UPI Fraud Complaint: Bank, 1930, RBI Ombudsman and Refunds

A UPI fraud complaint goes to your own bank first, within three working days of the debit alert, the window in which RBI’s rules give you zero liability. Call 1930 the same day so the money can be frozen. If the bank refuses or stays silent for 30 days, the RBI Ombudsman comes next.

On this page: the three complaint routes in the order they matter, the RBI Ombudsman’s new 90 day limit checked on 2 October 2026, the 2027 compensation rule worked out at six loss amounts, and four consumer commission orders with the amounts banks were told to repay.

Most pages on this query say call 1930 and stop. That is half the job. The police route can freeze money still sitting in a mule account; only your bank can put money back in yours. Below: the three routes in order, the rule that changed on 1 July 2026, the one that changes on 1 January 2027, and what consumer commissions ordered when banks said no.

Where does a UPI fraud complaint actually go?

Three places, and they do different jobs. The common mistake is assuming the UPI app’s own help button covers fraud. It does not. NPCI’s complaint page says that if the complaint is about a fraudulent transaction, the user has to connect with their bank. UPI Help is built for payments that failed, got stuck as pending, or debited twice.

Where	What it is for	Clock that matters	Source
Helpline 1930 and the cybercrime portal	Police side: freezing money still sitting in the receiving accounts, and the acknowledgement number	Same day; from 1 January 2027 also the five calendar day window for compensation	cybercrime.gov.in
Your own bank (the one your UPI is linked to)	The money side: reporting the debit, shadow credit, liability decision	Three working days for zero liability; bank must credit within 10 working days and decide within 90 days	RBI customer liability rules
UPI Help inside your payment app	Failed, pending and wrongly debited transactions	Not the route for fraud: NPCI tells fraud victims to go to their bank	NPCI complaint page
RBI Ombudsman	When the bank does not reply in 30 days or rejects you	File within 90 days of that, under the 2026 scheme	RB-IOS 2026 FAQ

So the order on the day is: 1930 or the National Cyber Crime Reporting Portal for the freeze, then your bank’s fraud line or branch in writing for the money, keeping the complaint reference from both. Our guide to filing the 1930 and cybercrime portal complaint walks through the police side screen by screen, and tracking the acknowledgement number afterwards covers what happens to it next.

Does the three working day rule cover a payment you approved yourself?

This is the uncomfortable part, and no ranking page says it plainly. The RBI rule most guides quote, first issued on 6 July 2017, is about unauthorised electronic transactions: money that left your account without you approving it. Under the RBI notification you carry zero liability where the bank was at fault, or where the breach was elsewhere in the system and you told the bank within three working days. The days are counted by your home branch’s working schedule, not counting the day the alert arrived.

When you tell the bank (third party breach)	Basic savings (BSBD) account	Savings account, most cards	Other current accounts, cards above Rs 5 lakh limit
Within 3 working days	Zero	Zero	Zero
Day 4 to day 7	Up to Rs 5,000	Up to Rs 10,000	Up to Rs 25,000
After day 7	Set by bank policy	Set by bank policy	Set by bank policy

The same notification puts the burden of proving customer liability on the bank, requires it to credit the amount within 10 working days of your report, and gives it at most 90 days to resolve the complaint. Those three lines are the ones that win cases, as the records below show.

Now the catch. If a caller talked you into typing your UPI PIN to “receive” a refund, or you scanned a QR code to collect money, the bank will argue the payment was authorised by you. Today’s rules were written for card cloning and hacked accounts, not for persuasion. Until 2027, a payment you were tricked into making is the weakest kind of UPI fraud complaint, and that is a fact about the rules, not a judgement about anyone who fell for it. The Telegram task scam and its cousins are built by professionals.

What did consumer commissions order when banks said no?

We read five published consumer commission records on disputed electronic transactions, four from LiveLaw’s reports and one from its February 2026 digest, plus the seven fraud accounts on the UPI page of ConsumerComplaints.in. These are case records and complaints, reported here as what happened in those cases, not as a promise of what happens in yours.

Bank liable, Chandigarh, UPI. In a case reported on 15 November 2025 (DC/AB1/44/CC/359/2023), five unauthorised UPI debits totalling Rs 99,940 left an SBI account on 21 July 2021. The customer went to the cyber cell that day and the bank the next. SBI argued that a UPI debit needs the secret PIN, so the customer must be liable. The District Commission disagreed: the bank never credited the money within 10 working days, never finished its inquiry in 90 days, and produced no proof of customer fault. Refund with 9 percent interest from 2021, plus Rs 10,000.

Bank liable, national level. On 11 December 2024 the National Commission (R.P. No. 1551/2023) upheld a refund of Rs 9 lakh, two transfers of Rs 4.5 lakh each made after a SIM replacement request, with 7 percent interest, Rs 15,000 compensation and Rs 10,000 costs. The bank’s defence was that OTPs went to the registered number. The Commission’s answer was the three day rule and the absence of any fault by the customer.

Bank liable, card. The Chandigarh District Commission’s order in CC/255/2021, summarised in LiveLaw’s February 2026 digest, ordered a refund of disputed card charges, a correction of the credit record and compensation, because the cardholder had reported promptly.

Customer lost, Goa. On 28 November 2024 the Goa State Commission (First Appeal 27 of 2024) reversed a win. A caller posing as a travel refund desk had the customer install a remote access app and share credentials; Rs 35,000 left by net banking. The Commission held the bank could not be made liable where the customer had bypassed every safeguard.

The pattern across them is consistent. Where the customer had not shared a PIN or OTP and reported fast, the bank’s own failure to follow the 10 day and 90 day rules sank it. Where the customer handed over access, the claim failed. The seven ConsumerComplaints.in accounts, dated April 2021 to January 2024, mostly involve shared PINs, fake QR codes and job scams, and none of them reports money coming back. One quotes the bank telling the customer to complain in UPI because the bank was not responsible, which is exactly backwards according to NPCI.

Bank ne mana kar diya, ab kya?

Then it goes to the RBI Ombudsman, and here most pages are now out of date. The Reserve Bank’s Integrated Ombudsman Scheme was replaced on 1 July 2026. Per the RBI’s own FAQ on the 2026 scheme:

You can file once the bank has not replied within 30 days, or has replied and you are not satisfied. The complaint must reach the Ombudsman within 90 days of that 30 day timeline expiring or of the bank’s last reply, whichever is later. Under the 2021 scheme it was one year, and most guides ranking for this query still say one year. Plan on 90.

Filing is free, on cms.rbi.org.in, with the toll free line 14448 for status help. You need the bank’s complaint number and date, a copy of what you sent, the transaction reference (UTR) and the bank’s reply if any. The Ombudsman can award compensation up to Rs 30 lakh for consequential loss plus up to Rs 3 lakh for time, expense and harassment; pages quoting Rs 20 lakh are describing the old scheme. A police investigation running in parallel does not block an Ombudsman complaint, according to the same FAQ.

Agar kisi ne “recovery agent” bankar fee maangi, toh samajh jaiye doosra scam shuru ho gaya. The Ombudsman and the portal charge nothing; our piece on getting money back after an earning app fraud covers the recovery agent trick in detail.

What changes for UPI fraud on 1 January 2027?

On 24 June 2026 the RBI announced amendment directions that apply to electronic banking transactions from 1 January 2027 at commercial, small finance, payments, local area, regional rural and co-operative banks. The press release says they widen the old unauthorised transaction rules to cover other categories of fraudulent transactions, shorten how long banks take on these complaints, and add compensation for small value fraud.

The detail, as MediaNama reported the final text: a fraudulent transaction now includes one made by a third party using credentials obtained by deceit, and one made by the customer under coercion. Bona fide victims of such a transaction with a loss of up to Rs 50,000, including cases involving customer negligence, can get 85 percent of the net loss or Rs 25,000, whichever is lower, once in a lifetime, if they report to the bank and to 1930 or the cybercrime portal within five calendar days. We could not open the directions PDF itself on the RBI site, which served a captcha, so treat these figures as reported until your bank publishes its updated policy.

Net loss	85 percent of it	Compensation under the 2027 rule
Rs 10,000	Rs 8,500	Rs 8,500
Rs 20,000	Rs 17,000	Rs 17,000
Rs 29,412	Rs 25,000	Rs 25,000 (the point where the cap starts to bite)
Rs 40,000	Rs 34,000	Rs 25,000
Rs 50,000	Rs 42,500	Rs 25,000
Rs 60,000	Rs 51,000	Nothing under this scheme: the loss is above Rs 50,000

Note what the arithmetic means. Anything above about Rs 29,400 hits the Rs 25,000 ceiling, and anything above Rs 50,000 falls outside this scheme entirely and goes back to the ordinary liability rules. And five calendar days is not three working days: a Saturday counts. A fraud before 1 January 2027 is judged under today’s rules.

Yeh sab general information hai, legal ya financial advice nahi. Every case turns on its facts and on what your bank’s own policy says.

What should a UPI fraud complaint to the bank contain?

Write it, even if you also called. A phone complaint with no reference number is hard to prove in front of the Ombudsman. Put these in the first message: the UPI transaction reference (UTR) for every debit, the date and time of each, the amount, the receiving UPI ID or account shown in the app, when you first saw the alert, the 1930 or portal acknowledgement number, and a single plain sentence on whether you shared a PIN or OTP. Ask in writing for the shadow credit within 10 working days and for the bank’s decision with reasons.

Keep screenshots of the debit SMS, app history and the fraudster’s chat. If a mule account received the money, our explainer on how mule accounts are recruited shows why the freeze has to happen fast, and when a 1930 complaint becomes an FIR covers the police step that some banks insist on. For the wider list of scam patterns this site tracks, start at our fake earning apps guide.

Frequently asked questions

---

Platform rules and rates change without notice. This page was verified in October 2026 and is rechecked on the Sunday refresh. If you hit something different, tell us in the comments and we will update it.