Bank's duty to refund money in UPI fraud cases

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 4 Nov 2026 · Online fraud

A bank's duty to refund in a UPI fraud case is governed by the Reserve Bank of India's directions on unauthorised electronic transactions, issued on 6 July 2017. Under those directions a customer's liability is zero where the loss was caused by the bank's own fraud, negligence or deficiency, and it is zero where a loss caused by a third party breach is reported within three working days. Where the transaction is notified later, liability rises, and beyond seven working days it is governed by the bank's board approved policy. Reporting quickly is not merely good practice; it is the mechanism that fixes who bears the loss.

The directions also impose positive duties on the bank which customers rarely invoke. On receiving a report, the bank must immediately take steps to prevent further unauthorised transactions in the account, and it must credit the amount to the account by a shadow reversal within ten working days of being notified. Those duties exist whether or not the customer's own liability has been finally determined, and a bank that sits on a complaint is not merely being unhelpful but acting contrary to the regulator's direction.

The framework that sets the bank's duty

The circular is titled customer protection and the limiting of liability of customers in unauthorised electronic banking transactions. It applies to scheduled commercial banks, small finance banks and payments banks, and it governs UPI transactions because they are electronic banking transactions. It sits alongside the RBI Integrated Ombudsman Scheme, which gives a customer a free forum to complain about a deficiency in service after first approaching the bank; the integrated scheme replaced the earlier separate ombudsman arrangements with a single window, and a complaint can be filed online, by email or by post, without engaging a lawyer.

Two structural features of the framework matter in practice. First, the customer's liability is measured from the date the bank informs the customer of the transaction, excluding the date of communication and counted on the working schedule of the home branch. That means the bank's own alert, by SMS or email, starts the clock for the customer's duty to report, and a bank that never alerted the customer cannot fairly rely on the customer's delay. Second, the directions state that banks may not offer electronic transaction facilities, other than ATM cash withdrawals, to customers who have not provided a mobile number, precisely because the alert depends on the mobile number being on record.

Zero liability and limited liability compared

The table is the heart of the framework and should be read with the reporting rule. The three and seven working day windows are counted from the bank's communication to the customer, and the reversal itself is due within ten working days of the customer's notification. A customer who reports on the same day, from the transaction alert, sits in the zero liability band for a third party breach. A customer who discovers the loss from a statement a fortnight later may be outside the statutory protection altogether and dependent on the bank's discretion.

The distinction that decides everything: authorised and unauthorised payments

This is where most UPI fraud claims turn, and where the law is genuinely unsettled. The RBI framework is directed at unauthorised electronic banking transactions, meaning transactions the customer did not initiate or authorise. A UPI transfer completed by the customer entering the UPI PIN is, on its face, an authorised transaction, even where the PIN was entered because the customer had been deceived into doing so. Where a fraudster induces a transfer by pretending to be a bank official, a buyer or an employer, the money moves with the customer's own authentication.

Banks frequently rely on this to refuse a refund, and the argument is not frivolous. Where the inducement involved no failure by the bank and the customer authenticated the payment, the bank's position is that the transaction is authorised and the circular does not apply. Victims argue that a transaction procured by deception is not truly authorised, and that the bank's fraud monitoring system should have flagged a beneficiary account that had already attracted other complaints. Courts have taken differing views and the question remains open, so the outcome on these facts will depend on the particular alert history, the beneficiary used, and whether the bank failed in any duty it owed.

Where the transaction was never initiated by the customer at all, the position is much stronger. A SIM swap, a stolen device, a compromised application, or a debit the customer never saw is unauthorised on any view, and the circular applies directly. Those are the cases in which a demand for a full refund is most likely to succeed, because the customer did not participate in the transfer at any point.

Steps to claim a refund

1. Call 1930 immediately. The national cyber crime helpline feeds the citizen financial cyber fraud reporting system, which can freeze funds while they are still inside the banking system.
2. Tell the bank in writing. Report the transaction to the home branch and through the application, and ask for the complaint reference number. The date of this report drives the liability table above.
3. Ask the bank to disable electronic transaction facilities on the account if the threat is continuing, and ask that the request be recorded.
4. File a complaint at cybercrime.gov.in with the transaction reference, screenshots, and the bank's acknowledgement.
5. Follow up for the shadow reversal. The directions require the amount to be credited to the account within ten working days of notification, without waiting for any insurance claim to be settled.
6. Write to the principal nodal officer of the bank if the branch does not respond, and keep every acknowledgement and reply.
7. Approach the RBI Integrated Ombudsman if the bank does not resolve the complaint within thirty days, or if the reply is unsatisfactory.

The RBI Ombudsman route

The Ombudsman route is free, does not require a lawyer, and is designed for exactly this kind of complaint. The customer must first give the bank thirty days to respond, and may then complain about a deficiency in service. A complaint may be filed online through the RBI complaint management system, by email, or by post, and the Ombudsman can direct the bank to reverse a transaction, refund money, or pay compensation for the delay and the harassment. The scheme applies to payment system participants as well as banks, which is useful where the dispute involves a payment application rather than a bank branch.

The route is not a substitute for the criminal complaint, and it does not punish anyone. Its value is that it is quick, that it costs nothing, and that a bank which does not comply exposes itself to regulatory consequences. Where the bank simply refuses to accept that the transaction was unauthorised, however, the Ombudsman cannot decide the disputed facts in the customer's favour without evidence, and the matter may still need a civil suit or a criminal trial.

Banks are expected to keep a record of the alerts they send. Where a bank claims that it informed the customer and the customer claims otherwise, the bank's own system log is the decisive document, which is why a complaint should always ask the bank to produce the alert history for the account. Requesting that record in writing at the first opportunity is one of the most useful steps a customer can take, because it fixes the date from which the liability windows run.

What decides the outcome

The single most important fact is how quickly the loss was reported and how it was reported. A telephone call to the helpline, followed by a written complaint the same day, creates the best possible record. The second is whether the bank's alerts were sent, and when. The third is whether the customer did anything that compromised his own account, such as sharing an OTP or a PIN, or installing a remote access application at a fraudster's request; the directions contemplate that customers may waive their liability by their own negligence, and banks rely heavily on this.

The fourth factor is the beneficiary. A bank's fraud monitoring systems can be expected to watch for accounts that receive funds from many different senders and disburse them quickly. Where such an account was already the subject of complaints and the bank did nothing, the customer's case for a refund strengthens considerably, because the loss can then be attributed to the bank's failure rather than to the customer's conduct. Where the beneficiary account was new and unremarkable, the bank's position is stronger.

One point that confuses customers is the difference between a failed transaction and a fraudulent one. Where a UPI payment fails and the money is not credited to the intended recipient, the reversal is governed by the RBI turnaround time directions, under which the amount should be returned promptly and a continuing delay can attract compensation payable by the bank. That is a service failure, not a fraud, and it is handled as a failure of service rather than under the unauthorised transaction framework, even though both complaints begin with the same application.

Mistakes that lose the refund

• Reporting late. Every day after the transaction alert weakens the claim, and after seven working days the customer is outside the statutory band.
• Reporting only to the payment application. The bank that holds the account must be notified in writing, because the application operator is not the account holder.
• Sharing the OTP or PIN with anyone. A customer who disclosed credentials gives the bank a direct answer to the claim.
• Installing a remote access application at a fraudster's request. Doing so can be treated as the customer's own negligence and can defeat the refund claim.
• Accepting a verbal assurance from a call centre. Insist on a written complaint reference and a written reply, because those are what the Ombudsman and any court will look at.

When to involve a lawyer

Most UPI refund claims can be pursued without a lawyer, through the bank and the Ombudsman. A lawyer becomes necessary where the bank disputes that the transaction was unauthorised, where the amount is large, or where a refusal has to be challenged by a civil suit or alongside a criminal complaint. In those cases the transaction trail, the bank's alert records, and the refund correspondence become the evidence on which the case turns. For the criminal side, see the cyber crime lawyer in Kolkata page; for a Kolkata-specific view of these matters, see cyber crime lawyer Kolkata services.

Frequently asked questions

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Related articles

• Bank\'s duty to refund in credit card fraud cases
• Which police station handles UPI fraud in Kolkata
• First 24 hours after UPI fraud: what to do right now
• UPI fraud and company liability under the IT Act
• UPI fraud against an NRI: jurisdiction and enforcement
• Time limit to file a UPI fraud complaint in India

Cyber crime lawyer in your city · Bank account freeze help · Contact