Money has left your bank account through UPI. Maybe you never approved it, or maybe someone tricked you into sending it. Either way, here is what to do and what the rules say.
In short
- Report immediately: call 1930 or use cybercrime.gov.in, and tell your bank.
- Under RBI rules today, if a transaction was unauthorised and you were not at fault, you have zero liability if you report within 3 working days.
- If you shared your PIN or OTP, you may have to bear the loss until you report it.
- New RBI rules apply to transactions from 1 January 2027: a 5-day window, cover for payments made under coercion, and a one-time compensation for small frauds.
- If your bank does not resolve it in 30 days, complain to the RBI Ombudsman at cms.rbi.org.in.
Many UPI frauds start with a message asking for your PIN or OTP, or for a “KYC update”. If a message looks off, paste it into the free ScamRead checker. It flags common warning signs and lists the links and numbers inside.
In this post
- First 3 steps (do these today)
- Unauthorised or tricked: why it matters
- RBI rules today
- What changes from 1 January 2027
- If the bank says no: how to escalate
First 3 steps (do these today)
- Call 1930 or file a complaint at cybercrime.gov.in. This system was set up for quick reporting of money frauds, so banks can try to stop the money before it moves on.
- Tell your bank through its official helpline, app or branch. Ask it to block your account or UPI if needed. Get a complaint number and keep it.
- Raise a dispute in your UPI app. Open the transaction and use the help or complaint option.
Write down the date, time, amount and transaction ID. Take screenshots of messages and call logs. You will need them.
Unauthorised or tricked: why it matters
RBI’s rules treat these two situations differently.
Example 1 (unauthorised): Someone gets access to Priya Example’s UPI without her knowing and sends money. She never approved it.
Example 2 (tricked): A “buyer” sends Priya a QR code and says she will receive money. She scans it and enters her PIN. She approved the payment herself, even though she was fooled.
The current rules are about unauthorised transactions. If you shared your PIN, OTP or password, the rules treat that as customer negligence. A tricked payment like Example 2 is harder to get back, but you should still report it at once. The money may still be traced and held.
RBI rules today (until 31 December 2026)
These come from RBI’s 2017 rules on limiting customer liability in unauthorised electronic banking transactions. Days are counted from when you receive the bank’s alert about the transaction.
| Situation | Your liability |
|---|---|
| The bank was at fault | Zero, even if you did not report it |
| Neither you nor the bank was at fault, and you reported within 3 working days | Zero |
| Same, but reported in 4 to 7 working days | The amount, or a cap of Rs 5,000, Rs 10,000 or Rs 25,000 depending on your account type, whichever is lower |
| Reported after 7 working days | As per your bank’s board-approved policy |
| You shared your PIN, OTP or password | You bear the loss until you report it. The bank bears losses after that. |
Two more rules help you. The bank must credit the disputed amount to your account within 10 working days of your report, while it looks into it. And the bank, not you, has to prove you were at fault. Complaints must be settled within 90 days.
What changes from 1 January 2027
In June 2026, RBI issued new final rules for fraudulent electronic banking transactions. They apply to transactions made on or after 1 January 2027.
- A “fraudulent” transaction now also includes one you approved under coercion or duress by someone else, for example while being threatened.
- If neither you nor the bank was at fault, you have zero liability if you report within 5 calendar days.
- Banks must settle domestic fraud complaints within 45 calendar days.
- Small-value compensation: an individual who loses up to Rs 50,000 can get 85% of the net loss or Rs 25,000, whichever is lower. It is available once in a lifetime. You must report to both 1930 or cybercrime.gov.in and your bank within 5 calendar days. This applies to frauds in the first year of the new rules.
If the bank says no: how to escalate
- Your UPI app, then the banks: NPCI says complaints go first to the UPI app, then the banks involved. NPCI is the last level in this chain.
- RBI Ombudsman: if your bank does not reply within 30 days, or you are unhappy with its reply, file a free complaint at cms.rbi.org.in under the RBI Integrated Ombudsman Scheme, 2026. File within 90 days after that.
- Need help? RBI’s toll-free number 14448 can guide you, but complaints are filed online.
Be careful of anyone who calls promising to “get your money back” for a fee. Read how recovery scams work. And to avoid fake payment pages in future, learn how to check if a website is a scam.
What to do: quick checklist
- Call 1930 or report on cybercrime.gov.in now.
- Report to your bank and get a complaint number.
- Raise a dispute in your UPI app.
- Keep screenshots, transaction IDs and dates.
- After 30 days with no fix, go to cms.rbi.org.in.
Report it: If you lost money or shared bank details, call the national cyber crime helpline 1930 straight away, or file a complaint at cybercrime.gov.in.
Before you act on the next “urgent” bank or UPI message, paste it into the free ScamRead checker for a quick second opinion.
This post is general information, not legal advice.