Hooked? Acting within the hour still gives you a chance.
UPI fraud is when someone tricks you into sending money through UPI or transfers money without your permission. Your account does not have to be hacked. If someone promises “cashback” or tells you to “scan this QR code and enter your PIN to receive money”, and you end up paying them, that is fraud too. You do not need to enter your UPI PIN to receive money.
As soon as you discover the fraud, call 1930. Inform your bank and ask it to prevent further transactions. Register a complaint at cybercrime.gov.in. Then approach the police with your evidence and request registration of an FIR. Do not delay notifying your bank while waiting for an FIR.
The first hour has two priorities: prevent further losses and provide enough information for the authorities to trace and hold the money. Even if an hour has already passed, report the fraud. Do not assume it is too late.
1. Call 1930 immediately
The central government’s financial cybercrime helpline is 1930. Tell the operator how much you lost, when the transaction took place, which bank account the money left and the transaction reference number. Save the acknowledgement number you receive after reporting the fraud.
If the call does not connect, do not spend all your time waiting. Continue contacting your bank and filing your complaint online.
2. Ask your bank to block further losses
Call the customer-care number listed in your bank’s official app, on its official website or on the back of your card. Do not trust a number simply because it appears in a Google search.
Tell the bank: “I have lost money in a UPI fraud. Please register a fraud complaint against this transaction, block the services necessary to prevent further losses and give me a complaint reference number.”
Ask the bank which facilities need to be blocked: UPI, mobile banking, your card or outgoing transactions from the account. RBI guidelines require banks to take immediate steps to prevent further unauthorised transactions once a customer reports one.
Blocking your account will not automatically bring back money already transferred. Also request urgent action to trace and hold the disputed funds in the recipient account. Banks, payment providers and law-enforcement agencies coordinate on these complaints.
If your UPI app lets you report a problem with the transaction, register a complaint there as well.
3. Complete your online complaint
Report the incident under the financial-fraud category on the National Cybercrime Reporting Portal.
If you first reported it through 1930 and received an acknowledgement number, use that number to complete your complaint on the portal within 24 hours. Do it immediately if possible.
Keep these details ready:
• The date, time and amount of the transaction.
• Your bank’s name and the relevant account details.
• The UPI Transaction ID, UTR or RRN shown in your payment app.
• The recipient’s UPI ID, name or phone number, wherever available.
• Payment screenshots, bank SMS alerts, chats and links connected to the fraud.
Do not guess missing details. Provide accurate information and preserve supporting evidence. Use your complaint number to track its status on the portal.
4. Preserve the evidence and approach the police
Do not delete chats, messages, call records or payment receipts. Save copies and write down what happened in chronological order.
Visit the nearest police station or cybercrime police unit and submit a written complaint. Attach the 1930 or portal acknowledgement number, your bank’s complaint number and the evidence. Request registration of an FIR.
You do not need to wait until you can reach a specialised cybercrime station. For a cognisable offence, you can approach any police station and request a Zero FIR if the incident falls outside its jurisdiction. How safe a complainant’s details are with the police is a question we took up in our Dial 100 piece.
Get an acknowledgement for your written complaint. Once the FIR is registered, obtain its number and a copy.
A cybercrime portal acknowledgement is not, by itself, confirmation that an FIR has been registered. The complaint and the FIR are separate stages.
Will you definitely get your money back?
There is no guarantee. Recovery depends on how quickly the fraud is reported, whether the money is still available in the accounts it reached and the circumstances of the transaction.
Holding or freezing the money and returning it to your account are also separate processes.
Depending on the case, restoration may involve a court order or an eligible administrative process. Telangana has been using the Ministry of Home Affairs’ Money Restoration Module (MRM) since June 2026 to facilitate eligible refunds without requiring a court order.
In a statement reported on September 13, the Telangana Cyber Security Bureau said police had helped return ₹139.68 crore to 24,189 cyberfraud victims during 2026 up to that point. This included refunds through different routes. Of that, ₹27.23 crore had been returned to 9,355 victims through MRM as of September 12. Ask your investigating officer which process applies to your case.
The next National Lok Adalat is scheduled for December 12, 2026. Ask your investigating officer or local Legal Services Authority whether your matter is eligible to be taken up.
Do not believe the claim that reporting any UPI fraud within three days guarantees a full refund. RBI’s customer-liability protections have conditions. Explain accurately whether the transaction happened without your authorisation or whether you made the payment after being deceived.
What changes from January 2027?
The RBI’s revised framework, announced on June 24, 2026, is scheduled to apply to transactions at commercial banks undertaken on or after January 1, 2027. Small finance banks, payments banks and regional rural banks are not covered by it. It broadens protection against fraudulent electronic banking transactions, including certain payments induced through deception or coercion.
Under the compensation mechanism, eligible individual victims with a gross loss of up to ₹50,000 may receive 85% of their net loss or ₹25,000, whichever is lower, once in their lifetime.
An essential condition is reporting the transaction both to the bank and to either 1930 or the National Cybercrime Reporting Portal within five calendar days of its occurrence. Eligibility and other conditions also apply. This is not an automatic ₹25,000 payment, and the new benefit does not cover earlier transactions.
Finally, beware of anyone asking for a fee to “recover” your money. That can be the start of another scam. Never share your OTP or UPI PIN. Keep your complaint numbers and a record of whom you contacted and when, and follow up with both your bank and the police.
