UPI Fraud & Digital Payment Fraud: Legal Remedies in India

UPI Fraud has made sending money as easy as sending a text — which is exactly why fraudsters love it. Fake QR codes, “KYC update” links, impersonated bank officials, and remote-access apps have turned digital payment fraud into one of India’s fastest-growing crimes. <cite index=”7-1″>According to RBI data submitted to the Ministry of Finance in a Lok Sabha session, UPI fraud incidents nearly doubled from 7.25 lakh cases in FY 2022–23 to 13.42 lakh in FY 2023–24.</cite> <cite index=”12-1″>Industry estimates suggest roughly ₹1,000 crore is lost to UPI fraud every quarter in India.</cite>

The good news: Indian law gives victims several overlapping remedies — banking, criminal, regulatory, and civil. This guide breaks down exactly what to do, which laws apply, how the recovery process actually works, and what to expect at every stage.

Why UPI Fraud Is Growing So Fast in India

<cite index=”3-1″>India’s leap into digital finance has been remarkable — the country has over 900 million internet users, a booming fintech ecosystem, and one of the world’s largest smartphone markets.</cite> But <cite index=”3-1″>that convenience has also given fraudsters a frictionless tool to move stolen money instantly,</cite> and <cite index=”3-1″>what was once a niche IT-department concern has become a mainstream, everyday threat.</cite>

Three structural factors make UPI fraud particularly hard to stop:

1. Speed of settlement. Once money leaves your account via UPI Fraud, it can be layered across multiple “mule” accounts within minutes, making it far harder to trace than a traditional bank transfer.
2. Social engineering over technical hacking. <cite index=”2-1″>While the technology underlying UPI is highly secure, cybercriminals overwhelmingly exploit human behaviour rather than technical vulnerabilities</cite> — fear, urgency, and impersonation do the work that hacking would otherwise need to do.
3. Cross-border operations. <cite index=”16-1″>Fraudsters often operate from foreign jurisdictions, making extradition and international legal cooperation complex,</cite> and <cite index=”16-1″>there remains a limited availability of trained cyber-forensic experts to support fast-moving investigations.</cite>

Common Types of UPI & Digital Payment Fraud

Understanding how these scams work is the first step to protecting yourself — and to proving your case later, since courts and Ombudsman officers will want to know exactly how the fraud unfolded.

• Fake QR code scams — <cite index=”2-1″>fraudsters send QR codes claiming the victim will “receive” money, but scanning them actually authorizes an outgoing payment.</cite> <cite index=”17-1″>A common misconception is that scanning a QR code “receives” money — in reality, many QR code interactions authorize outgoing payments.</cite>
• Fake customer care numbers — <cite index=”2-1″>victims searching for helpline numbers online land on fraudulent websites, where scammers extract OTPs, banking credentials, or remote device access.</cite>
• Remote-access app fraud — <cite index=”2-1″>victims are persuaded to install apps that let fraudsters control the device and access banking apps directly.</cite>
• Fake KYC update messages — <cite index=”2-1″>victims get urgent “your account/wallet needs KYC verification” messages, directing them to fraudulent websites that harvest credentials.</cite>
• Vishing/phishing calls — <cite index=”3-1″>callers impersonate bank officials, warn that the account will be blocked, and walk the victim through steps that end in an authorized payment or a shared OTP — often in under ten minutes, after which funds vanish across a chain of mule accounts almost impossible to trace within hours.</cite> <cite index=”3-1″>Phishing more broadly involves fake emails or websites mimicking legitimate institutions — banks, the Income Tax Department, IRCTC, e-commerce platforms — to harvest login credentials.</cite>
• SIM-swap fraud — <cite index=”17-1″>criminals fraudulently gain control of a victim’s mobile number through duplication or telecom manipulation, then use that access to enter banking systems and initiate unauthorized transactions.</cite>
• Fraud via gaming, betting, and investment platforms — <cite index=”11-1″>a significant share of online transaction fraud today occurs through gaming apps, betting apps, Telegram links, cryptocurrency platforms, and peer-to-peer transactions.</cite>
• Impersonation of support staff — <cite index=”14-1″>fraudsters impersonate payment-app or bank support executives to extract sensitive details like the UPI PIN, which then leads directly to unauthorized debits.</cite>

The Golden Rule: Report Within 3 Working Days

This is the single most important fact in this entire guide. <cite index=”7-1″>Under RBI’s zero-liability rules, if you report an unauthorized transaction within three working days, the bank must refund the full amount.</cite> Miss that window, and <cite index=”7-1″>your refund turns into a negotiation where the bank decides how much liability you bear.</cite>

However, there’s a critical catch: <cite index=”7-1″>RBI’s zero-liability protection only applies to transactions you genuinely did not authorize — if you entered your own UPI PIN, even under a scammer’s instructions, banks typically classify it as “authorized” and refuse a refund on that basis alone.</cite> This is why lawyers, the Ombudsman, and consumer forums matter — negligence and deficiency-of-service arguments can still get you a remedy even when the strict “zero liability” rule doesn’t apply.

It also helps to understand how liability is generally split under RBI’s customer-protection framework:

• Bank/system fault, reported promptly: Zero liability — full refund expected.
• Third-party breach beyond your control, reported promptly: <cite index=”18-1″>Limited or zero liability, depending on how quickly the unauthorized transaction was reported.</cite>
• Customer shared PIN/OTP/password: <cite index=”18-1″>The customer may bear the loss for the period before reporting; losses occurring after the transaction is reported may be treated differently.</cite>

Step-by-Step: What to Do Immediately

<cite index=”12-1″>The first 30 minutes after fraud is discovered are often what decide whether the money is recoverable.</cite> Treat this like a checklist you run through in order, not a menu you pick from.

READ MORE Instagram & WhatsApp Legal Threats: When Do Online Messages Become Criminal?

Step 1: Call 1930 and Freeze the Flow

<cite index=”12-1″>Dial 1930, the national cybercrime helpline, immediately — this step is what can trigger the freezing of the receiving account.</cite> This helpline is available 24/7 — <cite index=”7-1″>don’t wait for “business hours”; the helpline and your bank’s fraud team both work round the clock, and every minute of delay reduces the chance of blocking the fraudster’s account before the money moves further.</cite>

Step 2: Report to Your Bank in Writing

Call your bank’s UPI fraud helpline and follow up with a written complaint. <cite index=”19-1″>Get a written acknowledgment with a complaint reference number.</cite> <cite index=”16-1″>Banks are obligated to reverse the amount within 10 working days once zero-liability conditions are met.</cite> If the front-line customer care doesn’t resolve things, <cite index=”4-1″>escalate in writing to the bank’s designated Grievance Redressal Officer (GRO), whose contact details must be published on the bank’s website under RBI requirements.</cite>

Step 3: File a Complaint on cybercrime.gov.in

<cite index=”9-1″>File a complaint on the National Cyber Crime Reporting Portal (cybercrime.gov.in)</cite> under “Financial Fraud,” within 24 hours if possible. <cite index=”4-1″>This creates a systemic record supporting both the bank’s fraud investigation and any criminal case, and it triggers NPCI-level monitoring of the flagged transaction.</cite>

Step 4: Raise a Dispute Through the UPI App / NPCI

<cite index=”4-1″>You have the right to approach NPCI through your bank for a formal dispute under the UPI Dispute Management System.</cite> Note your Ticket/Reference Number for every escalation — <cite index=”7-1″>these numbers become important exhibits if you need to escalate the matter further.</cite>

Step 5: File an FIR

<cite index=”6-1″>Visit your nearest police station and file an FIR citing the relevant IT Act and criminal law sections. If police refuse to register it, you can approach the DCP or move a court under the relevant CrPC/BNSS provision for a direction to register the FIR.</cite> <cite index=”19-1″>A UPI scam is a cognizable criminal offense, and the FIR or official complaint acknowledgment becomes vital evidence for your later case against the bank as well.</cite>

Step 6: Escalate to the RBI Ombudsman

<cite index=”4-1″>If your bank fails to resolve your complaint within 30 days, you can escalate to the RBI Integrated Ombudsman.</cite> <cite index=”6-1″>The Ombudsman has the authority to direct banks to refund unauthorized UPI debits,</cite> and under the scheme’s compensation powers, <cite index=”20-1″>can direct compensation of up to ₹20 lakh for the customer’s loss and up to ₹1 lakh separately for mental agony and harassment.</cite>

Step 7: Consider Consumer Court or Civil Action

If the bank’s handling itself was negligent — for example, failing to act on a timely report — <cite index=”14-1″>you can file a consumer dispute for gross negligence or deficiency of service, such as a failure to act after you called the cyber crime helpline or a refusal to execute a statutory freeze.</cite> <cite index=”12-1″>Consumer District Forums are free to approach for claims up to ₹50 lakh under the Consumer Protection Act, 2019.</cite>

Which Laws Actually Apply?

India’s legal framework for digital payment UPI fraud draws from criminal law, cyber law, banking regulation, and consumer protection — often simultaneously, and victims are not required to pick only one.

Criminal Law: Bharatiya Nyaya Sanhita (BNS), 2023

<cite index=”4-1″>The BNS applies to UPI fraud cases from 1 July 2024 onward. Section 318 covers cheating, Section 336 covers forgery, and Section 316 covers criminal breach of trust</cite> — the core provisions used in UPI fraud prosecutions. Where a fraudster keeps money that was mistakenly transferred and refuses to return it, <cite index=”15-1″>Section 314 of the BNS (dishonest misappropriation of property) can also apply.</cite> Older cases filed before 1 July 2024 may still reference the corresponding IPC provisions — <cite index=”13-1″>Section 420 IPC for cheating and dishonestly inducing delivery of property, and Section 406 IPC for criminal breach of trust.</cite>

Information Technology Act, 2000

<cite index=”1-1″>Section 66C addresses identity theft, and Section 66D addresses cheating by personation using a computer resource</cite> — the exact scenario in most phishing and fake-helpline scams.

RBI Guidelines and Circulars

<cite index=”5-1″>RBI’s Online Dispute Resolution (ODR) mandate requires rule-based, system-driven resolution for digital payment disputes, starting with failed transactions, and unresolved cases can be escalated to the RBI Integrated Ombudsman.</cite> The foundational customer-liability framework traces back to <cite index=”5-1″>RBI’s 2017 circular on limited/zero liability for unauthorized electronic transactions,</cite> and banks are separately required to publish <cite index=”8-1″>a Board-approved cyber-security policy covering the risks from cyber threats and the measures to address them.</cite>

Consumer Protection Act, 2019

<cite index=”4-1″>This law provides recourse against banks and payment service providers for deficiency in service — delayed reversals, mishandled complaints, or failure to meet RBI’s grievance-redressal timelines.</cite> <cite index=”12-1″>Consumer courts (district forums) are free to approach for claims up to ₹50 lakh under the 2019 Act.</cite>

Civil Remedies

<cite index=”2-1″>In high-value UPI fraud cases, especially involving businesses or substantial losses, civil proceedings focused on compensation, tracing, and recovery — rather than prosecution — may become necessary,</cite> including <cite index=”2-1″>asset preservation orders.</cite> <cite index=”2-1″>Unlike criminal proceedings, which focus on prosecuting the wrongdoer, civil proceedings focus squarely on compensation and recovery for the victim.</cite>

The Investigation Process: What Happens After You Report

Many victims assume filing a complaint is the end of their job — in practice, it’s just the start of a multi-agency process.

• Layered account tracking. <cite index=”11-1″>When cybercrime police receive or intercept a complaint about a fraudulent transaction, they mark the transaction on a layered basis and proceed accordingly — accounts marked under the first layers can face search, seizure, and a call for production of documents under the relevant BNSS provisions.</cite>
• Coordination between agencies. <cite index=”5-1″>The National Cyber Crime Reporting Portal (NCRP) and the Indian Cyber Crime Coordination Centre (I4C) coordinate closely, but the actual freezing or unfreezing of accounts happens through State/UT law enforcement under BNSS/CrPC procedures — not directly through I4C.</cite>
• A widening toolkit for investigators. <cite index=”5-1″>A “suspect repository” is increasingly used to flag identifiers linked to a case, and automation of chargeback acceptance and rejection within UPI is gradually helping to shrink resolution delays.</cite>

Evidence You Must Preserve

Your recovery chances rise sharply with clean documentation. Keep:

• Bank debit SMS/email with UTR/RRN/Transaction ID
• Screenshots of the fraudster’s UPI ID, phone number, or chat
• Screenshot of any QR code scanned
• Written complaint to the bank (with acknowledgment/reference number)
• Cybercrime portal complaint acknowledgment and FIR copy
• Call recordings, where legally permissible

Banking Ombudsman vs. Consumer Court vs. Civil Suit — Which One?

Remedy	Best For	Typical Timeline
RBI Ombudsman	Bank denial/delay on a covered unauthorized transaction	<cite index=”7-1″>2–3 months, with relatively high success rates when the escalation chain was followed properly</cite>
Consumer Court	Deficiency of service by bank/PSP, damages for mental agony	Weeks to months; filing is largely free for smaller claims
Civil Suit	Large-value fraud, asset tracing, urgent restraint orders	Longer, but necessary for high-value or complex recovery
Criminal (FIR/Police)	Prosecuting the fraudster, freezing funds, gathering evidence	Immediate filing; investigation can take longer

<cite index=”10-1″>These remedies are not mutually exclusive — a criminal complaint for cheating and personation, a consumer dispute over service deficiency, an Ombudsman complaint against the bank, and a civil remedy for asset tracing can all run in parallel, since one remedy does not cancel out another.</cite> <cite index=”10-1″>A thorough approach maps the whole field of available remedies rather than blindly chasing just one path.</cite>

Common Bank Defences — And Why They’re Not Final

<cite index=”10-1″>Banks and payment service providers commonly resist claims by alleging customer negligence, relying on transaction authentication logs, or arguing they are merely intermediaries with limited responsibility.</cite> None of these defences is automatically the end of the road — <cite index=”10-1″>each needs to be tested against the actual facts, internal bank logs, fraud-response timelines, and the customer’s real conduct before and after the incident.</cite>

Why Recovery Is Never Guaranteed — Even With a Strong Case

It’s important to set realistic expectations. <cite index=”1-1″>Criminal provisions allow the state to prosecute the wrongdoer, but they do not automatically guarantee you a refund,</cite> and <cite index=”1-1″>even after an FIR is registered and police assist in freezing accounts, obtaining interbank transaction logs, and charging the accused, a criminal conviction or arrest alone does not automatically ensure you get your money back — separate recovery steps are often still needed.</cite>

<cite index=”17-1″>Recovery is possible in many cases, particularly where funds are traced quickly, but it is never automatic</cite> — and victims should be cautious of <cite index=”17-1″>unrealistic assurances from unofficial “recovery agents” or private operators claiming guaranteed recovery,</cite> since no legitimate authority or lawyer can promise a guaranteed outcome.

Practical Prevention Tips

Recovery is hard; prevention is comparatively easy. A few non-negotiable habits go a long way:

• Never share your UPI PIN, OTP, or password with anyone — <cite index=”9-1″>your UPI PIN is used to authorize payments, never to receive money.</cite>
• Be suspicious of any “scan to receive money” request — genuinely receiving money on UPI never requires you to scan a QR code or enter your PIN.
• Verify UPI handles and recipient names carefully before confirming any payment.
• Avoid clicking links or installing apps at the request of unknown callers or messages.
• Look up customer care numbers only from the official bank/app website — not from a general web search.
• Turn on transaction alerts and check them the moment they arrive.
• Report suspicious apps directly to your bank, RBI, or the Play Store/App Store.

Conclusion

UPI Fraud and digital payments have transformed how India moves money — but that same speed and convenience is precisely what fraudsters exploit. The legal system has kept pace to a meaningful degree: between RBI’s zero-liability framework, the Integrated Ombudsman Scheme, the BNS and IT Act’s criminal provisions, and the Consumer Protection Act’s service-deficiency remedies, victims of UPI and digital payment fraud in India have more tools available today than ever before.

But none of these remedies work well in isolation, and almost none of them work well if you wait. The single biggest determinant of whether you get your money back is speed — reporting to your bank and the 1930 helpline within minutes, not days, and filing on cybercrime.gov.in before the trail goes cold. From there, treating the process as a coordinated campaign — bank complaint, FIR, NCRP filing, Ombudsman escalation, and consumer or civil action where needed — gives you the strongest possible position.

If your bank denies a legitimate claim or drags its feet past the statutory timelines, don’t treat that as the final word. The RBI Ombudsman and consumer forums exist precisely to correct that imbalance, and in genuinely high-value or complex cases, a lawyer experienced in cyber fraud and banking litigation can help you run every available remedy at once rather than one at a time. Above all, awareness remains the cheapest and most effective defence — most UPI fraud succeeds not by breaking technology, but by exploiting a moment of trust or urgency, and that is the one thing every user has the power to control.///

READ MORE UPI Fraud Recovery in India: Complete Legal Guide to Recovering Money Lost Through Cyber Fraud