UPI Fraud: How to Recover Money Lost in India

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 2 Nov 2026 · Online fraud

Money lost to UPI fraud is recovered through the bank first: a written complaint within three working days, a freeze on the beneficiary account, and a chargeback under the RBI's 2017 limited liability direction. Courts matter when the bank refuses or the amount justifies a recovery suit.

Money lost to a UPI fraud is recovered through the banking channel first and the courts second. The banking channel means a written complaint to your bank's nodal officer within three working days, a freeze request on the beneficiary account, and a chargeback claim processed under the RBI's 2017 direction on limited liability. The courts matter when the bank refuses, delays beyond ninety days, or the amount justifies a recovery suit.

Nothing about this is automatic. A UPI payment is a completed transfer, and the bank cannot simply debit the recipient because you say the payment was a fraud. What the bank can do is freeze the receiving account on a police or portal request, reverse the amount if it is still there, and decide your liability under the RBI rules. Recovery therefore depends on how quickly the money is traced and how clearly you can show that you did not authorise the payment.

What recovery actually means in a UPI case

There are three different things people call recovery, and they are not the same. The first is a reversal, where the same transaction is undone and the money returns to your account. The second is a chargeback or compensation, where the bank or the payment system pays you for a loss it accepts should not have fallen on you. The third is restitution, where a court orders the convicted person or the account holder to pay you back. Reversal is fastest and rarest; compensation is the usual banking outcome; restitution comes last and depends on the accused having assets.

The distinction matters because the evidence and the forum are different for each. A reversal request goes to the bank and the payment network within hours. A compensation claim goes to the bank's nodal officer and then to the RBI Ombudsman. A restitution claim goes to the criminal court or to a civil court, and it needs the identity of the person who took the money. Pursuing one does not automatically start the others, which is why victims who only file a police complaint often recover nothing.

The law and the rules that create the claim

The criminal provisions are section 66D of the Information Technology Act, 2000 for cheating by personation using a computer resource, read with section 318(4) of the Bharatiya Nyaya Sanhita, 2023 for cheating and dishonestly inducing delivery of property. Where the accused received or retained the proceeds, section 66B of the IT Act and section 316 of the BNS, which covers criminal breach of trust, are also used. Section 336 of the BNS covers the forged payment screenshots and fake merchant pages that are common in these cases, and section 61 covers the conspiracy between the caller, the mule account holder and the withdrawing hand.

The recovery right against the bank is not in the IT Act. It comes from the RBI's direction on limited liability for unauthorised electronic banking transactions, issued in July 2017, and from the contract between you and the bank. The direction requires the bank to register the complaint, provide a provisional credit within ten working days, resolve the matter within ninety days, and not charge the customer for reporting a fraud. It sets zero liability where the breach is on the bank's or the system's side and the customer reports within three working days, and a capped liability of five thousand or ten thousand rupees where the report comes within seven working days.

Where the loss arises from a failure to protect sensitive personal data, section 43A of the IT Act gives a right to compensation against a body corporate that was negligent in implementing reasonable security practices. The Digital Personal Data Protection Act, 2023 adds duties on data fiduciaries, though its enforcement structure is still developing. For claims against a bank, the RBI's Integrated Ombudsman Scheme, 2021 provides a free forum that most victims overlook.

How to pursue recovery, in order

Stop further loss. Call 1930 and your bank's fraud line, block the UPI facility and the linked card, and change the passwords on the email and banking apps. If you installed a screen-sharing app at the fraudster's request, uninstall it and check for device administrator permissions you did not grant.
Send the bank a written complaint the same day. Address it to the branch manager and the nodal officer. State the transaction IDs, amounts, timestamps and the UPI handle paid, and say in one clear sentence that you did not authorise the transaction. Ask for a complaint number and for the beneficiary account to be frozen.
File on cybercrime.gov.in and call 1930 again if needed. The portal complaint generates the reference the bank and the police will ask for. Attach the bank statement, the SMS alerts and the screenshots. The portal's freeze request reaches the recipient bank faster than a customer email does.
Register the FIR. Under section 173 of the Bharatiya Nagarik Suraksha Sanhita, 2023, the police must record information disclosing a cognisable offence. If the station refuses, seek the refusal in writing and apply to the Magistrate under section 175(3) for a direction to investigate.
Claim the provisional credit. Under the RBI direction the bank must credit the disputed amount within ten working days while it investigates. If the bank has not done so, write again and quote the direction, the complaint date and the transaction date. Keep the acknowledgement of every letter.
Take the bank's written decision, then escalate. If the bank rejects the claim or does not resolve it within ninety days, complain to the RBI Ombudsman under the 2021 Scheme through the RBI's online complaint portal. The Ombudsman can direct the bank to pay, and the process costs nothing.
Use the criminal case to trace and attach. Once the FIR is registered, the investigating officer can seek the beneficiary account's KYC and transaction history, and the court can order the freezing or attachment of the proceeds. A victim who supplies the transaction trail shortens this considerably.
File a civil recovery suit where the amount justifies it. A suit for recovery of money, or for damages for cheating and negligence, can be filed within the limitation period of three years from the loss. Where there is a risk of the money being moved, an application for attachment before judgment can be considered.

The routes compared

Route	Forum	What you can get	Typical pace
Freeze and reversal	Your bank and the beneficiary bank, on a 1930 or portal request	The exact amount, if it is still in the account	Hours to days
Chargeback or compensation	Bank nodal officer, then RBI Ombudsman	Full or capped amount under the RBI direction	10 to 90 days, then Ombudsman
Criminal prosecution	Police station, Magistrate, sessions court	Conviction and a compensation order	Months to years
Civil recovery suit	Civil court	A decree for the amount with interest and costs	One to three years

The table explains a pattern that frustrates many complainants. The cheapest and fastest route is the banking one, but it is also the one that requires the most disciplined paperwork. The criminal route feels decisive because it carries punishment, yet it rarely returns money on its own, and it depends on the accused being traced and having assets. The civil route can produce a decree even where the criminal case stalls, but a decree against a person with no assets recovers nothing without execution proceedings.

What decides how much comes back

The first factor is the age of the transaction. Freeze requests work on money, not on people, and fraud networks empty mule accounts within minutes. A report made within an hour has a real chance of catching the balance; a report made after three days rarely does. The second factor is whether you reported within the RBI's three-working-day window. That window, not the date you happened to notice the debit, decides whether zero liability applies.

The third factor is whether the bank can point to customer negligence. Approving a collect request, sharing the UPI PIN, scanning a QR code to receive money, or installing a remote-access app at a stranger's request all give the bank a defence. The fourth is whether the payee was a merchant with a registered account or a personal handle used once and abandoned. Merchant transactions leave a better audit trail. The fifth is whether the amount was routed onward before the freeze landed, because a zero balance cannot be reversed.

The last factor is procedural persistence. The RBI framework is triggered by a written complaint and a written outcome. A victim who telephones the call centre five times but never writes a letter has no document to place before the Ombudsman and no date to rely on in court. A single well-drafted email, sent the same day and followed up in writing, is worth more than a week of calls.

What not to do while chasing the money

Do not pay anyone who promises to recover the amount for a fee. Recovery fraud is a second offence built on the first, and legitimate banks and lawyers do not work that way.
Do not delete the fraudster's messages, the payment screenshots or the app after reporting. Section 63 of the Bharatiya Sakshya Adhiniyam, 2023 requires a certificate for electronic records, and the original device makes that certificate possible.
Do not accept a bank settlement that describes the transaction as authorised, unless you have taken advice. It can end the Ombudsman route and weaken the criminal case.
Do not file a civil suit as the first step. It is the most expensive route and it does not freeze anything by itself.
Do not assume the police will inform the bank. Send the bank the FIR copy yourself.

When to involve a lawyer

A small loss with a cooperative bank is usually handled by the complaint and Ombudsman process alone. A lawyer helps where the bank has rejected the claim on a negligence ground, where the amount is large enough that a civil suit and attachment application make sense, where the police have refused to register the FIR, or where your own account has been frozen because funds passed through it. For a Kolkata complainant, bail and quashing matters go to the City Sessions Court and the Calcutta High Court, while the Bankshall Court handles many of the city's financial offence cases.

If you are deciding whether to accept a bank settlement or to litigate, a cyber crime lawyer in Kolkata can tell you what the settlement gives up. Victims who also face a counter-complaint, or whose account has been marked as a mule account, should read the criminal defence material before answering any notice, and can reach the office through the contact page.

Need help with a cyber crime matter?

Tell me what happened and I will tell you what to file, where, and by when. First conversation is free.

Call +91-9007000603 WhatsApp

Frequently asked questions

Can I get my UPI fraud money back?

Yes, if the money is still in the beneficiary account when the freeze request arrives, or if the bank accepts liability under the RBI's 2017 direction. Where the funds have already been withdrawn, recovery depends on the criminal investigation and on whether the accused has assets to repay.

How quickly must I report UPI fraud to the bank?

Report the same day and in writing. The RBI direction gives zero liability if you report within three working days of the unauthorised transaction, and capped liability of five thousand or ten thousand rupees if you report within seven. After seven days the bank's policy governs your share.

Does the bank refund money lost to UPI fraud?

The bank must give a provisional credit within ten working days of your complaint while it investigates, and must resolve the complaint within ninety days. Whether the credit becomes final depends on whether the transaction was unauthorised and whether you were negligent with the PIN or OTP.

Can I file a civil suit to recover UPI fraud money?

Yes. A suit for recovery of money or damages can be filed within the three-year limitation period, usually against the beneficiary account holder and, where onboarding was negligent, the bank. A decree is enforceable only if the defendant has assets, so it is used alongside the criminal freeze.

What is the RBI Ombudsman route for UPI fraud?

Under the Integrated Ombudsman Scheme, 2021 you can complain to the RBI Ombudsman if the bank rejects your claim or does not resolve it within thirty days of your complaint. The complaint is filed online through the RBI portal and costs nothing. The Ombudsman can direct the bank to pay.

Should I hire a recovery agent for UPI fraud?

No. Banks and lawyers do not charge an upfront fee to recover a fraud loss, and anyone who does is running a second fraud aimed at victims. Report such calls to 1930. Recovery happens through the bank, the police and the courts, not through private agents.

What if the fraudster has already withdrawn the money?

The bank cannot reverse a zero balance. The case then moves to the criminal investigation, which can trace the withdrawal, identify the mule account holder and seek restitution. A civil suit can still produce a decree against that person, though recovery depends on finding assets.

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Cyber crime lawyer in your city · Bank account freeze help · Contact