In 2025, India recorded ₹22,495 crore in cyber-fraud losses and 28.15 lakh complaints. PIB published the figures in Varta on Cyber Suraksha Abhiyan: Protecting Citizens from Digital Fraud Held in Kohima (PIB, 2026). If a UPI payment was unauthorised or induced by deception, report it immediately. This 10-minute checklist cannot promise recovery. For every complaint route, see the UPI help guide for India.
Key Takeaways
- Call your bank and 1930 immediately, then complete the cybercrime portal report.
- Save transaction details, messages, screenshots and complaint numbers.
- In 2026, CFCFRMS had safeguarded ₹11,158 crore, but reporting never guarantees recovery (PIB, 2026).
- A failed payment is not automatically fraud.
What should you do in the first 10 minutes after UPI fraud?
In 2026, CFCFRMS had safeguarded ₹11,158 crore across 32.80 lakh complaints by June 30. PIB reported this in Varta on Cyber Suraksha Abhiyan: Protecting Citizens from Digital Fraud Held in Kohima (PIB, 2026). Act quickly, because early reporting may help institutions trace funds.
- Minute 0 to 1: End the call, chat, screen share or remote-access session. Do not send another payment.
- Minute 1 to 3: Alert your bank through its official app, website or number. Report the unauthorised transaction and request protective action.
- Minute 3 to 6: Call 1930. Give accurate transaction details and record the acknowledgement number.
- Minute 6 to 8: Change compromised banking and email passwords from a clean device. Ask whether UPI or the account should be blocked.
- Minute 8 to 10: Save evidence and begin the complaint at cybercrime.gov.in.
Unique analysis: Run two connected tracks. The bank track protects the account and records the disputed debit. The cybercrime track helps police and participating institutions follow the money. One complaint number does not replace the other.
Citation capsule: By June 30, 2026, CFCFRMS had safeguarded ₹11,158 crore across more than 32.80 lakh complaints, according to PIB’s Varta on Cyber Suraksha Abhiyan. The result supports immediate reporting, but it does not show that every reported loss will be recovered.
Step 1: How do you stop the scammer and contain further loss?
In 2025, fake investment and trading scams accounted for 76% of reported financial losses cited in PIB’s Varta on Cyber Suraksha Abhiyan: Protecting Citizens from Digital Fraud Held in Kohima (PIB, 2026). Stop following instructions, even if the caller threatens penalties or promises an instant refund.
Save messages and identifiers before blocking the contact. Do not scan another QR code, approve a collect request or disclose an OTP. NPCI’s Fraud Awareness says entering a UPI PIN is for making a payment, not receiving money (NPCI, 2026).
If you installed a remote-access app, cut connectivity. RBI’s BE(A)WARE: A Booklet on Modus Operandi of Financial Frauds warns that such apps can expose financial credentials (RBI, 2022). Check recent debits on another device.
Citation capsule: In 2025, fake investment and trading scams represented 76% of losses cited by PIB’s Varta on Cyber Suraksha Abhiyan. A victim should stop further payment instructions, end remote access and verify recent account debits before engaging with any claimed refund process.
Step 2: How should you tell your bank about the unauthorised transaction?
Under RBI’s 2017 Customer Protection: Limiting Liability of Customers in Unauthorised Electronic Banking Transactions, reporting a qualifying third-party breach within 3 working days can result in zero customer liability (RBI, 2017). Notify the bank immediately and describe the payment accurately. Eligibility depends on how the loss occurred.
Use the bank’s official 24-hour channel. Provide the amount, time, transaction number and beneficiary UPI ID. Request a complaint number. If deception led you to enter a PIN, say so. RBI says customer negligence can affect liability until reporting. The bank bears the burden of proving liability.
For money knowingly sent to the unintended recipient, follow the wrong UPI transfer recovery steps. A mistaken transfer and an unauthorised debit need different descriptions.
Citation capsule: RBI’s 2017 circular provides zero liability for a qualifying third-party breach reported within 3 working days. Reporting in 4 to 7 working days may create limited liability, while delays beyond 7 working days fall under the bank’s policy. Case facts still determine the outcome.
Step 3: Where should you report UPI fraud after calling 1930?
In 2021, I4C launched CFCFRMS for immediate financial-fraud reporting, according to PIB’s Measures Taken by the Government to Spread Awareness Against Cybercrimes (PIB, 2025). Call 1930 promptly and also use the National Cyber Crime Reporting Portal.
Keep your mobile number, bank name, UPI ID, transaction ID, amount, date and beneficiary details ready. Official Citizen Financial Cyber Frauds Reporting and Management System instructions say a caller receives an acknowledgement and must complete portal registration within 24 hours (National Cyber Crime Reporting Portal, 2023).
Reporting creates a traceable record but does not guarantee a freeze, refund or FIR. Retain the 1930 acknowledgement. Contact local police for immediate danger.
Citation capsule: I4C’s reporting system connects complaints with police, banks and payment intermediaries. Official portal instructions say a 1930 caller receives an acknowledgement and must complete online registration within 24 hours. The process may help block funds, but the instructions do not promise recovery.
Step 4: Preserve evidence and secure affected accounts
In 2017, RBI required banks to preserve the time and date of fraud reports because timing helps determine liability. The requirement appears in Customer Protection: Limiting Liability of Customers in Unauthorised Electronic Banking Transactions (RBI, 2017). Save evidence before deleting apps, chats or files.
Keep screenshots, alerts, emails, call logs, phone numbers and the payment receipt. Write a timeline while events remain fresh. Store all complaint numbers away from the compromised device. Change exposed passwords from a trusted device and disclose the compromise to each institution.
Unique analysis: Match each scammer instruction to the related login, collect request or debit. This clean timeline does not prove the case, but it helps the bank and investigator follow the sequence without guessing.
Citation capsule: RBI’s 2017 circular requires bank reporting systems to record when alerts were delivered and customer objections received. Victims should therefore retain acknowledgements, timestamps and transaction records. Those materials support a coherent complaint and may affect the bank’s liability assessment.
Is it UPI fraud or an ordinary failed payment?
In 2026, NPCI’s UPI Frequently Asked Questions described a UPI PIN as a 4 to 6 digit code used to authorise bank transactions (NPCI, 2026). A debit you authorised can still fail technically, but that alone does not make it fraud. Check who initiated and approved the payment.
A payment is likely failed when you intended to pay the displayed beneficiary but saw a failed or pending status. NPCI says declined debits should receive real-time reversal. Follow the failed UPI payment and refund guide.
Fraud may involve an unauthorised debit, fake support, remote access or a QR refund trick. Don’t label a completed payment as failed.
Unique analysis: Ask, "Did I understand the recipient, amount and purpose when I authorised it?" That question helps separate technical disputes, mistaken transfers and deception-based fraud. The bank and investigators make the formal assessment.
Citation capsule: NPCI says UPI uses a 4 to 6 digit PIN to authorise transactions and provides real-time reversals for declines. A failed payment generally belongs in the payment-dispute route, while unauthorised or deception-induced payments also belong in the fraud-reporting route.
What happens after you report an unauthorised UPI transaction?
Under RBI’s 2017 customer-protection circular, a bank must provide shadow credit within 10 working days in covered zero-liability or limited-liability cases. The same circular sets a maximum of 90 days for complaint resolution (RBI, 2017). These timelines are not universal refund promises.
Track both cases separately. If the bank rejects the complaint, request written reasons. RBI’s 2021 Frequently Asked Questions on the Reserve Bank Integrated Ombudsman Scheme allows a complaint after no bank reply within 30 days or an unsatisfactory response (RBI, 2022).
Check the UPI transaction limits guide before resuming payments. Limits can reduce exposure, but careful verification remains essential.
Citation capsule: RBI’s 2017 circular requires shadow credit within 10 working days for covered cases and resolution within 90 days. These protections depend on the facts and reporting timeline. They should not be read as an automatic refund for every scam-induced payment.
Frequently Asked Questions
In 2026, PIB reported that CFCFRMS had safeguarded ₹11,158 crore across more than 32.80 lakh complaints by June 30. That evidence from Varta on Cyber Suraksha Abhiyan (PIB, 2026) supports fast reporting. It does not make recovery certain for an individual complaint.
Act now, then keep both complaint trails organised
In 2017, RBI’s Customer Protection: Limiting Liability of Customers in Unauthorised Electronic Banking Transactions included a 3-working-day zero-liability window for qualifying third-party breaches (RBI, 2017). Start with the bank, 1930 and cybercrime.gov.in, then preserve every acknowledgement.
Read the complete UPI help guide for wider escalation. Fast action may help, but only the bank and authorities determine liability, freezing and recovery.
