UPI Fraud in India: What to Do in the First 24 Hours (and Your Legal Remedies)

India runs on UPI. In 2025 alone, monthly transaction volumes crossed 18 billion, and with that convenience has come a genuinely industrial-scale fraud problem — from fake “refund” calls to QR-code swap scams to remote-access apps that quietly drain your account.

If money has just left your bank account without your consent, what you do in the first 24 hours matters more than anything a lawyer can do a week later. This post is a practical playbook — not legal advice on a specific matter — explaining the steps that actually improve your odds of recovery, and the legal remedies available to you afterwards.

The five UPI scams doing the rounds right now

• The “wrong transfer” call. Someone rings, says they sent you money by mistake, and asks you to click a payment request to reverse it. You are actually authorising a debit.
• KYC-expiry SMS with a link. Clicking installs a screen-mirroring or SMS-forwarding app that reads OTPs in real time.
• QR-code swap at merchants. A sticker is pasted over the legitimate shop QR; you scan and pay a scammer instead of the shopkeeper.
• Fake customer-care numbers on Google search results, taking users through “remote support” that ends in an emptied wallet.
• Job / task fraud on Telegram. Small pay-outs at first (as bait), followed by a “deposit to unlock earnings” step.

The first-24-hour playbook

Do these in order. Do not stop to argue with the fraudster.

1. Call your bank’s 24×7 fraud helpline immediately. Ask them to block the account, freeze further UPI mandates, and raise a chargeback / recall request against the beneficiary.
2. Report on the Cyber Crime portal. Register the incident on cybercrime.gov.in or by dialling 1930. A complaint filed within roughly 72 hours has a materially higher chance of freezing money that is still parked in the beneficiary account.
3. File an FIR at your local police station. Under the BNSS (which replaced the CrPC in July 2024) you can register a “Zero FIR” at any station, so do not let anyone send you to a different jurisdiction.
4. Preserve every digital breadcrumb. Screenshots of the SMS/UPI notification, call logs of the fraudster, the exact time of the transaction, the UPI reference number (UTR), and the beneficiary VPA/account number. Do not delete anything, even if it looks embarrassing.
5. Change your UPI PIN and app passwords. Uninstall any app the fraudster asked you to install (AnyDesk, TeamViewer, Quick Support, or any “screen mirroring” utility).

Your legal remedies

1. RBI’s zero-liability framework

The Reserve Bank of India’s circular on Customer Protection – Limiting Liability of Customers in Unauthorised Electronic Banking Transactions puts real, enforceable obligations on your bank. If you report the fraud within 3 working days, your liability is zero in cases where the negligence is on the bank’s side or where the fraud is a third-party breach. Between 4-7 days, liability is capped. Beyond 7 days, it depends on the bank’s policy. Speed matters.

2. Banking Ombudsman

If your bank refuses to credit you back within 30 days, escalate to the RBI Ombudsman. Filing is free, entirely online, and the Ombudsman can direct the bank to refund up to ₹20 lakh, plus compensation for loss of time and mental anguish.

3. Criminal complaint under BNS

UPI fraud typically attracts sections of the Bharatiya Nyaya Sanhita covering cheating, impersonation and criminal conspiracy, read with the Information Technology Act (Sections 66C and 66D). The police can trace the beneficiary account, freeze it and, in some cases, actually recover money before it is withdrawn.

4. Consumer forum

If the bank or the UPI app itself was negligent — say they failed to act on your fraud alert — a consumer complaint under the Consumer Protection Act, 2019 is available. This is a compensation route, not a recovery route, and it is often the last piece that makes the victim whole for time, harassment and mental agony.

How to stay ahead of it

• Set a low UPI transaction limit for daily use; raise it only when you are actually transacting large amounts.
• Turn on UPI Lite for small everyday payments — the wallet-style limit means a compromise cannot drain your main account.
• Never install any app on a phone call. Any “bank executive” asking you to install AnyDesk, Quick Support or TeamViewer is a fraudster. Full stop.
• Save your bank’s official fraud helpline in your contacts now, before you need it.
• For merchants: laminate your QR sticker, position it where you can see the customer’s screen, and audit it visually every morning.

Bottom line

UPI fraud is not a technology problem, it is a social-engineering problem. The system is built to work at the speed of a tap; unfortunately, so is the fraud. The single biggest lever you have is time — report within 24 hours, ideally within the first three, and your odds of getting your money back go from “difficult” to “usually yes”.

If you have been defrauded and your bank is dragging its feet, or you need help drafting the Ombudsman complaint or a police follow-up, book a consultation and we will walk through your situation.