Google Pay hacked and money stolen: recovery steps

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 1 Nov 2026 · Online fraud

Money debited from Google Pay without your consent can still be recovered, but only if the beneficiary account is frozen before the funds are moved again. Call 1930, file on cybercrime.gov.in, and submit your bank's dispute form the same day. The fraud is an offence under Section 66D of the IT Act, 2000 and Section 318(4) of the BNS, 2023.

If money has left your Google Pay account and you did not authorise it, you are working against a clock that runs in hours. A UPI transfer lands in the beneficiary's account in seconds, and the only realistic chance of getting it back is to have that account flagged with a lien before the fraudster layers the money onward through further transfers, cash withdrawals or merchant payments. Everything in the first twenty-four hours should be aimed at that one outcome.

There are three separate tracks, and victims usually ruin their case by treating them as one. The bank track is a chargeback under the UPI dispute mechanism, where your bank raises a dispute against the beneficiary bank. The police track is a criminal complaint that produces an FIR and, if the officer moves quickly, a freeze request to the beneficiary bank. The regulatory track is a complaint against your own bank if it stalls, first to its nodal officer and then to the RBI Ombudsman. You need all three running in parallel, not one after another.

What the law says about a hacked Google Pay account

Google Pay is a third-party UPI application. The money sits in, or moves from, your bank account; Google is the interface, and the National Payments Corporation of India runs the underlying UPI rails. That matters because your legal claim for the money is against your bank, not against Google. The bank is the account holder's contractual counterparty and the entity bound by the RBI's customer protection directions.

On the criminal side, the fraudulent debit is ordinarily registered under Section 66D of the Information Technology Act, 2000, which punishes cheating by personation using a computer resource with imprisonment up to three years and a fine up to one lakh rupees. Because the underlying act is also cheating, the FIR will normally add Section 318(4) of the Bharatiya Nyaya Sanhita, 2023, which carries up to seven years and a fine. Where the fraudster obtained and used your credentials, SIM or device to pose as you, Section 66C (identity theft, up to three years and a fine up to one lakh rupees) is added. If the deception was run through a fake account or a spoofed identity, Section 66 may be invoked for the computer-related act itself.

Where the offender gained access to your phone or account without authority, Section 43 of the IT Act creates civil liability for unauthorised access, and Section 43A deals with compensation for failure to protect sensitive personal data — the latter is aimed at bodies corporate, not individuals, so it rarely helps a retail customer.

On the money side, the operative instrument is the Reserve Bank of India's circular of 6 July 2017 on Customer Protection – Limiting Liability of Customers in Unauthorised Electronic Banking Transactions. Its framework is simple in outline. If the fraud is caused by a third-party breach and you had no role in it, and you notify the bank within three working days, your liability is zero. If you notify between the fourth and seventh working day, liability is capped at twenty-five thousand rupees under that circular. Beyond seven working days, liability is determined by the bank's board-approved policy, which in practice means the bank will try to push the loss onto you.

The circular protects unauthorised transactions. Where you tapped pay and entered the PIN yourself after being deceived, banks routinely argue the transaction was authorised. That argument is the single most contested point in Indian UPI fraud claims, and it is not settled.

That distinction is where most Google Pay matters are won or lost, and any honest adviser will tell you so at the outset rather than after six months. A transaction executed by a fraudster who had your device or credentials is unauthorised. A transaction you executed because someone convinced you to pay is technically authorised, even though you were defrauded. The first is a bank liability question. The second is a criminal recovery question, and the bank's duty is narrower — though NPCI's chargeback rules and the RBI's customer protection framework still apply to how the dispute is handled, and a bank cannot simply refuse to process a genuine fraud report.

The first twenty-four hours, in order

Call 1930 immediately. The National Cyber Crime Helpline connects you to the Citizen Financial Cyber Fraud Reporting and Management System. A report there can trigger a request to the beneficiary bank to hold the funds. Have the UTR or transaction ID, the amount, the timestamp and the beneficiary UPI ID ready.
File on cybercrime.gov.in. Lodge a financial fraud complaint in the same session. Save the acknowledgement number; it is the reference every later authority will ask for.
Call your bank and use the word 'unauthorised'. Ask for the transaction to be marked disputed and for a chargeback to be raised. Note the complaint reference and the name of the person you spoke to.
Email the bank's nodal officer. Put the facts in writing the same day. RBI's framework works on notification dates, and a phone call that leaves no record is worth very little eighteen months later.
Freeze the access, not just the card. Reset the UPI PIN, revoke device binding, change the email and Google account password, and enable two-factor authentication. If a SIM swap is suspected, get the SIM blocked and reissued at the operator's store, not over the phone.
Give the police station a written complaint. Under Section 173 of the Bharatiya Nagarik Suraksha Sanhita, 2023, information about a cognizable offence must be recorded, and electronic filing is permitted with a signed copy to follow within three days. Ask for the FIR number, not just a general diary entry.

Which forum does what

Forum	What it can actually do	Practical timeline
1930 / cybercrime.gov.in	Log the fraud, initiate a freeze request on the beneficiary account	Same day; freeze only if funds remain
Your bank's dispute desk	Raise UPI chargeback, mark lien, investigate	Acknowledgement in days; resolution usually weeks
Bank nodal officer	Formal escalation, creates the record RBI expects	30 days before Ombudsman route opens
Police / cyber cell	FIR, notices to banks and platforms, attachment of proceeds	Weeks to months
RBI Ombudsman	Compensation for deficient service or wrongful refusal	After the bank's 30-day window lapses
Consumer commission	Deficiency of service claim against the bank	Months; viable for larger sums

Two statutes matter at the investigation stage and are worth knowing by name. Section 105 of the BNSS allows the police to attach proceeds of crime, which is how a beneficiary account gets frozen formally rather than by a bank's internal hold. Section 187 of the BNSS governs further investigation, which is the provision used when the first charge sheet names only the mule account holder and the real operator is traced later.

What decides whether you get the money back

Speed of the freeze. This outweighs everything else. If the beneficiary account still holds the funds, recovery is common. If the money has moved through three accounts and been withdrawn, you are chasing a person, not a balance, and the case becomes an investigation rather than a reversal.

How the transaction was executed. A debit initiated by someone else, using your stolen credentials or a cloned SIM, fits the RBI zero-liability box cleanly. A debit you initiated after a screen-sharing session or a fake 'collect request' is fought over. Preserve everything that shows who pressed the button: call records, the screen-share app's logs, the message that induced the payment.

Whether you reported inside three working days. The RBI framework is date-driven. A complaint filed on day nine hands the bank a defence it will use.

Quality of the paper trail. Banks respond to written, referenced, dated complaints. They discount telephonic claims that cannot be located in their system.

Whether the beneficiary is a mule or the operator. Most UPI fraud money passes through accounts opened with stolen or purchased KYC. The mule account holder is usually traceable and often prosecutable, but is rarely the person who ran the fraud. Expect the investigation to move slowly after the first arrest.

Mistakes that cost victims their claim

Waiting for Google to refund. Google Pay can restrict an account and pass information to the bank, but it does not adjudicate your money claim. The dispute sits with the banks.
Reporting only to the platform. A complaint inside the app leaves no statutory record and no freeze request.
Using the word 'mistake' or 'wrong transfer'. A wrong transfer and a fraudulent debit follow different processes. Describe what happened accurately rather than softening it.
Deleting the app or formatting the phone. Both destroy the device-side evidence that would have shown an unauthorised session.
Accepting a 'recovery agent' offer. Anyone who calls claiming to be from a cyber cell or a recovery firm and asks for a fee or another payment is running the second stage of the same fraud.
Filing a police complaint months later. Delay is the bank's best argument and the investigator's least favourite fact.

On the evidence side, the Bharatiya Sakshya Adhiniyam, 2023 changed how electronic records are proved. Under Section 63 of the BSA, an electronic record is admissible on production of the device or medium together with a certificate identifying the record and dealing with the integrity of the device and the manner of production. In practice, your screenshots, SMS alerts and the bank's own statement are best proved through the bank and the platform rather than through your own phone, and a cyber crime blog explainer on Section 63 certificates is worth reading before you file anything in court.

Jurisdiction is usually straightforward. Under Section 179 of the BNSS, a case may be tried where the offence was committed or where any part of it was committed, and for online frauds the victim's location is generally accepted. A Kolkata victim can file at the local police station or the cyber crime cell, and the trial will run before the jurisdictional magistrate, with appeals reaching the City Sessions Court and the Calcutta High Court.

When to involve a lawyer

Most small-value cases resolve if the victim moves fast and documents properly. A lawyer becomes useful when the bank has rejected the chargeback, when the amount is large enough to justify a consumer or civil claim, when the police have closed the case as 'untraced', or when you are the account holder whose account was frozen because fraud money passed through it. The last situation is the one people underestimate: mule account holders are arrested far more often than the operators, and an early legal appearance can prevent a genuine account holder from being treated as an accused. If you need help structuring the complaint or escalating a refusal, a cyber crime lawyer in Kolkata can review the papers before you sign them, and contact details for a first consultation are on the site.

Need help with a cyber crime matter?

Tell me what happened and I will tell you what to file, where, and by when. First conversation is free.

Call +91-9007000603 WhatsApp

Frequently asked questions

Can money debited from Google Pay without my consent be recovered?

Yes, if the beneficiary account is frozen before the funds are withdrawn. Call 1930 and file on cybercrime.gov.in the same day so a hold request reaches the beneficiary bank, then raise a chargeback with your own bank. Recovery is realistic within hours and progressively less likely after the money is layered onward.

Is Google Pay responsible for refunding a fraudulent transaction?

No. Google Pay is an interface; the funds sit with your bank, which is the party bound by RBI customer protection directions. Google can restrict accounts and share information, but the money claim and the chargeback are handled between the two banks under NPCI's UPI dispute rules.

What is the time limit for reporting UPI fraud to get zero liability?

Three working days from the transaction, under the RBI circular of 6 July 2017 on limiting customer liability in unauthorised electronic banking transactions. Reporting within that window gives zero liability where you had no role in the breach. Between day four and day seven, liability is capped at twenty-five thousand rupees.

Is a UPI payment I made myself after being tricked still unauthorised?

Technically no, and that is the hardest part of these cases. If you entered the PIN after being deceived, banks treat the transaction as authorised, so the RBI zero-liability shield does not automatically apply. The criminal case under Section 66D of the IT Act and Section 318(4) of the BNS still stands, and recovery depends on freezing the beneficiary account.

Can I file a Google Pay fraud complaint online without going to a police station?

You can file the financial fraud complaint on cybercrime.gov.in and it is treated as a report to the cyber crime cell. For an FIR you will usually need to visit the police station or send a written complaint, though Section 173 of the BNSS permits information to be given electronically with a signed copy submitted within three days.

What should I do if my bank refuses to register the fraud dispute?

Escalate in writing to the bank's nodal officer, quoting the transaction reference and the date you first reported. If thirty days pass without resolution, complain to the RBI Ombudsman under the Integrated Ombudsman Scheme, 2021. Keep the 1930 acknowledgement and the cybercrime.gov.in reference, as both establish that you reported promptly.

Should I delete the Google Pay app after a fraud?

Not before preserving evidence. Uninstall only after you have exported your transaction history, saved the SMS alerts and screenshots showing the disputed entries, and noted the device and login details. Deleting the app or resetting the phone wipes session logs that could show the access was not yours.

Can a fraudster be arrested if the money went to a mule account?

Often yes, though the person arrested is usually the account holder who lent or sold the account, not the operator who ran the fraud. That person can be prosecuted under Section 66D of the IT Act and Section 318(4) of the BNS, and Section 105 of the BNSS allows police to attach the proceeds. Tracing the operator takes longer.

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Cyber crime lawyer in your city · Bank account freeze help · Contact