Act within hours, not days. Report the fraud to the cyber crime helpline 1930 and to your bank immediately – how fast you report decides how much you can get back.
Do this right now: call 1930 (National Cyber Crime Helpline) or report at cybercrime.gov.in, then call your bank to block UPI, cards and net banking.
Your liability under RBI rules
RBI’s customer-protection rules for unauthorised electronic transactions limit what you lose if you were not at fault:
| Situation | Your liability |
|---|---|
| Fraud due to the bank’s fault or a system breach, whether or not you report | Zero |
| Third-party breach (neither you nor bank at fault), reported within 3 working days | Zero |
| Same, reported in 4–7 working days | Limited, capped by account type |
| Loss due to your negligence (e.g. sharing OTP or PIN) | Full loss until you report; bank bears loss after reporting |
Step by step
- Report on 1930 / cybercrime.gov.in and note the acknowledgement number.
- Report to the bank in writing (app, email or branch) with the transaction IDs. Ask for a complaint number.
- The bank should credit the amount (a “shadow reversal”) within 10 working days of your report where you are not liable, and resolve the complaint within 90 days.
- Keep screenshots, call logs, SMS and the fraudster’s UPI ID or number.
- If the bank refuses or delays, complain to the RBI Ombudsman after 30 days.
Common UPI frauds
- “Scan this QR to receive money” – you never need a PIN to receive money.
- Fake customer-care numbers from search results.
- Screen-sharing apps installed at a caller’s request.
- Fake “digital arrest” calls claiming to be police, CBI or customs.
This is general information, not legal advice. For more details, do consult a lawyer or a subject-matter expert about your own case.