Last updated: November 2026. If money has just left your account because of a fraud, stop reading and call 1930 (the national cyber-crime helpline) or file a complaint at cybercrime.gov.in right now. Then come back for the remaining steps.
UPI has made paying for anything in India as easy as scanning a code. Unfortunately, it has made stealing money just as easy for fraudsters. The good news is that a large share of UPI fraud money can be frozen and returned — if you act quickly and report it through the right channels. Every hour you wait gives the fraudster time to move the money through several “mule” accounts and withdraw it.
This guide explains exactly what to do, in order, and what your bank is required to do under Reserve Bank of India (RBI) rules.
Step 1: Call 1930 immediately (the “golden hour”)
The 1930 helpline is run under the Ministry of Home Affairs’ Citizen Financial Cyber Fraud Reporting and Management System. When you report, the details of the transaction are sent electronically to your bank and to the bank that received the money, which can then put a hold on the amount in the fraudster’s account if it is still there.
Keep this information ready before you call:
- Your bank name and account number (or the linked mobile number)
- The UPI transaction ID / UTR number (12 digits, shown in your UPI app’s history)
- Date, time and amount of each fraudulent transaction
- The UPI ID, phone number or QR code the money went to
- Screenshots of chats, call logs or messages from the fraudster
You will receive an acknowledgement number. Write it down — you need it for every follow-up. If you cannot get through on the phone, file the complaint online at cybercrime.gov.in under “Report Cyber Crime → Financial Fraud”.
Step 2: Tell your bank and block UPI
Next, inform your bank through its official customer care number (printed on your debit card or passbook — never one found through a web search), net banking or the bank’s app. Ask them to:
- Block UPI and debit-card transactions on the account temporarily.
- Register a formal complaint for an unauthorised electronic transaction and give you a complaint reference number.
- Note the exact date and time you reported it. Under RBI rules, the clock for your liability is counted from this moment.
Also raise a dispute inside the UPI app you used (Google Pay, PhonePe, Paytm, BHIM and others all have a “Report a problem” or “Raise dispute” option on each transaction). This creates a record with NPCI, the organisation that runs UPI.
Step 3: Secure your phone and accounts
- Change your UPI PIN and your net-banking password.
- Uninstall any screen-sharing or remote-access app (such as AnyDesk or TeamViewer) the fraudster asked you to install.
- Check for unknown apps with permission to read SMS or notifications, and remove them.
- If your SIM stopped working suddenly, contact your mobile operator — it could be a SIM-swap.
Our smartphone security guide walks you through a full clean-up.
Step 4: File a police complaint (FIR) if the amount is large
Your online complaint on cybercrime.gov.in is forwarded to the cyber cell of your state. For larger amounts, also visit your nearest police station or cyber police station with printouts of your complaint, bank statement and screenshots, and ask for an FIR. Banks and courts often ask for a copy of the FIR before releasing frozen money back to you.
What your bank must do: RBI’s customer liability rules
RBI’s 2017 circular on limiting customer liability in unauthorised electronic banking transactions decides how much of the loss you bear. The key factor is how quickly you report and whose fault the breach was.
| Situation | Your liability |
|---|---|
| Fraud caused by the bank’s own lapse (whether or not you report) | Zero |
| Third-party breach (not your fault, not the bank’s), reported within 3 working days | Zero |
| Third-party breach reported in 4–7 working days | The transaction value or a fixed cap (₹5,000, ₹10,000 or ₹25,000 depending on account type), whichever is lower |
| Reported after 7 working days | As per the bank’s board-approved policy |
| Loss due to your own negligence (for example, you shared your UPI PIN or OTP) | You bear the full loss until you report it; the bank bears losses after you report |
Where you are not liable, the bank is required to credit the disputed amount to your account (a “shadow credit”) within 10 working days of your report, and to resolve the complaint within 90 days.
An honest note: most UPI scams trick you into approving the payment yourself — entering your PIN on a collect request or scanning a QR code. Banks usually treat these as “authorised” transactions, so the RBI zero-liability rule may not apply. In such cases your best chance of recovery is the money being frozen in the fraudster’s account through your 1930 complaint. That is why speed matters so much.
If the bank does not help: escalate
- Bank’s grievance officer / nodal officer: details are on every bank’s website under “Grievance Redressal”.
- RBI Ombudsman: if the bank rejects your complaint, gives an unsatisfactory reply, or does not reply within 30 days, you can complain free of cost on RBI’s Complaint Management System at cms.rbi.org.in.
- Court: for frozen money that is not being released, the police or a magistrate’s order may be needed. A lawyer can guide you.
The 8 most common UPI scams in 2026
| Scam | How it works | Red flag |
|---|---|---|
| “Receive money” collect request | The fraudster sends a collect request and says you must enter your PIN to receive money. | You never need a PIN to receive money. |
| QR code to “get paid” | A buyer on OLX or Facebook sends a QR code to “pay” you. | Scanning a QR code is always for paying, never receiving. |
| Fake customer care | You search online for a helpline and call a fake number. | Real support never asks for your PIN or to install an app. |
| Screen-sharing | “Support” asks you to install a remote-access app to “fix” a refund. | Anyone asking for remote access to your phone. |
| KYC / electricity / SIM “deactivation” | An SMS warns your account or connection will be cut off today. | Urgency and a personal mobile number or a link. |
| Wrong transfer, “please return” | Someone sends a small amount, then asks you to return a larger one. | Check your bank statement, not their screenshot. |
| Task / part-time job | You earn small payouts for “likes”, then must deposit to unlock earnings. | Any job that asks you to pay first. |
| “Digital arrest” | Callers pretending to be police, CBI or customs demand money to “clear” your name. | No agency in India arrests or settles cases on a video call. |
We cover more of these tricks in our article on online scams. You can also report a suspected fraud call or SMS — even if you did not lose money — using the Chakshu facility on the government’s Sanchar Saathi portal.
Seven habits that prevent UPI fraud
- Remember the golden rule: the UPI PIN is only for sending money.
- Read every screen before entering your PIN — check the name, the amount, and whether it says “Pay” or “Request”.
- Set a daily UPI limit in your bank or UPI app that matches your real spending.
- Use a separate account for UPI with a small balance, and keep savings in another account.
- Turn on app lock (fingerprint or face) for every payment app.
- Never install apps from links sent on WhatsApp or SMS, especially files ending in .apk.
- Pause and verify — scammers depend on panic. Hang up and call the organisation yourself on its official number.
For a broader look at staying safe with digital payments, see our guide to credit card mistakes to avoid — many of the same rules apply.
Frequently asked questions
How long does it take to get UPI fraud money back?
It varies. If the bank accepts that you are not liable, it must give a shadow credit within 10 working days. If your money was frozen in the fraudster’s account, its release can take weeks or months because the police and sometimes a court must approve it.
Can a UPI payment be reversed?
A completed UPI payment cannot be cancelled like a cheque. It can only be returned by the receiver, or frozen and refunded through the bank and police process described above.
I sent money to the wrong UPI ID by mistake. Is that fraud?
No, that is a mistaken transfer. Raise a complaint in your UPI app and with your bank, which will contact the receiver’s bank. The receiver must agree to return it, so it helps to act quickly.
Is reporting on 1930 free?
Yes. Reporting on 1930, cybercrime.gov.in and the RBI complaint portal is completely free. Be wary of anyone who offers to “recover” your money for a fee — that is often a second scam.
Disclaimer: This article is general information to help you act quickly; it is not legal advice. Rules and helpline processes can change, so always follow the instructions given by your bank, the 1930 helpline and the police. Read our full disclaimer.