ComplaintAdda
Fact CheckedLast Updated: 21 July 2026Reviewed By: ComplaintAdda Financial Grievance Desk

UPI Fraud Reporting & Fund Recovery Guide

Unified Payments Interface (UPI) is India's most widely used digital payment system, processing billions of transactions monthly across applications like Google Pay, PhonePe, Paytm, BHIM, and bank-specific UPI apps. However, this popularity has made UPI a primary target for cybercriminals employing sophisticated social engineering tricks, malicious QR code traps, fake customer care handles, and remote access trojans. Under National Payments Corporation of India (NPCI) guidelines and Reserve Bank of India (RBI) directives, victims of unauthorized UPI transactions possess clear legal rights to lodge formal chargeback disputes. Taking immediate action within the 'Golden Hour' (first 2 hours post-fraud) by dialing National Cyber Crime Helpline 1930 is the most critical step to freeze stolen funds in suspect accounts before fraudsters launder the money through ATM withdrawals or mule accounts.

Expert Advisory Note & Regulatory Nuance

Remember the fundamental UPI rule: Entering your UPI PIN is strictly required ONLY to DEBIT or SEND money from your account. Receiving a payment or prize NEVER requires entering a UPI PIN or scanning a QR code. In case of fraudulent debit, dial Helpline 1930 within the 2-hour Golden Hour to freeze stolen funds.

What Is It

UPI fraud encompasses various deceptive techniques used to trick account holders into transferring money or compromising their banking credentials. Common categories of UPI scams actionable under Indian law include: (1) Fake Collect Request / 'Receive Money' Scams where fraudsters send a payment collect request, falsely convincing the victim that entering their UPI PIN is required to 'receive' a lottery prize, cashback, or OLX item payment. (2) Malicious QR Code Scams where scammers send a QR code via WhatsApp or email, falsely claiming it will credit funds into the victim's account when scanned. (3) Remote Screen-Sharing Access Scams where fraudsters impersonate bank or app customer support agents and trick victims into installing screen-sharing applications like AnyDesk, TeamViewer QuickSupport, or RustDesk to capture banking passwords and OTPs. (4) Fake Customer Care Number Scams operating through sponsored Google Search ads or fake Twitter handles. (5) Wrongful Account Debit glitches where money is debited due to technical timeout but not credited to the merchant or beneficiary.

When To Use It

Use this guide immediately if money has been fraudulently or mistakenly debited from your bank account via UPI, if you scanned a suspect QR code, or if you accidentally disclosed your UPI PIN/OTP or allowed screen access to an unverified caller claiming to represent Google Pay, PhonePe, Paytm, BHIM, or your bank.

Step-by-Step Process

  1. 1Step 1: Dial National Cyber Helpline 1930 Immediately (Golden Hour Window). Within the first 2 hours of the fraudulent debit, call 1930. Provide the cyber operator with your registered mobile number, Bank Name, UPI Virtual Payment Address (VPA), 12-digit UTR/RRN Transaction Number, and exact timestamp to initiate beneficiary account freezing via the Citizen Financial Cyber Fraud Reporting System (CFCFRMS).
  2. 2Step 2: Block UPI Service & Debit Card via Bank App. Immediately log into your bank's mobile app or net banking portal to block your UPI profile, revoke UPI PIN, and temporarily freeze your linked debit card/account to prevent further debits.
  3. 3Step 3: Register a Formal Dispute on NPCI Portal at npci.org.in. Visit www.npci.org.in, navigate to 'Get in Touch' > 'UPI Dispute Redressal Mechanism' > 'Complaint'. Select Transaction Type as 'Person to Person (P2P)' or 'Person to Merchant (P2M)', select Issue Type as 'Incorrectly transferred to another account' or 'Fraudulent transaction', enter the UTR number, and submit.
  4. 4Step 4: File an Official Cyber Complaint on cybercrime.gov.in. Log into cybercrime.gov.in, select 'Report Financial Fraud', fill in the victim and suspect details, attach transaction screenshots/bank statements, and obtain your 15-digit Cyber Complaint Acknowledgement Number.
  5. 5Step 5: Lodge a Chargeback Form with your Remitter Bank Branch. Visit your bank branch or email their Fraud Monitoring Cell (FMC). Submit a written dispute application citing RBI Circular DBR.No.Leg.BC.78/09.07.005/2017-18 for Unauthorized Electronic Transactions along with the cyber complaint PDF.
  6. 6Step 6: Escalate to the Payment App Nodal Officer. Email the designated Grievance Nodal Officer of your UPI app (Google Pay, PhonePe, Paytm, BHIM) with your UTR reference and cyber complaint copy requesting blacklisting of the fraudster's merchant VPA and mobile device IMEI.
  7. 7Step 7: Escalate to RBI Ombudsman at cms.rbi.org.in. If your remitter bank or NPCI fails to resolve the dispute or refund the unauthorized debit within 30 calendar days, lodge a formal Ombudsman appeal at cms.rbi.org.in.

Documents Required

  • 12-Digit UTR / RRN (Unique Transaction Reference) Number (found on the UPI payment status receipt or SMS alert)
  • Bank Account Statement / Passbook copy highlighting the disputed debit timestamp and amount
  • Uncropped Screenshots of the UPI App Payment Confirmation Screen showing the suspect's VPA / Phone Number
  • Screenshots of WhatsApp chats, SMS collect requests, fake QR codes, or call logs with the scammer
  • Copy of the 15-digit Cyber Crime Complaint Acknowledgement PDF from cybercrime.gov.in
  • Government Identity Proof (Aadhaar Card, PAN Card, or Passport) of the account holder

Fees

Free. Registration of UPI fraud complaints on the National Cyber Crime Portal (1930), NPCI Dispute Portal, Bank Chargeback Cell, or RBI Ombudsman is completely free of charge.

Processing Time

Helpline 1930 triggers beneficiary account freezing within 2 to 4 hours of reporting. NPCI Dispute Resolution takes 3 to 7 working days. Bank Chargeback investigation and final RBI Ombudsman refund resolution takes 30 to 60 calendar days.

Important Tips

  • Remember the golden rule of UPI: You ONLY enter your UPI PIN to SEND or DEDUCT money from your account. Receiving money NEVER requires entering your UPI PIN.
  • Never scan a QR code sent over WhatsApp or email to 'receive' payments or rewards — scanning a QR code ALWAYS debits money.
  • Never install remote screen-sharing tools (AnyDesk, TeamViewer, QuickSupport, RustDesk) at the request of an incoming phone caller.
  • Set daily UPI transaction limits (e.g., ₹10,000 max) in your bank app to minimize exposure in case of account takeover.
  • Verify the recipient's registered bank name displayed on the UPI confirmation screen before approving any payment.

Frequently Asked Questions

Under NPCI guidelines, if an unauthorized or fraudulent UPI debit occurs, reporting it to your bank within 24 to 48 hours enables the remitter bank to raise an automated inter-bank chargeback request through the NPCI Dispute Resolution Mechanism (DRM). If the beneficiary bank has not allowed the funds to be withdrawn, the money is locked and remitted back to the victim's account within 7 working days.
Under RBI Circular DBR.No.Leg.BC.78/09.07.005/2017-18: (1) Zero Customer Liability applies if the unauthorized transaction occurs due to a third-party breach or system glitch and the customer reports it within 3 working days. (2) Limited Liability (up to ₹10,000 for savings accounts) applies if reported within 4 to 7 working days. (3) 100% Customer Liability applies if the fraud occurred because the customer voluntarily shared their UPI PIN or OTP.
Fraudsters initiate a 'Request Money' transaction on the UPI app with an alluring note like 'Cashback Approved ₹5,000' or 'Payment for OLX Item'. When the victim clicks the notification, the app prompts for the UPI PIN. Victims mistakenly believe they are entering the PIN to receive money, but entering the UPI PIN instantly debits the amount from their bank account.
Immediately disconnect your phone's Internet (Wi-Fi & Mobile Data). Uninstall the remote sharing app. Turn off your phone and use another device to call your bank hotline (or dial 1930) to freeze your bank accounts, net banking, and UPI access. Reset all your banking passwords from a safe device.
If cash has been physically withdrawn at an ATM, direct bank chargebacks become impossible. However, the Cyber Police Cell uses the 15-digit cyber complaint acknowledgement number to obtain the ATM CCTV footage, mule account KYC details, and linked IMEI device numbers to arrest the gang under BNS Section 318(4) and seek court-ordered recovery.
Under RBI's Harmonisation of Turn Around Time (TAT) circular (DPSS.CO.PD.No.629/02.01.014/2019-20), if money is debited during a failed UPI transaction (Auto-reversal T+1 day), the bank must reverse the amount within T+1 day. If delayed beyond T+1, the bank must automatically pay compensation of ₹100 per day of delay to the account holder.
If you accidentally sent money to the wrong UPI ID, notify your bank immediately to initiate an 'Erroneous Transfer' resolution. Contact the beneficiary payment app (Google Pay/PhonePe) to request consent-based reversal from the receiver. If the receiver refuses to return the money, lodge a grievance on npci.org.in under 'Incorrectly transferred to another account'.
Yes. The National Cyber Crime Helpline 1930 is connected directly to the Citizen Financial Cyber Fraud Reporting System (CFCFRMS). When you lodge a report, an automated hold alert is dispatched instantly to the beneficiary bank and payment gateway to put a lien on the recipient account balance.
If your bank fails to resolve your written complaint within 30 calendar days or rejects your chargeback request, visit cms.rbi.org.in. Click 'File a Complaint', select your bank, select 'UPI / Digital Transactions Deficiency', attach your bank statement and initial complaint copy, and submit.
This article is for general information only and does not constitute legal advice. Always verify with the official source before acting.