The order of action after a UPI fraud
A person who has lost money through a UPI transaction has three routes, and they run side by side. The first is the bank or the payment service with which the account is held: the Reserve Bank’s instructions require banks to give customers round-the-clock access to report an unauthorised transaction, through at least the website, phone banking, SMS, e-mail, IVR, a toll-free helpline and the home branch, and to take immediate steps on a report to prevent further unauthorised transactions in the account. The second is the national route for cyber fraud: the helpline 1930 and the National Cyber Crime Reporting Portal at cybercrime.gov.in, described on the page on how to report a cyber crime online. The third, once the bank has been approached, is the Reserve Bank Ombudsman.
The first two should be done at once. The 2017 circular tells banks to advise customers to notify them of any unauthorised transaction at the earliest, and that the longer the time taken to notify, the higher is the risk of loss to the bank or the customer. The helpline 1930 and the financial fraud reporting system run by the Indian Cyber Crime Coordination Centre exist to stop the money from being moved on, and by 2 December 2025 the Ministry of Home Affairs reported that more than Rs 7,130 crore had been saved in more than 23.02 lakh complaints.
Who bears the loss: the Reserve Bank’s circular of 6 July 2017
The circular Customer Protection - Limiting Liability of Customers in Unauthorised Electronic Banking Transactions, RBI/2017-18/15, applies to scheduled commercial banks including regional rural banks, small finance banks and payments banks. It sets out when a customer bears no loss and when the loss is limited. The table gives the cases as the circular states them.
| Case | The customer’s liability |
|---|---|
| The fault lies with the bank, or there was contributory fraud, negligence or deficiency on its part | Zero liability, whether or not the customer reports it |
| The fault lies elsewhere in the system and the customer reports within three working days of the bank’s communication | Zero liability |
| The fault lies elsewhere in the system and the customer reports within four to seven working days | The transaction value or the amount in Table 1, whichever is lower |
| The fault lies elsewhere in the system and the customer reports after seven working days | As per the bank’s Board-approved policy |
| The loss is due to the customer’s negligence, such as sharing the payment credentials | The customer bears the entire loss until the transaction is reported; the bank bears any loss after the report |
The amounts in Table 1 of the circular, which cap the liability in the four-to-seven-day case, depend on the type of account.
| Type of account | Maximum liability |
|---|---|
| Basic savings bank deposit accounts | Rs 5,000 |
| All other savings accounts, pre-paid payment instruments and gift cards, MSME current and overdraft accounts, individual current accounts with annual average balance up to Rs 25 lakh, credit cards with a limit up to Rs 5 lakh | Rs 10,000 |
| All other current, cash credit and overdraft accounts, and credit cards with a limit above Rs 5 lakh | Rs 25,000 |
The working days are counted by the home branch’s working schedule, excluding the date on which the communication was received. The circular requires the bank to credit the amount involved to the customer’s account within ten working days of the customer’s notification, without waiting for settlement of any insurance claim, with value as of the date of the unauthorised transaction. It requires a complaint to be resolved and any customer liability established within the time in the bank’s Board-approved policy, not exceeding ninety days from receipt, and if the bank cannot do so within ninety days it must pay the compensation under the circular. The bank must also tell customers of its policy when an account is opened, and display it publicly.
The circular is written for unauthorised transactions. Where the loss is due to the customer’s negligence, such as where the customer has shared the payment credentials, it provides that the customer bears the entire loss until the transaction is reported to the bank, and that any loss after the report is borne by the bank. A person who has been tricked into a payment should therefore report at once, whatever the question of fault.
Escalating to the RBI Ombudsman
The Reserve Bank - Integrated Ombudsman Scheme, 2026 replaced the 2021 Scheme with effect from 1 July 2026. Complaints received before that date, and appeals and awards arising from them, remain under the 2021 Scheme. The new Scheme is a cost-free and expeditious alternative route for complaints of deficiency in service by the regulated entities it covers.
The complainant must first approach the regulated entity with proof of the complaint. A complaint may go to the Ombudsman if there has been no reply within thirty days, or within the time specified by the Reserve Bank, the National Payments Corporation of India or card network guidelines if that is longer, or if the complainant is not satisfied with the reply. It must reach the Ombudsman within ninety days from the expiry of that period or from the entity’s last communication, whichever is later. A complaint can be lodged on the portal at cms.rbi.org.in, by e-mail to [email protected], or by post to the Centralised Receipt and Processing Centre at Chandigarh. There is no fee. The Ombudsman can deal with a dispute of any amount, can award compensation up to Rs 30 lakh for consequential loss, and may provide up to Rs 3 lakh for the complainant’s time, expenses, harassment and mental anguish.
The criminal law on a UPI fraud
A payment fraud is cheating under section 318 of the Bharatiya Nyaya Sanhita, which punishes cheating that dishonestly induces the person deceived to deliver property with imprisonment up to seven years and fine. Where the fraudster pretended to be a bank officer or another person, section 319 on cheating by personation also fits, with up to five years, and section 66D of the Information Technology Act provides for cheating by personation using a computer resource. The old numbers and the other sections are listed on the page on IPC to BNS, and a scam in which the caller poses as an officer is described on the page on the digital arrest scam.
The instructions are under revision
The Reserve Bank had reviewed the 2017 instructions in view of the rapid adoption of technology in banking and payments. According to the Press Information Bureau, revised instructions, including a compensation mechanism for small value fraudulent electronic banking transactions, were issued for public and stakeholder consultation on 6 March 2026. The table above states the position under the 2017 circular. A customer should check the Reserve Bank’s notifications for the final instructions and the date from which they apply.
Frequently asked questions
What should I do first after a UPI fraud?
Report it to your bank at once, through its 24x7 channels, and call the cyber crime helpline 1930 or report on cybercrime.gov.in. The 2017 instructions of the Reserve Bank say that the longer a customer takes to notify the bank, the higher the risk of loss, and that on a report the bank must take immediate steps to prevent further unauthorised transactions in the account.
Will I get my money back after a UPI fraud?
It depends on whose fault the transaction was and how fast it was reported. Under the Reserve Bank’s circular of 6 July 2017, a customer has zero liability where the bank was at fault, or where the fault lies elsewhere in the system and the customer reports within three working days. Where the customer shared payment credentials, the customer bears the loss until the report.
How long does the bank have to credit the amount?
Under the 2017 circular, on being notified by the customer the bank must credit, as a shadow reversal, the amount involved in an unauthorised electronic transaction within ten working days, and it must resolve the complaint within the time in its Board-approved policy but not exceeding ninety days.
Can I complain to the RBI Ombudsman about a UPI fraud?
Yes, once you have complained to the bank. Under the Reserve Bank - Integrated Ombudsman Scheme, 2026, in force from 1 July 2026, you can go to the Ombudsman if you have had no reply in 30 days, or the time specified by RBI, NPCI or card network guidelines if that is higher, or if you are not satisfied with the reply. The complaint must reach the Ombudsman within 90 days after that period or the bank’s last communication. There is no fee.
Which sections apply to a UPI fraud?
Cheating under section 318 of the Bharatiya Nyaya Sanhita, and, where the fraudster pretended to be someone else, cheating by personation under section 319, with section 66D of the IT Act on cheating by personation using a computer resource. Whether and which sections are charged is for the police.