UPI fraud and company liability under the IT Act

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 4 Nov 2026 · Cyber law

In a UPI fraud the criminal who took the money is liable first, but your bank, the payment service provider and sometimes a platform can owe you compensation too. That liability is not automatic. It arises from specific duties under the IT Act, 2000 and the RBI's rules on unauthorised electronic transactions.

When a UPI transfer is induced by fraud, the person who takes your money is a criminal. The company that moved the money, meaning your bank, the app or the payment service provider, is not the thief. The real question is narrower: does any duty run from that company to you, and what follows when the duty is breached? The answer is yes, in three separate ways, and each is governed by a different body of law.

First, the fraudster's conduct is punished under the Bharatiya Nyaya Sanhita, 2023 and the Information Technology Act, 2000. Second, your bank's liability for an unauthorised debit is decided by the Reserve Bank of India's directions on unauthorised electronic transactions and the RBI Integrated Ombudsman Scheme, 2021. Third, a body corporate or an intermediary that was negligent can carry liability under sections 43, 43A and 79 of the IT Act. A company is never liable merely because it built the app; it becomes liable when it owed you a duty and failed it.

Who is "the company" in a UPI fraud?

Before any claim is framed, separate the players, because each has a different relationship with you:

Your bank or payment service provider — the bank that holds your account and routes the UPI instruction out of it.
The beneficiary bank — the bank whose customer received the money you lost.
The retail payment system operator — the entity that runs the network over which the instruction travelled.
The merchant or platform — an e-commerce entity, aggregator or app through which the fraud was induced.

A claim against one of these is not automatically a claim against the others. A section 43A claim against a body corporate is a different cause of action from a bank's liability under the RBI framework, which is different again from the criminal case against the fraudster.

What the law says: the criminal side

Inducing a person to part with money by deception is cheating under section 318 of the BNS, 2023. Where the fraudster pretends to be someone else, a bank official, a customer care executive or a relative, section 319 makes cheating by personation an offence. On the technology side of the same conduct, section 66D of the IT Act punishes cheating by personation using a computer resource, and section 66C punishes identity theft, meaning the fraudulent or dishonest use of another person's password or unique identification feature. Section 66 covers dishonest or fraudulent acts in relation to a computer resource, and section 65 protects computer source code from tampering.

These provisions are aimed at the fraudster. They are the reason an FIR is worth filing even when the amount is modest, and the reason the police, rather than your bank, is the primary investigator. They do not, by themselves, make a bank or an app liable.

How the fraud is run, and why that matters

Most UPI losses follow a handful of patterns. A collect request is sent that looks like a payment received. A fake customer care number is found online and the caller talks the victim into approving a request or sharing a screen. A lookalike merchant QR code diverts a payment. In each case the network worked exactly as designed; what failed was authentication, and authentication failure is where questions of negligence begin.

This matters because liability turns on whose security failed. If the bank's systems allowed a transaction without the authentication the RBI requires, the deficiency is the bank's. If the customer approved the request, the bank will say the negligence is the customer's. The facts of how the fraud ran, recorded clearly and early, decide which side of that line the claim falls on.

What the law says: company liability

Section 79 and the intermediary safe harbour

Section 79 of the IT Act exempts an intermediary from liability for third-party information it transmits or hosts, provided it satisfies the conditions in section 79(2), principally the due diligence published in the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021. The exemption is conditional. It falls away if the intermediary conspired or abetted the offence, or failed to act after being directed to by a court or a government agency. Whether a particular payment platform is an intermediary at all is contested, and courts have answered that question differently on different facts.

Sections 43 and 43A: compensation for negligence

Section 43 makes a person who accesses a computer resource without the owner's permission liable to pay compensation for the damage caused. Section 43A goes further. Where a body corporate possesses, deals with or handles sensitive personal data in a computer resource that it owns, controls or operates, and is negligent in maintaining reasonable security practices and procedures, it is liable to pay damages by way of compensation to the person affected. These are civil compensation rights that sit inside a criminal statute, and they are the clearest route to a claim against a company rather than a fraudster.

Your bank's liability under the RBI framework

The RBI's directions on customer protection for unauthorised electronic banking transactions create a graded liability regime rather than blanket responsibility. The core structure is this:

Situation	Customer's liability
Contributory fraud, negligence or deficiency on the bank's part	Nil
Third-party breach with no negligence by the customer	Nil
Loss caused by the customer's own negligence	Limited, as set out in the framework
Delay by the customer in reporting the transaction	Governed by the framework's reporting conditions

The framework also lays down how and when you must report. A customer who wants the protection of the zero-liability rule must notify the bank without delay and, in any event, within three working days of receiving a communication about the unauthorised transaction. Banks are required to nominate a nodal officer for these disputes and to maintain a Board-approved policy on customer liability. Where liability is nil, the framework requires the bank to credit the amount to the customer's account within a short fixed period measured from the complaint.

The framework binds the bank. A cardholder agreement does not displace it. This matters because banks sometimes refuse claims by asserting "negligence" or "shared credentials" without making the finding the framework requires, and an assertion is not a finding.

Two channels run in parallel here and should not be confused. The 1930 helpline and the cybercrime.gov.in portal feed the Citizen Financial Cyber Fraud Reporting and Management System, through which banks act to freeze funds; that is the recovery track. The complaint to your bank's nodal officer under the RBI framework is the liability track, and it decides whether the bank itself must bear the loss. A single incident may need both, and a reference number from each.

Can you pursue the beneficiary bank?

The bank that received your money is not usually your debtor. Your contract is with your own bank. But the beneficiary bank has duties under the RBI directions to act on a fraud report and to place a lien or hold on funds traceable to an unauthorised transaction, and the investigation runs through it. In practice, pressure on the beneficiary bank is applied through the police and through your own bank's nodal officer, not by suing it directly. Money is recovered more often by freezing it early than by proving fault later. Pull the beneficiary account details and the transaction reference out of your statement at once, because the freeze request needs them.

The e-commerce platform and the aggregator

Where the fraud was induced through a shopping site, a fake seller listing or an aggregator, the platform's obligations run through the Consumer Protection Act, 2019 and the Consumer Protection (E-Commerce) Rules, 2021, alongside the intermediary safe harbour in section 79. A platform that hosts a fake seller, ignores a valid takedown notice, or fails to display the seller's identity is in a weaker position than one that acted promptly. The safe harbour and the consumer rules are read together, and a platform that ignores complaints can lose the protection it would otherwise have.

Step by step: building a claim against a company

Report the crime first. File on cybercrime.gov.in or call 1930, then register a police complaint. A live investigation helps, because the money trail is being traced and accounts can be frozen while funds are still traceable.
Notify the bank in writing, immediately. Use the app's fraud-reporting route or the bank's nodal officer, and keep the complaint reference number safe.
Demand a written decision. Ask the bank to state on paper whether it treats the transaction as customer-negligent, and on what basis.
Escalate to the RBI Ombudsman under the Integrated Ombudsman Scheme, 2021 if the bank refuses, delays or gives no reasons.
Consider the consumer route. A deficiency in service can be pursued before a consumer commission under the Consumer Protection Act, 2019, and the e-commerce rules apply where the fraud ran through an online platform.
Consider section 43 or 43A compensation where a body corporate was negligent with your data, your credentials or your account.

What decides who pays

Whose negligence it was. If you shared an OTP, approved a collect request or installed a remote-access app, the bank will allege contributory negligence, and the zero-liability rule will not apply to you.
How fast you reported. Speed is the factor most within your own control and the factor banks weigh most heavily.
Whether a duty existed at all. A company that merely processed a genuine-looking instruction may owe you nothing at all.
Whether the intermediary kept its safe harbour. Weak grievance handling under the 2021 Rules weakens the section 79 defence.
Whether the money is still traceable. Recovery is realistic while the funds remain in the beneficiary account, and largely theoretical once they have been layered away.

Where the law is still unsettled

There is no settled rule that a payment aggregator or a UPI app owes a defrauded customer compensation simply because the fraud used its rails. Whether section 79 covers payment system operators, and how far the RBI liability framework reaches non-bank entities, are questions still being worked out case by case. Anyone who tells you a platform "must" refund you has gone beyond what the law presently says. That gap is exactly why the paperwork has to be built properly.

Common mistakes

Reporting only to the app's in-app support and never to the police or to 1930.
Accepting a verbal assurance from a call centre instead of recording a complaint reference number.
Deleting the SMS alerts, chat threads and screenshots that establish the timeline.
Filing the bank complaint weeks later, then arguing about negligence.
Assuming the beneficiary bank will return the money on request without an investigation.

When to involve a lawyer

A lawyer becomes useful when the bank has refused the claim in writing, when the Ombudsman route has run its course, or when the amount justifies a compensation claim under section 43 or 43A. For a Kolkata victim this means assessing the claim against the bank and against any platform separately, and choosing the forum that can actually give relief. Our page on cyber crime cases in Kolkata explains how these matters are handled, and you can contact the chamber if you want your UPI fraud claim assessed against the bank rather than the fraudster. Where the aim is recovery of money rather than punishment, the route described under civil litigation is often the more practical one.

Need help with a cyber crime matter?

Tell me what happened and I will tell you what to file, where, and by when. First conversation is free.

Call +91-9007000603 WhatsApp

Frequently asked questions

Is a bank liable for UPI fraud in India?

A bank is liable where the unauthorised transaction was caused by its own deficiency or negligence, or by a third-party breach in which the customer was not negligent. Under the RBI's directions on unauthorised electronic transactions, the customer's liability in those situations is nil. Where the loss was caused by the customer's own negligence, the liability is limited as the framework provides.

Which section of the IT Act deals with company liability for cyber fraud?

Sections 43 and 43A of the IT Act, 2000 deal with compensation. Section 43 covers unauthorised access to a computer resource, and section 43A makes a body corporate liable for damages where it is negligent in maintaining reasonable security practices for sensitive personal data it handles. Section 79 gives intermediaries a conditional exemption from liability for third-party content.

What is the time limit to report UPI fraud to the bank?

You must notify the bank without delay, and in any event within three working days of receiving a communication about the unauthorised transaction, to claim the protection of the zero-liability rule. Waiting longer does not destroy your right to complain, but it weakens the claim and gives the bank a reason to allege negligence on your part.

Can a payment app be held liable for a UPI fraud?

Only if the app owed you a duty and breached it. There is no settled rule that a payment aggregator or a UPI app must compensate a defrauded customer merely because the fraud used its network. A claim is stronger where the platform was negligent with your data or credentials, or ignored valid takedown complaints and so lost its safe harbour.

What is the difference between bank liability and the fraudster's liability?

The fraudster's liability is criminal and personal, arising under section 318 of the BNS, 2023 and sections 66C and 66D of the IT Act. The bank's liability is civil and contractual, governed by the RBI's directions on unauthorised electronic transactions. You can pursue both, but they are separate proceedings before different authorities.

How do I escalate a refused UPI fraud claim against my bank?

First ask the bank for a written decision. If it refuses, delays or gives no reasons, escalate to the RBI Ombudsman under the Integrated Ombudsman Scheme, 2021. You can also pursue a deficiency in service before a consumer commission under the Consumer Protection Act, 2019. For negligence with your data, sections 43 and 43A of the IT Act provide a separate compensation route.

Does a cardholder agreement limit what my bank owes me?

No. The RBI's liability framework for unauthorised electronic transactions binds banks and is not displaced by the terms of a cardholder or account agreement. Banks often cite shared credentials or negligence when refusing a claim, but the framework requires an actual finding of customer negligence, not a bare assertion in a rejection letter.

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Cyber crime lawyer in your city · Bank account freeze help · Contact