Reclaim & Rights · 7 min read
You have been defrauded on UPI. What to do in the first hour
Reporting inside three working days is what caps your liability. The order to do things in, and the one number to call.
Krish Dalal
Founder and editor, PaisaExpert. Master's in Business Management, SP Jain School of Global Management, London. · Last updated 2026-09-05
Speed matters more than completeness here. A partial report filed in the first hour is worth more than a perfect one filed tomorrow, because money moves through mule accounts fast and the only realistic chance of a freeze is early.
The order to do it in
- Call 1930, the national cyber crime helpline. This is what can trigger a freeze on the receiving account.
- File the complaint at cybercrime.gov.in and keep the acknowledgement number.
- Report to your bank in writing, through the app or net banking, so there is a timestamped record. A phone call alone is not a record.
- Note the UPI transaction reference number, the amount, the exact time and the UPI ID or account it went to.
- If a card or account is compromised rather than a one-off transfer, block it.
What the liability rules actually say
| When you report | Your liability for an unauthorised transaction |
|---|---|
| Within 3 working days | Nil |
| 4 to 7 working days | Limited, up to a capped amount that depends on the account type |
| Beyond 7 working days | Governed by the bank's own policy, which is where people lose everything |
The important distinction is between an unauthorised transaction and one you authorised while being deceived. If someone gained access and moved your money, these rules protect you. If you were talked into approving the payment yourself, recovery is much harder, because from the bank's side the transaction is valid. That is precisely why the frauds that work are the ones that get you to press approve.
The tells worth knowing
- You never enter a UPI PIN to RECEIVE money. Any request to enter a PIN in order to be paid is a fraud, without exception.
- A collect request is a request for money from you, not a payment to you. Read what the screen actually says before approving.
- No bank, no UPI app and no government body asks for an OTP, a PIN or a screen-sharing app. Screen sharing is the mechanism behind most large losses.
- A QR code scan sends money. It does not receive it.
- Urgency is the tool. Anything demanding you act in the next two minutes is worth two minutes of not acting.
If the bank refuses
Escalate in writing to the bank's grievance officer and give them thirty days. After that, or on an unsatisfactory reply, take it to the RBI Ombudsman at cms.rbi.org.in. It is free, it is online, and it exists for exactly this. Keep your cybercrime acknowledgement number, because it establishes when you reported.
What to do next
- Save 1930 in your phone now, before you need it.
- Check whether your UPI app lets you switch to a username-based ID instead of your mobile number.
- Tell the oldest person in your family that a PIN is never needed to receive money.