UPI Fraud Happened? Know the Legal Rights and Refund Rules
If you have lost money through UPI fraud, Indian law provides several ways to protect your rights and seek recovery. Under RBI rules, customers may have zero or limited liability for certain unauthorised transactions. You can also report the fraud to your bank, call the cybercrime helpline at 1930 and file a complaint with the RBI Ombudsman if the bank fails to resolve the issue.
What Is UPI Fraud?
UPI fraud happens when someone dishonestly obtains money through the Unified Payments Interface (UPI). Fraudsters may use fake payment requests, phishing links, QR codes, impersonation or unauthorised access to bank accounts.
Add LawBhoomi as your preferred source on Google.
For example, a fraudster may pretend to be a customer care executive and ask for your UPI PIN. In another situation, someone may convince you to scan a QR code to receive a refund, when the actual purpose is to debit money from your account.
Not all UPI fraud cases are legally identical. Some involve transactions made without the customer’s permission, while others involve payments that customers authorise after being deceived.
This difference is important because RBI refund rules mainly protect customers against qualifying unauthorised electronic banking transactions.
Who Is Responsible When UPI Fraud Happens?
The responsibility for UPI fraud depends on how the transaction occurred and whether the bank, customer or another party was responsible.
Explore the latest legal opportunities for law students and lawyers.
Under RBI’s customer protection framework, a bank may be required to bear the loss when an unauthorised transaction results from its negligence or a qualifying third-party security breach.
However, if you voluntarily disclose payment credentials or approve a fraudulent transaction, the liability may be different.
The RBI issued directions titled Customer Protection – Limiting Liability of Customers in Unauthorised Electronic Banking Transactions on 6 July 2017. These directions explain when customers have zero liability, limited liability or responsibility for the financial loss.
What Are the RBI Rules for UPI Fraud Refunds?
Zero Liability When the Bank Is Responsible
If an unauthorised UPI transaction occurs because of fraud, negligence or a deficiency attributable to the bank, the customer has zero liability under the applicable RBI framework.
For example, if money is transferred without authorisation because of a security failure attributable to the bank, the customer may be entitled to reimbursement.
This protection applies regardless of when the customer reports the unauthorised transaction. However, the circumstances must establish that the bank was responsible.
Zero Liability When Fraud Is Reported Within 3 Working Days
You may also have zero liability when an unauthorised transaction results from a third-party breach, provided neither the bank nor the customer is responsible.
For this protection, the bank must be informed within three working days of receiving communication about the unauthorised transaction.
Learn at your own pace with LawBhoomi's recorded law courses.
The reporting period excludes the date on which the customer receives the bank’s communication. Working days are calculated according to the schedule of the customer’s home branch.
For example, if ₹15,000 is transferred without your permission because of a qualifying third-party breach and you report it within the prescribed period, the RBI framework provides for zero customer liability.
Limited Liability When Fraud Is Reported Within 4 to 7 Working Days
If a qualifying third-party breach is reported between four and seven working days, the customer’s liability may be limited.
For covered scheduled commercial banks, RBI prescribes different maximum liability amounts depending on the account category.
| Account Type | Maximum Customer Liability |
| Basic Savings Bank Deposit account | ₹5,000 |
| Other savings accounts and specified eligible accounts | ₹10,000 |
| Higher-limit current accounts and specified credit cards | ₹25,000 |
The customer bears the transaction amount or the prescribed maximum, whichever is lower.
For reports made after seven working days, liability is determined according to the bank’s board-approved policy.
If you share your UPI PIN or other confidential payment credentials with a fraudster, RBI may treat the resulting unauthorised transaction as a case involving customer negligence.
Under the applicable framework, the customer bears the loss resulting from such negligence until the incident is reported to the bank.
However, any subsequent unauthorised loss after the bank receives the report must be borne by the bank.
Explore LawBhoomi's free law library for students and lawyers.
For example, if a fraudster obtains your UPI PIN and withdraws ₹10,000 before you report the incident, you may be responsible for that loss. But if further unauthorised transactions occur after reporting, the bank’s liability rules become relevant.
Importantly, entering a UPI PIN after being tricked into making a payment is not always treated in the same way as a transaction made without authorisation. Each situation requires examination of the facts.
Can You Get Your Money Back After UPI Fraud?
Yes, money lost through UPI fraud can sometimes be recovered. However, a refund is not guaranteed in every case.
In qualifying unauthorised electronic banking transactions, RBI requires the bank to provide a provisional credit, commonly called a shadow reversal, within 10 working days of receiving the complaint.
The bank must determine customer liability and resolve the complaint within the period specified in its policy, subject to a maximum of 90 days.
The bank also bears the burden of proving customer liability in an unauthorised electronic banking transaction.
These protections do not mean that every payment voluntarily made to a fraudster must automatically be refunded.
What Should You Do Immediately After UPI Fraud?
Taking quick action can improve the possibility of preventing further financial loss and recovering money.
Step 1: Call the Cybercrime Helpline at 1930
The first important step is to report the financial fraud through the National Cybercrime Helpline at 1930.
Provide details such as the transaction amount, bank name, UPI transaction ID and time of the incident.
The reporting mechanism allows authorities and participating financial institutions to initiate action to trace and restrict the movement of suspected fraudulent funds.
Step 2: Report the Fraud to Your Bank
Immediately contact your bank through its official customer care number, mobile banking application or branch.
Explain the fraudulent transaction and request that the complaint be registered.
Ask the bank to take appropriate steps to secure your account and prevent further unauthorised transactions.
Keep the complaint reference number because it may be required for future legal proceedings.
Step 3: File an Online Cybercrime Complaint
Visit the National Cyber Crime Reporting Portal and register the incident.
The complaint should include relevant transaction details, the suspected fraudster’s information, if available, and supporting evidence.
If the complaint is initially reported through 1930, complete the required online registration promptly using the acknowledgement details.
Step 4: Preserve Evidence
Keep screenshots of transactions, bank statements, suspicious messages, phone numbers and communications with the alleged fraudster.
These records may help the bank, cybercrime authorities or RBI Ombudsman understand what happened.
The National Cybercrime Reporting Portal specifically requests transaction information and relevant evidence for financial fraud complaints.
What if the Bank Refuses to Refund the Money?
If the bank rejects the refund request or fails to resolve the complaint satisfactorily, you may approach the RBI Ombudsman.
The Reserve Bank – Integrated Ombudsman Scheme, 2026, effective from 1 July 2026, provides a free mechanism for resolving eligible complaints involving deficiencies in services provided by RBI-regulated entities.
How to File a Complaint With the RBI Ombudsman
The bank must first be given an opportunity to address the complaint.
Generally, a complaint can be escalated when the bank rejects it, provides an unsatisfactory response or fails to respond within the applicable period, ordinarily 30 days unless a longer prescribed period applies.
The complaint can be submitted through the RBI Complaint Management System.
It should contain the original complaint details, relevant supporting documents, the bank’s response and the relief requested.
The Ombudsman can examine eligible complaints and grant appropriate relief under the Scheme. However, the Ombudsman does not automatically order a refund merely because fraud has occurred.
Can Criminal Action Be Taken Against UPI Fraudsters?
Yes. UPI fraud may constitute a criminal offence under Indian law, depending on the manner in which the fraud was committed.
The following provisions may be relevant:
- Section 318 of the Bharatiya Nyaya Sanhita, 2023: This section deals with cheating. It may apply when someone dishonestly deceives another person and induces the transfer of money.
- Section 319 of the Bharatiya Nyaya Sanhita, 2023: This provision deals with cheating by personation. It may apply when a fraudster pretends to be a bank employee or another person to obtain money.
- Section 66C of the Information Technology Act, 2000: This section concerns identity theft, including dishonest or fraudulent use of another person’s password or other unique identification feature.
- Section 66D of the Information Technology Act, 2000: This section addresses cheating by personation through computer resources or communication devices.
A criminal complaint may help authorities investigate the fraud and pursue action against those responsible. However, criminal proceedings and banking refund claims are separate legal processes.
Is UPI Fraud Different From a Failed UPI Transaction?
Yes. A failed UPI transaction occurs when money is debited but the intended payment is not completed successfully. UPI fraud involves dishonest conduct intended to obtain money.
RBI has prescribed separate refund timelines for failed UPI transactions.
| Failed Transaction | Refund Timeline | Compensation for Delay |
| Money debited but beneficiary not credited | T+1 day | ₹100 per day beyond the deadline |
| Merchant payment debited but confirmation not received | T+5 days | ₹100 per day beyond the deadline |
Here, T means the transaction date.
These compensation rules apply to specified failed payment situations. They do not automatically apply when a successful UPI transfer is made to a fraudster.
How Can UPI Fraud Be Prevented?
Although legal remedies are available, preventing fraud remains important.
Some essential precautions include:
- Never share a UPI PIN: Banks and legitimate payment services do not require customers to disclose UPI PINs for receiving money. A UPI PIN is generally used to authorise outgoing payments.
- Verify payment requests: Before approving a UPI collect request, check the recipient, amount and transaction purpose. Fraudsters may disguise payment requests as refunds or rewards.
- Avoid suspicious links and applications: Fraudsters often use fake websites and remote access applications to obtain financial information or control devices.
- Use official customer support channels: Customer care numbers should be obtained from official banking websites or applications rather than unknown messages or advertisements.
These precautions can reduce exposure to common UPI fraud methods.
Conclusion
UPI fraud victims have several legal remedies under Indian banking regulations and criminal laws. RBI provides zero or limited liability protection for qualifying unauthorised transactions, while the cybercrime reporting system helps authorities trace fraudulent payments.
If you experience UPI fraud, immediately report the incident to your bank and the 1930 cybercrime helpline. Where the bank fails to address an eligible complaint, the RBI Ombudsman offers an additional remedy.
The possibility of recovering money ultimately depends on the nature of the fraud, customer conduct, reporting time and applicable legal protections.
Join LawBhoomi’s 100K+ Community
