UPI Scam? What to Do Immediately and How to Get Money Back

If you have lost money in a UPI scam, call the 1930 cyber fraud helpline or report on cybercrime.gov.in right away, then report the transaction to your bank through its 24x7 fraud channel. Speed matters: the sooner you report, the better the chance of freezing the money before it is withdrawn, and under RBI rules, how fast you report decides how much of the loss you bear. This guide walks through the exact steps, your rights as of October 2026 and where to escalate.

Do these steps right now

1. Call 1930 or file on cybercrime.gov.in. This is the National Cyber Crime Reporting Portal run by the Ministry of Home Affairs. It alerts banks and payment apps so they can try to put a hold on the money in the receiving account. Note your acknowledgement number.
2. Report to your bank. Use the bank's fraud helpline, app, net banking "report fraud" option or the number on its website. Ask the bank to block UPI on your account if needed and record a complaint reference number. Banks must provide 24x7 channels to report unauthorised transactions.
3. Raise a dispute in your UPI app. Use the "Help" or "Report a problem" section for the specific transaction, and mention that it is fraud.
4. Secure your accounts. Change your UPI PIN, net banking password and email password. Uninstall any screen-sharing or remote-access app (such as AnyDesk or TeamViewer) a caller asked you to install.
5. Collect evidence. Take screenshots of the transaction, UTR number, the fraudster's UPI ID or phone number, chats, SMS and call logs.
6. File a police complaint if asked. Many banks ask for an FIR or the cybercrime acknowledgement for larger amounts. Report the caller's number on the Sanchar Saathi portal (Chakshu) as well.

Do not wait to "see if it reverses". Every hour reduces the chance of recovery.

Common UPI scams and how they work

NPCI stopped person-to-person (P2P) UPI collect requests from 1 October 2025, so a stranger should not be able to send you a payment "request" from a personal UPI ID. Merchant collect requests still exist, so check who is asking before approving anything.

Investment scams often promise 3% to 5% a month. Compare that with what a bank FD actually pays using our FD calculator: anything far above that with "no risk" is a warning sign.

Your rights: RBI's customer liability rules

Rules in force until 31 December 2026

RBI's 2017 framework on limiting customer liability in unauthorised electronic banking transactions covers UPI payments from bank accounts. Liability depends on fault and how quickly you report:

Under this framework, the bank must credit ("shadow reverse") the amount within 10 working days of your report in eligible cases and resolve the complaint within 90 days.

New rules from 1 January 2027

RBI issued the Commercial Banks (Responsible Business Conduct) Third Amendment Directions, 2026 on 24 June 2026. They apply to electronic banking transactions at commercial banks on or after 1 January 2027. Key changes reported in the directions:

• Zero liability for third-party breaches reported within five calendar days.
• One-time compensation for small frauds caused by customer negligence: for a gross loss up to ₹50,000, the lesser of 85% of the net loss or ₹25,000, once in a lifetime. You must report to 1930 or cybercrime.gov.in and to the bank within five calendar days.
• Complaints to be resolved within 45 calendar days for domestic fraud.

Similar directions apply to other bank categories; check your bank's customer protection policy, which must be on its website.

Worked example

Suppose ₹40,000 is taken from your savings account through a SIM-swap fraud (a third-party breach). Under the current rules:

• Reported on day 2: liability ₹0; the bank must reverse ₹40,000.
• Reported on day 6: liability is the lower of ₹40,000 and ₹10,000, so ₹10,000. The bank refunds ₹30,000.
• Reported on day 10: liability depends on the bank's policy.

Now suppose instead that you shared your UPI PIN with a fake "customer care" agent on 15 January 2027 and lost ₹40,000. Under the new framework, if you report within five calendar days and the loss is verified, you may receive the lesser of 85% of ₹40,000 (₹34,000) or ₹25,000, so ₹25,000, as a one-time compensation.

Where to complain if the bank does not help

1. Bank's grievance officer. Escalate in writing if the branch or call centre does not resolve the issue. Keep your complaint numbers.
2. RBI Ombudsman. If the bank rejects the complaint, does not reply within 30 days, or you are not satisfied, file at cms.rbi.org.in or call RBI's 14448 helpline. The RBI Integrated Ombudsman Scheme, 2026, in force from 1 July 2026, requires you to file within 90 days of the bank's reply or response deadline, whichever is later.
3. Cybercrime and police. Follow up on your 1930 or cybercrime.gov.in complaint using the acknowledgement number.
4. Sachet (sachet.rbi.org.in). Report entities illegally collecting deposits or promising unrealistic returns.
5. SEBI SCORES (scores.sebi.gov.in). If the scam involved a SEBI-registered broker, adviser or investment platform, complain there as well.

If the fraud involved a fake loan app, see our guide on how to report fake loan app fraud.

What not to do

• Do not pay anyone who promises to "recover" your money for a fee. Recovery scams target fraud victims.
• Do not share your UPI PIN, OTP, card CVV or screen with anyone, including people claiming to be from your bank, NPCI, RBI or police.
• Do not delete the fraudster's messages or call logs; they are evidence.
• Do not wait for the weekend to pass before reporting. Use 1930 and the bank's 24x7 channel.
• Do not approve any UPI request or enter your PIN to "receive" money.

How to protect yourself going forward

• Set a lower daily UPI limit in your app if you rarely make large payments.
• Turn on SMS and email alerts for every transaction, and keep your mobile number and email updated with the bank.
• Use only official app stores and the bank's official website for helpline numbers.
• Keep separate accounts: a low-balance account for daily UPI and a main account, or an FD ladder, for savings.
• Use our guide on how to choose a safe bank and understand deposit insurance to keep your savings protected.

Key takeaways

• Report UPI fraud to 1930 or cybercrime.gov.in and your bank immediately; speed decides both recovery and liability.
• Until 31 December 2026, you have zero liability for third-party breaches reported within 3 working days, and capped liability for 4 to 7 days.
• From 1 January 2027, commercial banks follow new rules with a five-day reporting window and up to ₹25,000 one-time compensation for small frauds.
• Escalate to the RBI Ombudsman at cms.rbi.org.in if the bank does not resolve your complaint within 30 days.
• You never need to scan a QR code or enter your UPI PIN to receive money.