How to file a Google Pay fraud complaint: step by step

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 2 Nov 2026 · Online fraud

A Google Pay fraud complaint works best as three filings made the same day: a call to 1930, a written dispute with your bank, and a police complaint. Each produces a different reference number, and no single one recovers money on its own. The criminal provisions are Section 66D of the IT Act, 2000 and Section 318(4) of the BNS, 2023.

Most people who lose money on Google Pay make one complaint and then wait. That is the wrong shape for the problem. A UPI fraud needs a fraud report that triggers a freeze, a bank dispute that triggers a chargeback, and a police record that gives both of them legal force. Skip any one and the other two stall.

This guide sets out the order, the exact words to use at each counter, the documents each forum will ask for, and the points at which a complaint quietly dies. It assumes the money has already left and the transaction is recent. If the debit happened more than a few days ago, the sequence is the same but the recovery prospects are materially worse, and saying so plainly at the start is more useful than optimism.

What you are actually complaining about, in law

Three legal characterisations run in parallel and they are not interchangeable.

The criminal characterisation is cheating by personation using a computer resource under Section 66D of the Information Technology Act, 2000 — up to three years and a fine up to one lakh rupees — typically clubbed with Section 318(4) of the Bharatiya Nyaya Sanhita, 2023 for cheating, which carries up to seven years and a fine. Where your SIM, credentials or device were used to impersonate you, Section 66C (identity theft) is added; where the fraudster accessed your account or phone without authority, Section 66 and the civil liability provision in Section 43 become relevant.

The banking characterisation is an unauthorised electronic banking transaction under the RBI circular of 6 July 2017 on limiting customer liability. That circular sets the notification windows: zero liability if you report within three working days where you had no role in the breach, a cap of twenty-five thousand rupees between the fourth and seventh working day, and the bank's own board-approved policy thereafter.

The payment system characterisation is a UPI dispute under NPCI's chargeback rules, where your bank, as the remitter bank, raises a chargeback against the beneficiary bank. This is the mechanism that actually returns money, and it moves on its own clock — typically a short window to raise the dispute, then a longer cycle for the beneficiary bank to respond.

The complaint, in the order that works

Stop the bleeding first (minutes 0-15). Change the UPI PIN, revoke device binding in the app, change your Google account password and email password from a different device, and enable two-factor authentication. If you suspect a SIM swap, get the SIM blocked at the operator's store.
Call 1930 (minutes 15-30). This is the National Cyber Crime Helpline. Give the UTR number, amount, time, your bank, and the beneficiary UPI ID or account if visible. The operator logs it into the Citizen Financial Cyber Fraud Reporting and Management System, which is what allows a hold request to be sent to the beneficiary bank.
File on cybercrime.gov.in (same hour). Choose 'Report Financial Fraud', complete the transaction details and upload the statement or screenshots. Save the acknowledgement number in three places.
Call your bank and say 'unauthorised electronic transaction' (same day). Not 'wrong transfer', not 'mistake'. Ask for a dispute reference and for the transaction to be marked as disputed. Note the time, the agent's name and the reference.
Email the bank's nodal officer (same day, before midnight). Two or three paragraphs, the transaction reference, the 1930 acknowledgement, and a clear request to raise a chargeback and place a lien on the beneficiary account. The date on this email is the date the RBI framework will use.
Give the police a written complaint (within 24-48 hours). Under Section 173 of the Bharatiya Nagarik Suraksha Sanhita, 2023, information about a cognizable offence must be recorded. Electronic intimation is permitted, with a signed copy to follow within three days. Ask for the FIR number and a copy, and do not accept a general diary entry in place of an FIR for a cognizable offence.
Follow up on day 7 and day 30. Most cases are lost to silence rather than to law. A short written reminder each week keeps the file alive and builds the record you need for the Ombudsman.

What to carry, and what each forum keeps

Document	Why it matters	Who wants it
Bank statement showing the debit	Establishes the amount, time and beneficiary	Police, bank, Ombudsman
UTR / transaction ID	The only identifier the beneficiary bank can act on	1930, bank, police
SMS and email alerts	Shows when you learned of the debit	Bank, Ombudsman
Screenshots of the app and chat	Shows the inducement or the unauthorised session	Police
1930 acknowledgement	Proves prompt reporting	Bank, Ombudsman, court
Written complaint with date stamp	Fixes the date of intimation	Police, bank
FIR copy	Converts a complaint into an investigation	Bank, court

Keep originals. Banks increasingly ask for a self-declaration that you did not share the PIN or OTP, and that declaration is a document with consequences — if it later emerges that a screen-sharing app was running, the bank will treat the claim as misrepresentation. Write what happened, including the parts that are unflattering.

Filing when the police will not register an FIR

This is the most common point of failure, and there is a statutory answer. Under Section 173(4) of the BNSS, if a police officer refuses to record information about a cognizable offence, the aggrieved person may send the substance of the complaint in writing to the Superintendent of Police, who may then investigate or direct a subordinate to do so. If that also produces nothing, Section 175(3) of the BNSS allows a complaint to be made to the jurisdictional magistrate, who can order an investigation.

In practice a magistrate application is filed with the written complaint, the 1930 acknowledgement, the bank correspondence and an affidavit setting out the delay and the refusal. Magistrates in Kolkata routinely direct registration where the refusal was plainly unjustified, but the application has to be drafted as a criminal complaint, not as a grievance letter.

Where a bank refuses or drags its feet, the route is the RBI's Integrated Ombudsman Scheme, 2021. You must first give the bank thirty days to respond, and the complaint is then filed online with the RBI Ombudsman. The Ombudsman can award compensation for deficiency in service, but it does not decide criminal guilt and it will not compel a beneficiary bank to refund money that has already been withdrawn.

Evidence: why Section 63 of the BSA matters even at the complaint stage

Under Section 63 of the Bharatiya Sakshya Adhiniyam, 2023, an electronic record is proved by producing the device or medium along with a certificate that identifies the record, describes the device, and addresses the integrity of the manner of production. The section replaced the old Section 65B certificate practice but kept its logic: electronic evidence needs an authentication trail, not just a screenshot.

At the complaint stage this means three habits. Screenshot the transaction within the app rather than forwarding a cropped image from a chat. Export the statement as a PDF from net banking, which carries a verifiable reference. And keep the phone you used, untouched, because the defence will eventually want to know whether a remote-access application was installed on it. If you have already reset the device, say so early rather than having it discovered later.

What actually decides the outcome

Whether the money is still in the beneficiary account. Nothing else comes close. A freeze within hours usually means recovery; a freeze on day ten usually means the account holds a few hundred rupees and a queue of other complainants.

Whether the transaction was authorised by you. If you entered the PIN, the bank will argue the payment was authorised and the RBI's zero-liability protection does not apply. That argument is strong on the wording of the 2017 circular, though it sits awkwardly with the fact that you were deceived, and it is litigated rather than settled.

The date of first intimation. Everything turns on whether your first written complaint was inside three working days.

Whether the beneficiary account is a mule. Most fraud money passes through accounts opened with purchased KYC. The account holder is traceable, the operator usually is not, and the case against the mule is often the only case that gets filed.

Whether the bank followed its own process. A bank that failed to acknowledge, failed to raise a chargeback, or failed to respond within thirty days hands you a service-deficiency argument that is often worth more than the original claim.

Five ways a complaint is lost

Complaining only inside the app. Google can suspend an account, but it does not run the chargeback and it cannot order a refund from your bank.
Saying 'I made a mistake'. That phrasing moves you from a fraud claim to a wrong-transfer request, which the bank may decline to process.
Missing the three-day mark because you were waiting for the bank to call back. Send the email; do not wait.
Sending originals and keeping no copies. Every forum will ask again.
Paying a 'cyber recovery specialist' who found you on WhatsApp. No agency charges a fee to freeze an account, and the second approach is usually run by the same network as the first.

A parallel case often helps. If the fraudster used a fake profile or a spoofed handle, the platform takedown request and the police complaint reinforce each other, and a record of both is useful if the matter later reaches the West Bengal cyber crime courts. For a broader view of how these prosecutions unfold, the material at cyber crime lawyer Kolkata sets out the forum and the stages.

When to involve a lawyer

File the first three complaints yourself; they are designed to be filed by a layperson and delay while appointing someone is the real risk. A lawyer earns their place at the second stage: when the bank has rejected the chargeback, when the police have closed the case as untraced, when a magistrate application under Section 175(3) of the BNSS is needed, or when you have been named as an accused because your account received the money. At that point the file needs to be read as a legal record, and the difference between a complaint that fails and one that proceeds is usually a matter of documents and dates rather than argument.

Need help with a cyber crime matter?

Tell me what happened and I will tell you what to file, where, and by when. First conversation is free.

Call +91-9007000603 WhatsApp

Frequently asked questions

What is the first thing to do after a fraudulent Google Pay transaction?

Call 1930 and report the transaction, then file the same details on cybercrime.gov.in. That combination triggers a freeze request to the beneficiary bank, which is the only step with a real chance of stopping the money. Do it before contacting anyone else, including a lawyer.

Can I file a Google Pay fraud complaint without an FIR?

Yes, the 1930 report and the bank dispute can proceed without an FIR, and they are where recovery is decided. But an FIR gives the police power to summon records and attach proceeds under Section 105 of the BNSS, so it is worth pursuing in parallel rather than later.

How long does a UPI chargeback take in India?

NPCI's dispute cycle runs in stages: the remitter bank raises the chargeback, the beneficiary bank responds, and resolution typically takes several weeks rather than days. Your bank must acknowledge your complaint promptly, and if it does not resolve within thirty days you can approach the RBI Ombudsman.

What documents does the bank ask for in a UPI fraud dispute?

The bank will ask for a written dispute letter, the UTR or transaction reference, the account statement showing the debit, the 1930 acknowledgement, and a signed declaration that you did not share your PIN or OTP. Some banks also ask for a police complaint copy and a screenshot of the transaction.

What if the police station refuses to register my cyber fraud complaint?

Send the complaint in writing to the Superintendent of Police under Section 175(3) of the BNSS, and if that yields nothing, apply to the jurisdictional magistrate with the written complaint, the 1930 acknowledgement and the bank correspondence. A magistrate can direct an investigation where the refusal was unjustified.

Is there a time limit to report Google Pay fraud to the bank?

Report within three working days to preserve zero liability under the RBI circular of 6 July 2017. Between the fourth and seventh working day liability is capped at twenty-five thousand rupees, and after seven working days the bank's board-approved policy governs, which usually shifts most of the loss to the customer.

Can I complain to the RBI Ombudsman about a bank's handling of UPI fraud?

Yes, under the Integrated Ombudsman Scheme, 2021, but only after giving the bank thirty days to respond to your written complaint. The Ombudsman addresses deficiency in service and can award compensation; it does not decide criminal liability or direct a refund from the beneficiary's bank.

Does Google Pay refund money lost to fraud?

Generally no. Google Pay is a third-party UPI application and the funds move between bank accounts, so the refund decision sits with the banks under NPCI's dispute rules. Google can restrict the fraudster's account and provide information, which supports the police case but does not by itself return the money.

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Cyber crime lawyer in your city · Bank account freeze help · Contact