Lost Money in a UPI Fraud? Steps to Report and Recover It

What should I do in the first hour after a UPI fraud?

Call 1930, the national cyber fraud helpline, or file a complaint under the financial fraud option on cybercrime.gov.in, the National Cybercrime Reporting Portal. Give the transaction details: date and time, amount, the UPI reference number (UTR) for each debit, the UPI ID or account the money went to, and your bank. You will get a 14 digit acknowledgment number. Write it down; every later step refers to it.

The call or the portal entry goes into a system run by the Indian Cyber Crime Coordination Centre (I4C) called the Citizen Financial Cyber Fraud Reporting and Management System. It sends your complaint straight to your bank and to the bank that received the money. That bank checks whether the money is still there, puts a hold on it if it is, and reports where it went next if it has moved. The trail is followed account by account, which is why five minutes can be the difference between a full hold and nothing.

In the same hour, block your UPI on the app, call your bank's fraud number to block the account or card if any credentials were shared, and change your UPI PIN and net banking password from a clean phone. If you installed any app the caller asked you to install, such as a screen sharing or remote access app, uninstall it and do not use that phone for banking until it is checked. Do not call back the fraudster's number or reply to their messages.

Steps to report a UPI fraud and protect your claim

Do these in order, within the first 24 hours if you can. Each step creates a record that the bank, the police or a court will later ask for.

1. Report on 1930 or the portal

   Call 1930 or file on cybercrime.gov.in with every transaction reference. Ask for and save the acknowledgment number. If the call drops or you are unsure the details were recorded, file on the portal as well; duplicate entries are better than a missing one.

2. Inform your bank in writing

   Send an email to your bank's registered fraud or grievance address, and report through the app or branch. Give the acknowledgment number and the UTRs, and ask the bank to confirm the date and time you reported. Under RBI's customer liability rules, the date of your report to the bank decides how much of the loss the bank must bear.

3. Preserve the evidence

   Take screenshots of the transaction history, the chats, the call log, the payment request, the QR code and any website or app involved. Do not delete the chats or the app. Export the WhatsApp chat if the fraud happened there, and note the fraudster's numbers and UPI IDs exactly.

4. Report the numbers and handles

   Report the fraudster's phone number on the Chakshu facility on the Sanchar Saathi portal, and report the profile or account on the platform where the fraud began. This does not recover your money, but it helps get the numbers blocked and adds to the record.

5. Follow up for an FIR

   Track the complaint on the portal. For larger amounts, go to the cyber police station with the acknowledgment and your papers and ask for an FIR. In Delhi, complaints above ₹10 lakh are converted into e-Zero FIRs, and you must visit the police station within three days to convert it into a regular FIR.

6. Ask where the money is held

   Within a few days, ask the investigating officer or the cyber police which accounts have a hold on your money and how much. That figure decides what can be recovered and which route you take to get it released.

If the fraud happened on a holiday or late at night, still call 1930. Banks act on these holds round the clock, and the fraudsters rely on victims waiting until the morning.

How does the 1930 helpline actually freeze my money?

The helpline does not freeze your money; it gets the receiving banks to place a hold, often called a lien, on the amount in the fraudster's account. The complaint flows through the reporting system to the first receiving bank, which marks the disputed amount so it cannot be withdrawn. If the money has already been moved, that bank reports the next account, and the hold request travels down the chain. In a typical case, ₹2 lakh sent at noon may sit in five or six accounts in three states by evening, with smaller sums at each layer.

Under the standard operating procedure issued by the Ministry of Home Affairs on 2 January 2026, banks, payment aggregators, wallets, e-commerce platforms and trading apps are all expected to act on these requests in a set way. The hold is meant to cover the disputed amount, not the whole account of the person who received it. It is a temporary measure during investigation. It does not mean the money is yours yet.

What the system cannot do is reach money that has already been withdrawn in cash, spent, converted into crypto on a foreign exchange or moved abroad. That is the honest limit of recovery. Victims who report within the first hour often see a large part of the amount held. Victims who report after a day or two often see only small amounts caught in the later layers, or nothing at all.

Will I get my UPI fraud money back?

You get back what was held and what the bank is liable to pay you, and not much more. There are three possible sources. First, money held in the fraudster's accounts, which can be released to you by the police or the court. Second, a refund from your own bank, if the transaction was unauthorised and you reported it in time under RBI's rules. Third, recovery from the accused after trial, which is slow and uncertain and should not be the plan.

Most victims recover through the first route. The amount held is fixed in the first few days, and nothing a lawyer does later will enlarge it. What a lawyer can do is make sure the hold is not lifted before you apply, that the application for release is made to the right court with the right papers, and that the bank's liability, if any, is pressed in writing before limitation runs.

Be suspicious of anyone who promises to recover the whole amount for an advance fee. Fake recovery agents, fake cyber cell officers and fake lawyers contact fraud victims with exactly that offer, and many victims lose money a second time. No genuine police officer will ask you to pay to have your own money released.

Common UPI frauds and what recovery usually depends on

The type of fraud decides whether the bank can be asked to pay, and how much of the money the trail is likely to catch.

Is the bank liable to refund a UPI fraud?

The bank is liable only for unauthorised transactions, and only to the extent RBI's customer liability rules say. Those rules, first issued in July 2017 and applied by every bank through its board approved customer protection policy, give you zero liability where the fraud happened because of the bank's own deficiency, or where the breach was by a third party, the fault lay neither with you nor the bank, and you reported within three working days of being told of the transaction. If you report within four to seven working days, your liability is capped at between ₹5,000 and ₹25,000 depending on the type of account. Beyond seven working days, the bank's own policy applies.

The catch is customer negligence. If you shared your PIN, OTP or card details, or entered your PIN yourself, the rules put the loss on you until you report it to the bank; anything lost after you report is the bank's. In most UPI frauds the victim entered the PIN, so banks treat the debit as authorised. That is why bank refunds succeed mainly in SIM swap, hacked device and similar cases where you did not take part in the transaction at all.

Where the bank is liable, it must credit the amount to your account, as a shadow reversal, within ten working days of your report, and close the complaint within 90 days. If it does not, complain to the bank's grievance officer and then to the RBI Ombudsman. Our post on the RBI Ombudsman complaint process sets out the steps. Where the bank sat on your fraud report, ignored obvious red flags, or delayed blocking the account after you asked, a complaint for bank deficiency in service before the consumer commission may also be worth considering, though commissions have decided these cases both ways.

Your liability under RBI's rules, by when you report

Working days are counted from the date you received the bank's alert of the transaction, not counting that day. Keep the SMS or email alert, because the bank will look at it to fix the start date.

Do I need an FIR, or is the 1930 complaint enough?

For holding the money, the 1930 or portal complaint is enough. For releasing held money above small amounts, for any action against the fraudsters, and often for the bank's own records, you need an FIR. The portal complaint is not an FIR. It is a complaint that the police may convert into an FIR, register as a zero FIR, or keep for enquiry.

A UPI fraud is cheating under section 318 of the Bharatiya Nyaya Sanhita, often with cheating by personation under section 319, and offences under sections 66C and 66D of the Information Technology Act. These are cognizable, so the police should register an FIR under section 173 of the Bharatiya Nagarik Suraksha Sanhita. For offences punishable with three to seven years, section 173(3) allows a preliminary enquiry of up to 14 days first, and some police stations use it for cyber cheating complaints. Our post on zero FIR and e-FIR under the new criminal laws explains how filing from anywhere works.

In Delhi, every district has a cyber police station, and the Delhi Police IFSO unit handles larger and inter-state cases. In Noida and Ghaziabad, the police commissionerates run their own cyber crime police stations. If the police will not register the case, write to the DCP and keep proof, then apply to the magistrate under section 175(3) BNSS; our post on what to do when the police refuse to register an FIR covers that route.

The laws that apply to UPI fraud

How do I get the held money released to me?

For small amounts, the January 2026 MHA procedure allows refunds of frauds below ₹50,000 without a court order, where the trail is clear. The police and the bank process these through the reporting system. In practice, you may still be asked for the acknowledgment, your ID, your bank details and a written undertaking to return the money if it later turns out you were not entitled to it. The same procedure tells banks to lift holds on such small amounts within 90 days if no court or restoration order is in place, so do not wait for months before asking.

For larger amounts, you usually need an order from the magistrate. Once an FIR exists, you or your advocate file an application before the court of the magistrate having jurisdiction over the police station, asking that the amount held in the named accounts be released to you, usually on a bond or undertaking. The court asks the investigating officer for a report, gives the account holder a chance to object, and then passes an order directed to the banks. Some district courts and legal services authorities have also used Lok Adalats to release held money to victims in bulk.

Where your money was split across accounts in several states, the order of the court where your FIR is registered is generally sent to each bank. Problems arise when another state's police have registered their own case over the same mule account, or when several victims' money is mixed in one account. The SOP provides for proportionate distribution in such cases, and the court will want to see that your claim is traced to that account. A clear chart of your money trail, taken from the investigating officer, does most of the work in these applications.

Documents to keep for the complaint and the release application

What an advocate looks at in a UPI fraud file

When Advocate B.K. Singh opens a UPI fraud file, the first thing he checks is the gap between the time of the last debit and the time of the 1930 call, because that gap explains almost everything about how much was held. The second is whether the bank was told in writing within three working days, which decides whether there is any point in pressing the bank. The third is the money trail itself: which accounts hold how much, in which states, and whether any of those holds are already being challenged by the account holders.

That last point is often missed. The people whose accounts received your money are entitled to object, and some will, claiming they received it for goods sold or a crypto trade. If they apply first and the magistrate hears only their side, your hold can be lifted. Filing your own application, or at least an objection, before that happens protects the amount. His background in computer applications helps when the trail runs through wallets, payment gateways and exchanges rather than plain bank accounts, because the right notice has to go to the right intermediary.

Mistakes that cost UPI fraud victims money

• Waiting until morning. Fraudsters move money in minutes and withdraw it within hours. A complaint the next day often finds empty accounts.
• Deleting the chats or the app. Victims delete the conversation out of embarrassment or fear. It is your main evidence, and the police need the numbers and IDs it contains.
• Paying a 'recovery agent'. Anyone who calls offering to recover your money for a fee, or claiming to be from a cyber cell and asking for charges, is very likely a second fraudster.
• Telling the bank only by phone. The three working day window is proved by a written report with a date and time. Send an email and keep it.
• Not following up. The hold sits quietly in the system. If nobody applies for release, small holds can lapse after 90 days and larger ones stay tied up for the length of the investigation.
• Assuming the FIR is automatic. A portal complaint is not an FIR. For larger amounts, go to the police station and ask for the case to be registered.

Can I file a case against the bank in a consumer court?

You can, but only where the bank did something wrong, not merely because the fraud happened through it. Consumer commissions have held banks liable where they failed to act on a fraud report promptly, where they did not have proper alerts or two factor checks, or where the transaction was plainly unauthorised and the bank refused to follow RBI's liability rules. They have refused relief where the customer shared an OTP or PIN and the bank acted correctly after being told.

The complaint goes to the District Commission for amounts up to ₹50 lakh, within two years of the cause of action. Before filing, put your case to the bank in writing and, ideally, to the RBI Ombudsman, because the bank's replies often show whether it followed its own policy. The consumer route runs alongside the criminal case; one does not bar the other.

What to do this week after a UPI fraud

• Call 1930 or file on cybercrime.gov.in, and save the acknowledgment number
• Email your bank's fraud or grievance address with the UTRs and keep the sent mail
• Block UPI, change PINs and passwords, and remove any app the caller made you install
• Save chats, call logs, screenshots and bank alerts in one folder, with a printed copy
• Visit the cyber police station with your papers and ask for an FIR, especially for larger amounts
• Ask the investigating officer for the money trail and the amounts on hold
• Note the bank's 10 working day refund deadline and its 90 day closure deadline
• Decide, with advice, whether to apply to the magistrate for release of the held amount

When to get a lawyer, and when you can manage alone

For a small fraud below ₹50,000 with a clear trail, you can usually manage alone: report, inform the bank, follow up with the police, and use the refund procedure. Get advice when the amount is large, when money is held in several states, when the bank refuses a refund you think it owes, when an account holder has objected to the hold, or when the police have not registered an FIR after a reasonable time. Also get advice if the fraudster has your documents or photos and is threatening you, which turns a fraud case into something closer to sextortion or blackmail.

If you want an advocate to look at the trail before you apply for release, the team of Advocate B.K. Singh can read the papers and tell you which court to approach and what the bank still owes you. You can send the acknowledgment number and statements through our online legal enquiry page. Our page on cyber laws describes the other online problems we handle.