Can Payment Apps Be Held Responsible for Fraud in India?
Yes, payment apps can be held responsible for fraud in India if the loss occurs due to their negligence, security failures or violation of applicable legal obligations. However, apps such as Google Pay, PhonePe and Paytm are not automatically liable for every fraudulent transaction. Under RBI guidelines and consumer protection laws, liability depends on how the fraud occurred, whether the transaction was authorised and who was responsible.
Can Payment Apps Be Held Liable for UPI Fraud?
Payment apps can be held liable for UPI fraud when their actions or failures amount to a violation of applicable legal duties. However, liability is not automatic merely because a fraudulent payment was made through their platform.
Add LawBhoomi as your preferred source on Google.
For example, if a fraudster tricks a customer into transferring ₹20,000 through a UPI application, the payment app may not be responsible simply because it processed the transaction.
However, if a security failure, unauthorised transaction or deficiency in service is attributable to the payment provider, the affected customer may have grounds to seek compensation or other relief.
The legal responsibility depends on several factors:
- Nature of the fraud: Whether the transaction was authorised by the customer or occurred without permission.
- Security failures: Whether the payment service provider failed to follow applicable security requirements.
- Customer negligence: Whether sensitive information, such as a UPI PIN or OTP, was voluntarily shared.
- Regulatory obligations: Whether the bank or payment service provider violated RBI directions or failed to address the complaint properly.
Therefore, identifying the actual cause of the fraudulent transaction is essential before determining liability.
Find the latest legal internship opportunities, updated daily.
Which Laws Govern Payment App Fraud in India?
Several laws and regulatory guidelines govern the responsibility of payment apps, banks and digital payment service providers.
Payment and Settlement Systems Act, 2007
The Payment and Settlement Systems Act, 2007, provides the legal framework for regulating payment systems in India.
Under this Act, the Reserve Bank of India regulates authorised payment systems and can issue directions concerning their operation, security and compliance.
Payment system operators must comply with the applicable regulatory requirements. Violations may attract regulatory action.
The RBI issued guidelines on limiting customer liability in unauthorised electronic banking transactions on 6 July 2017.
These guidelines determine when customers are entitled to protection against financial losses arising from unauthorised transactions.
They distinguish between bank negligence, customer negligence and third-party breaches. The guidelines also prescribe timelines for reporting fraudulent transactions and determining customer liability.
Consumer Protection Act, 2019
The Consumer Protection Act, 2019, allows consumers to seek remedies for deficiency in service and unfair trade practices.
Explore the latest legal opportunities for law students and lawyers.
If a payment service provider fails to fulfil its legal or contractual obligations, an affected consumer may approach the appropriate Consumer Commission, subject to the Act’s requirements.
However, the consumer must establish grounds for holding the concerned service provider responsible.
RBI Rules for Digital Wallets
Digital wallets are governed by the RBI Master Directions on Prepaid Payment Instruments, 2021, as amended.
These directions prescribe obligations relating to transaction security, customer protection, reporting unauthorised transactions and grievance redressal. They also contain customer liability rules for qualifying unauthorised transactions involving non-bank prepaid payment instrument issuers.
When Are Payment Apps Responsible for Fraud?
Payment apps may face legal responsibility in circumstances where their negligence or deficiency in service contributes to financial loss.
Fraud Due to Security Failures
Payment service providers must comply with applicable security standards and regulatory directions.
If a fraudulent transaction occurs because of a security failure attributable to the provider, the affected customer may have grounds to seek compensation.
For example, an established failure to implement mandatory security controls may be relevant when determining responsibility.
An unauthorised transaction occurs when money is transferred without the customer’s permission.
Find the latest legal internship opportunities, updated daily.
If a customer discovers an unauthorised debit, the bank must examine the complaint according to applicable RBI guidelines.
Where the loss results from bank negligence, the RBI framework provides zero customer liability. Responsibility for an app provider must be assessed separately according to its role.
Failure to Address Fraud Complaints
Payment providers are required to follow applicable grievance redressal procedures.
If a provider fails to register complaints, investigate relevant transaction issues or comply with mandatory complaint-handling requirements, such conduct may amount to a deficiency in service.
However, an unsuccessful attempt to recover money does not automatically establish negligence.
When Are Payment Apps Not Responsible for Fraud?
Payment apps are generally not automatically responsible when customers knowingly authorise transactions, even if the recipient later turns out to be a fraudster.
For example, suppose a customer receives a fake job offer and transfers ₹10,000 through PhonePe. The recipient disappears after receiving payment.
In this situation, the payment was authorised, although it was obtained through deception. The customer may report the fraud and seek recovery, but the payment app is not necessarily liable to refund the amount.
Similarly, voluntarily disclosing a UPI PIN or OTP may affect customer liability.
However, the circumstances must still be examined. Customer negligence does not automatically eliminate every legal obligation of the bank or payment provider.
What Do RBI Guidelines Say About Customer Liability?
The RBI’s 2017 guidelines provide specific protections for customers affected by unauthorised electronic banking transactions.
Where the unauthorised transaction results from a third-party breach and neither the bank nor the customer is responsible, customer liability depends on the reporting period.
| Time Taken to Report | Customer Liability |
| Within 3 working days | Zero liability |
| Within 4–7 working days | Limited liability, subject to prescribed limits |
| After 7 working days | As per the bank’s approved policy |
The reporting period is calculated from receipt of the bank’s communication regarding the unauthorised transaction, according to RBI rules.
Where zero or limited liability applies, the bank must provide a provisional credit within 10 working days of notification, subject to the prescribed framework. The complaint must ordinarily be resolved and liability determined within a maximum of 90 days.
If the customer shares payment credentials and the loss occurs because of that negligence, the customer generally bears losses until the unauthorised transaction is reported. Losses occurring after reporting are borne by the bank under these directions.
These rules primarily concern unauthorised transactions and should not be confused with cases where customers voluntarily transfer money to fraudsters.
Who Is Responsible for UPI Fraud: Bank or Payment App?
Responsibility depends on the role performed by each participant in the payment process.
| Entity | Responsibility |
| Payment app | Provides payment services and handles relevant app-level complaints |
| Customer’s bank | Maintains the account and addresses unauthorised debits under applicable RBI rules |
| PSP bank | Facilitates UPI transactions and participates in dispute resolution |
| NPCI | Operates the UPI payment system and its dispute-resolution framework |
| Wallet issuer | Manages prepaid wallet funds and follows applicable RBI customer protection rules |
The responsibility of a bank is therefore different from that of a third-party payment application.
In some cases, the bank may be required to reimburse the customer even when the fraudulent transaction was initiated through a payment app.
How to File a Complaint Against a Payment App for Fraud?
Customers who lose money through a payment app should report the incident immediately. Delays may reduce the possibility of recovering funds.
Step 1: Report the Fraud to the Payment App
The customer should use the official complaint or support facility available within the payment application.
The complaint should include the transaction ID, amount, date, recipient details and a description of the incident.
Step 2: Inform the Bank Immediately
If money was debited from a bank account, the customer should separately inform the bank through its official fraud-reporting channel.
This is important because customer liability under RBI guidelines can depend on how quickly an unauthorised transaction is reported.
Step 3: Report the Fraud to the Cybercrime Authorities
Financial cyber fraud can be reported through the national cybercrime helpline 1930 or the National Cyber Crime Reporting Portal.
Prompt reporting may help authorities trace the transferred funds and initiate measures to prevent further movement of the money. However, recovery is not guaranteed.
Step 4: Approach the RBI Ombudsman
If the complaint concerns a covered RBI-regulated entity and remains unresolved, the customer may approach the RBI Ombudsman.
The Reserve Bank – Integrated Ombudsman Scheme, 2026, came into effect on 1 July 2026, replacing the 2021 Scheme.
Generally, customers must first complain to the concerned regulated entity. An Ombudsman complaint may be filed if the entity rejects the complaint, gives an unsatisfactory response or fails to respond within 30 days, subject to the Scheme’s conditions.
Complaints can be submitted through RBI’s Complaint Management System.
Can Customers Claim Compensation from Payment Apps?
Yes, customers may claim compensation where an actionable deficiency in service, negligence or violation of applicable legal obligations is established.
Under the Consumer Protection Act, 2019, a consumer may seek appropriate relief where the requirements of the Act are satisfied.
Depending on the facts, the available remedies may include:
- Refund of financial loss: A refund may be directed where the bank or payment service provider is legally responsible for the transaction or loss.
- Compensation for deficiency in service: Compensation may be awarded where the consumer establishes the relevant deficiency and resulting harm.
- Other appropriate relief: Consumer Commissions may grant additional relief permitted under the Act, depending on the circumstances.
It is important to distinguish compensation for proven deficiency in service from an automatic refund of every fraudulent payment.
Is UPI Fraud Different from a Failed UPI Transaction?
Yes. A failed UPI transaction occurs when a payment is unsuccessful because of technical or processing issues. UPI fraud involves deception, unauthorised access or other fraudulent conduct.
Under RBI’s framework for failed payment transactions, specified UPI payment failures must be reversed within prescribed timelines.
For qualifying delays, compensation of ₹100 per day may apply beyond the applicable deadline. However, this rule concerns failed transactions and does not create an automatic compensation entitlement for fraudulent payments.
Conclusion
Payment apps can be held responsible for fraud in India when negligence, security failures or deficiency in service is established under applicable law. However, payment apps are not automatically liable for every fraudulent UPI transaction.
RBI guidelines, consumer protection laws and cybercrime reporting mechanisms provide important remedies for affected customers. The outcome depends on whether the transaction was authorised, which entity was responsible and whether the fraud was reported promptly. Understanding these distinctions is essential for determining the legal rights of victims of digital payment fraud.
Join LawBhoomi’s 100K+ Community
