" basis, is free of cost, and complaints can be filed online through the Reserve Bank's complaint management system. Escalate only after you have first complained to the bank and either received an unsatisfactory reply or waited out the thirty-day period, because the ombudsman generally expects you to give the bank a chance to resolve the matter first.
Alongside these remedies, the fraud is a criminal offence. Cheating and impersonation using electronic means can attract provisions of the Bharatiya Nyaya Sanhita, 2023 and Sections 66C and 66D of the Information Technology Act, 2000, which is why the report on cybercrime.gov.in and, where needed, a formal police complaint sit next to your bank dispute rather than replacing it.
From what I see in these matters, the single biggest reason people do not get their money back is a slow or purely verbal report. The customers who recover are the ones who called 1930 within minutes, filed on cybercrime.gov.in, and emailed the bank the same day with the transaction details, so that the timeline was undeniable. The RBI rule is on the customer's side, but it rewards proof and speed. If your bank stonewalls, do not give up at the branch counter. Put the complaint in writing, collect the rejection, and take it to the ombudsman. For the fuller picture, see our guides on online financial fraud recovery, how to report cyber crime in India, and our cyber fraud protection guide, and our cyber crime law team for help with a specific case.
Frequently Asked Questions
Q: What is the very first thing to do after a UPI or bank fraud?
Call 1930, the national cyber-crime helpline, then report on cybercrime.gov.in and inform your bank in writing. Speed is what allows the receiving accounts to be frozen before the money is withdrawn.
Q: Will I get my money back automatically?
No. Recovery is not automatic. It depends on reporting quickly, on whether the fraud was a third-party breach or your own negligence, and on the bank acting on your dispute. Prompt reporting is what gives you the best chance.
Q: Do I bear the loss if I report immediately?
Under the RBI limited-liability rule, if the fraud is a third-party breach and you report within the early window in the circular, you generally bear zero liability. The loss shifts increasingly to you the longer you delay.
Q: The bank says it was my fault because I shared an OTP. What now?
Where the loss is due to your own negligence, you bear the loss only until you report; further loss after your report shifts to the bank. Importantly, the bank must prove your negligence, and you should insist it does so rather than accepting a refusal at face value.
Q: How fast do I have to notify the bank?
As fast as possible. The RBI circular sets short working-day windows that decide your liability, so notify the bank in writing on the same day. Check the current circular and your bank's policy for the exact day counts.
Q: What is a chargeback?
A chargeback is a formal dispute raised through the card network to reverse an unauthorised or disputed card payment. Ask your card issuer to initiate it, and keep the dispute reference number.
Q: The bank has not resolved my complaint. Where do I escalate?
To the Reserve Bank's ombudsman under the Integrated Ombudsman Scheme, 2021, if the bank has not resolved the matter, has rejected it wrongly, or has not replied within thirty days. It is free and can be filed online.
Q: Is cyber fraud also a criminal offence?
Yes. Cheating and impersonation by electronic means can attract the Bharatiya Nyaya Sanhita, 2023 and Sections 66C and 66D of the Information Technology Act, 2000. Your report on cybercrime.gov.in and any police complaint run alongside the bank dispute.
This article is general legal information, not legal advice, and does not create a lawyer-client relationship. Reporting timelines and liability caps are set by the RBI circular and your bank's board-approved policy and can change. For advice on a specific fraud, consult a qualified advocate.
