Phone Lost? How to Block UPI, Bank Apps and SIM Fast

"My phone was stolen in the train an hour ago, and it has Google Pay, my bank app and all my OTPs on it." If this is you, the one-line fix is: call your mobile operator from another phone to block the SIM, then call your bank's 24x7 helpline to disable UPI, mobile banking and cards, and only then deal with the police complaint and phone tracking. The SIM is the key that receives OTPs; blocking it first cuts off most of the risk.

This guide gives the order to act in, what each block does, what you are owed under RBI rules as of October 2026, and how to set everything up again safely on a new phone.

Why a lost phone is a banking risk

A UPI payment needs your UPI PIN, and banking apps need a login PIN or biometrics. A thief who cannot unlock the phone usually cannot pay. The risk comes from what an unlocked or poorly locked phone exposes:

• SMS OTPs and bank alerts on the lock screen, which can be used to reset a UPI PIN or log in to net banking;
• Email, which is often the route to reset banking and app passwords;
• Saved passwords, card details and photos of ID documents;
• The SIM itself, which can be put in another phone to receive OTPs.

NPCI's UPI FAQs say that if your mobile is lost, blocking the mobile number means no transaction can be initiated from it. That is why the SIM comes first.

What to block, where and how

Under RBI's customer protection rules, banks must offer 24x7 channels to report unauthorised transactions and the loss or theft of a payment instrument. Use the number from the bank's official website or the back of your card, never one from a web search.

Step-by-step: what to do

In the first hour

1. Block the SIM. Call your operator from a family member's phone. Ask them to suspend the number and note the complaint number and time.
2. Call every bank whose app was on the phone. Ask them to disable UPI and mobile banking for now, and to block the debit card if it was saved in the phone. Note each complaint number and time.
3. Block or freeze credit cards saved in apps, wallets or browsers. Most issuers let you do this from net banking on a computer. See credit card lost or stolen for card-specific steps.
4. Change your email password and sign out of all devices from a computer. Then change net banking passwords.
5. Lock or erase the phone remotely using Google's or Apple's find-device service. Erasing removes data but usually stops tracking, so lock first if you hope to recover it.
6. Check for any unauthorised transaction. If you find one, report it to the bank as unauthorised immediately and call 1930 or file on cybercrime.gov.in.

On the first day

7. File a police complaint for the lost or stolen phone, online where your state's police allow it. Note the IMEI (printed on the box or invoice, or shown in your Google or Apple account).
8. Get a duplicate SIM at the operator's own store with your original ID. Under a DoT order of September 2022, SMS is barred for 24 hours on a replacement SIM, so OTPs will start only after that.
9. Block the IMEI on Sanchar Saathi. On sancharsaathi.gov.in, use the CEIR option to block a lost or stolen handset, uploading the police complaint copy and ID proof. Keep the request ID; you need it to unblock the phone if it is found.
10. Tell wallets, brokers and other apps linked to the number (demat, mutual fund platforms, insurance) so they can freeze changes.

Over the next week

11. Set up the new phone. Reinstall apps only from the official app store, register UPI again with the same number (the app verifies your SIM by SMS), and set a new UPI PIN using your debit card details. If you have forgotten the PIN, see forgot UPI PIN.
12. Ask the bank to re-enable services once the new phone is ready, and confirm what is active.
13. If you change your mobile number instead of getting a duplicate SIM, update it with every bank first; our guide on changing your mobile number in the bank covers the process.

What you are owed under RBI rules

If money is taken through a third-party breach and you did not share your PIN or OTP, RBI's limited-liability rules (July 2017 circular, in force until 31 December 2026) apply:

The bank should give a shadow reversal within 10 working days of your report in eligible cases. For commercial banks, revised directions take effect from 1 January 2027: zero liability if a third-party breach is reported within 5 calendar days, and a once-in-a-lifetime compensation where you were negligent, for smaller losses. Our guide on unauthorised transactions and zero liability covers both sets of rules in detail.

Worked example: why the hour matters

Arjun's phone is stolen on a Friday evening. His lock screen showed SMS previews, and the thief used the OTPs to reset his net banking password and moved ₹24,000 from his savings account on Saturday night.

Had he blocked his SIM within the first hour on Friday, the thief could not have received the OTPs at all. If the ₹24,000 had been a credit card spend instead, interest could also build on the unpaid amount while the dispute runs; the credit card interest calculator shows how quickly that adds up.

Where to complain

If the bank does not resolve the complaint within 30 days, see bank not resolving complaint.

Ready-to-copy message to your bank

Subject: Mobile phone lost/stolen - block digital banking and UPI - A/c [last 4 digits]

Dear Sir/Madam,

My mobile phone with number [registered mobile] was lost/stolen on [date]
at about [time]. Your mobile banking / UPI app was installed on it.

Please immediately:
1. Disable UPI and mobile banking on my account(s) [last 4 digits];
2. Block my debit card [last 4 digits] if it is linked to the phone;
3. Confirm whether any transaction took place after [time] on [date].

[If applicable] I did not authorise the following transaction(s):
Date/time: [ ]  Amount: Rs [ ]  Reference/UTR: [ ]
I have reported this on 1930 / cybercrime.gov.in, acknowledgement [ ].

Please acknowledge this report with a complaint number and time.

[Name], [address], [alternate contact number]

What not to do

• Do not wait to see if the phone turns up before blocking the SIM and UPI. You can always re-enable services.
• Do not reply to messages claiming your phone has been found that ask you to log in or share a code. Use only the official Google or Apple site to check your device.
• Do not share OTPs or your UPI PIN with anyone calling to "help unblock" your account, even if they know your details.
• Do not search online for a bank or UPI app helpline. Fake numbers are common; use the bank's official website or card.
• Do not reuse the old UPI PIN or passwords on the new phone.
• Do not keep ID photos, PINs or passwords in your gallery or notes without a lock.

Key takeaways

• Block the SIM first, then disable UPI, mobile banking and cards with each bank, then secure email.
• File a police complaint and block the IMEI through CEIR on Sanchar Saathi; keep the request ID.
• A replacement SIM gets no SMS for 24 hours, so plan OTP-based setup around it.
• Until 31 December 2026, a third-party fraud reported within three working days means zero liability; report to the bank and 1930 immediately.
• Reinstall apps only from official stores and set a new UPI PIN on the new phone.