UPI Fraud Complaint Process in India: Steps and Timeline

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 2 Nov 2026 · Cyber crime

A UPI fraud complaint must be filed with two authorities at once: helpline 1930 or cybercrime.gov.in for the criminal case, and your bank's nodal officer for the freeze and chargeback. The first 24 hours decide whether the money is still in the beneficiary account when the freeze request arrives.

A UPI fraud complaint goes to two places at the same time. The criminal complaint goes to the national cyber crime portal or to helpline 1930, and the money claim goes to your bank's nodal officer under the RBI's limited liability framework. The first twenty-four hours usually decide whether the beneficiary account is frozen while the money is still sitting in it.

UPI transfers settle in seconds and cannot be pulled back by the sender. The system therefore runs on speed and on the bank's duty to freeze the receiving account once a fraud is reported. A complaint made only to the police, and never to the bank, normally loses the freeze window. A complaint made only to the bank, with no portal acknowledgement or FIR behind it, is often closed as an ordinary customer dispute. Doing both, in writing, is what makes the process work.

What the law says about a UPI fraud complaint

Cheating by personation through a computer resource is a specific offence under section 66D of the Information Technology Act, 2000, punishable with imprisonment up to three years and a fine up to one lakh rupees. Where the fraudster used another person's credentials, section 66C of the same Act covers identity theft, and section 66B covers the dishonest receipt of a stolen computer resource, which is how mule account operators are usually charged.

On the criminal side, the general cheating provisions of the Bharatiya Nyaya Sanhita, 2023 apply alongside the IT Act. Section 318(4) punishes cheating and dishonestly inducing the delivery of property, and carries imprisonment up to seven years with a fine. Section 336 covers forgery, section 340 covers a forged electronic record, and section 61 covers criminal conspiracy where more than one person arranged the mule account, the SIM and the withdrawal. Sections 66D and 318(4) are commonly invoked together, because one addresses the use of the computer resource and the other addresses the dishonest inducement.

The procedural side sits in the Bharatiya Nagarik Suraksha Sanhita, 2023. Section 173 requires the police to register information disclosing a cognizable offence, and its proviso allows that information to be given by electronic communication, which is the legal footing for a portal complaint. Section 175(3) lets you ask a Magistrate to direct an investigation if the police refuse to register your case. Section 35 restricts arrest without notice for offences punishable with less than seven years, and sections 480 and 482 govern regular and anticipatory bail.

The money claim rests on the RBI's direction on limited liability for unauthorised electronic banking transactions, issued in July 2017. It creates a three-tier structure. If the fraud is caused by a third-party breach and the customer is not negligent, and the customer reports within three working days, liability is zero. If the report comes after three but within seven working days, the customer's liability is capped, at five thousand rupees for basic accounts and ten thousand rupees for other accounts. Beyond seven working days, liability is fixed by the bank's own policy. The direction also requires the bank to provide a provisional credit within ten working days and to resolve the complaint within ninety days.

Filing the complaint, step by step

Call 1930 immediately. The national cyber crime helpline logs the call and gives you a reference. Have the transaction ID, the amount, the time and the UPI ID or mobile number you paid ready. Do not wait until morning and do not wait to gather documents.
Tell your bank in writing, not only by phone. Call the bank's fraud line to block the card or UPI facility, then send an email to the nodal officer and to the branch, quoting the transaction. Ask for the complaint number in the same email. This written record is the piece of evidence that fixes your reporting date under the RBI direction.
Ask for the beneficiary account to be frozen. Say plainly that you are reporting an unauthorised transaction and request that the receiving account be put on hold. Banks act on the portal's freeze request faster than on a customer email, which is why the next step matters.
File on cybercrime.gov.in. Choose the financial fraud category, enter the transaction details, upload the screenshots and the bank statement, and save the acknowledgement number. The portal routes the complaint to the police unit and issues a ticket that you can track.
Register an FIR at the police station. Under section 173 of the BNSS you are entitled to have your information recorded. Take a printed copy of the portal acknowledgement and a signed complaint. If the officer declines, ask for the refusal in writing and move to section 175(3) before the Magistrate.
Preserve the original evidence. Keep the phone, the SMS alerts, the bank statement and the chat with the fraudster untouched. Electronic records are admissible under section 63 of the Bharatiya Sakshya Adhiniyam, 2023, but the certificate required by that section has to be produced, and that is far easier when the original device and account are intact.
Follow up in writing every week. Ask the bank for the status of the freeze and the chargeback, and ask the investigating officer for the case number and the account details traced. Keep every reply.
Escalate to the RBI Ombudsman if the bank does not resolve it. Under the Reserve Bank's Integrated Ombudsman Scheme, 2021, you can complain to the Ombudsman if the bank rejects your claim or does not respond within thirty days. The complaint can be filed online at the RBI's complaint portal at no cost.

Documents to keep and the timeline that applies

Document or action	Why it matters	Timing
Call to 1930 and its reference number	Creates the first official record of the fraud	Same hour
Written complaint to the bank's nodal officer	Fixes your reporting date for the liability rules	Within 3 working days
Bank statement and UPI transaction history	Shows the debit, the UPI handle and the reference number	Immediately
Screenshots of the payment page and chats	Shows what you were told and what you relied on	Before deleting anything
Portal acknowledgement and FIR copy	Links the criminal complaint to the money claim	As early as possible
Provisional credit from the bank	Required within ten working days of the complaint	10 working days
Final written decision from the bank	Required within ninety days	90 days

Two timing rules deserve separate mention. First, the three-working-day and seven-working-day windows in the RBI direction are counted from the date of the unauthorised transaction, not from the date you noticed it, so a delayed discovery shortens your protection. Second, there is no statutory deadline for lodging an FIR in a cheating case, but courts and banks both treat delay as a fact that has to be explained, and a complaint filed months later is examined far more closely.

What decides the outcome

The single biggest factor is whether the money is still in the beneficiary account when the freeze request lands. Fraud networks withdraw quickly, so a complaint that reaches the bank within hours has a materially better chance of a chargeback than one filed after a week. The second factor is your own conduct. If you approved the collect request, shared the UPI PIN, scanned a QR code sent by a stranger or installed a screen-sharing app at their request, the bank will argue that you authorised the transaction, and section 66D or 318(4) then has to be proved against the fraudster rather than presumed against the bank.

The third factor is documentation. A bank facing a claim looks for a written complaint with a date, a transaction reference, a police acknowledgement and a clear statement that you did not authorise the debit. A claim supported only by a phone call is easy to dispute. The fourth is the quality of the trail the investigation can build: the mule account's KYC, the device identifiers, the IP logs and the withdrawal location. Where those are traced and the account holder is identified, both the criminal case and the civil claim become much stronger.

Finally, the bank's own system logs matter more than most customers expect. The bank can see the device binding, the IP address and the session history. If the fraud happened through a device the bank had never seen, that supports your case. If it happened on your own device after an OTP was delivered to your registered number, the bank will say the authentication was complete and the loss arose from your failure to protect the credentials.

Mistakes that weaken a UPI fraud complaint

Reporting only to the bank or only to the police, instead of both.
Deleting the fraudster's chat, the SMS alerts or the app after the loss.
Resetting the phone or clearing the UPI app before the device is examined.
Waiting for the bank's internal review before filing the portal complaint.
Paying a second "recovery fee" to someone who promises to retrieve the money, which is a fresh fraud.
Signing a bank form that describes the transaction as authorised in order to get a faster response.
Filing a civil suit before the freeze and chargeback track has been exhausted, which wastes the cheapest remedy available.

One mistake is worth spelling out. A customer who is told by a call centre that the matter is "under process" often does nothing for weeks. The ninety-day resolution requirement does not pause because a call centre said so, and the Ombudsman route depends on a written complaint and a written outcome. If the bank has not put its decision in writing, there is nothing to escalate and nothing to challenge later.

When to involve a lawyer

Most straightforward UPI frauds are handled without a lawyer if the amounts are small and the bank responds. A lawyer becomes useful when the bank rejects the claim on a negligence ground, when the police refuse to register the FIR, when the amount is large enough that a civil suit or an application for attachment is worth considering, or when you are the account holder whose account has been frozen because a fraudster routed money through it. For a Kolkata complainant, the practical forums are the local police station, the Bankshall Court for the city's cheque and financial offences, the City Sessions Court and the Calcutta High Court for bail and quashing matters.

If you are weighing a criminal complaint against a civil claim, or you have been accused of receiving part of a UPI fraud, it helps to speak to a cyber crime lawyer in Kolkata before you sign anything at the bank. The same facts often support both a prosecution and a recovery suit, and the order in which you pursue them affects what you can recover. Our cyber crime law practice in Kolkata handles both tracks, and the blog carries the document checklists for each stage.

Need help with a cyber crime matter?

Tell me what happened and I will tell you what to file, where, and by when. First conversation is free.

Call +91-9007000603 WhatsApp

Frequently asked questions

How do I file a UPI fraud complaint online?

File on cybercrime.gov.in under the financial fraud category, entering the transaction ID, amount, time and the UPI handle you paid. Upload the bank statement and screenshots, then save the acknowledgement number. Report to helpline 1930 as well and send a written complaint to your bank's nodal officer the same day.

What documents are needed for a UPI fraud complaint?

Keep the bank statement showing the debit, the UPI app transaction history with the reference number, the SMS and email alerts, screenshots of the chat or payment page, and the 1930 or portal acknowledgement. Carry a photo ID and a signed written complaint when you go to the police station for the FIR.

Is there a time limit to report UPI fraud?

There is no statutory deadline for the FIR, but the RBI liability rules work on strict windows. Report within three working days for zero liability and within seven working days for capped liability. Delay beyond that leaves the bank's own policy to decide your share of the loss.

Can the bank reverse a UPI payment after I approve it?

The bank cannot reverse a completed transfer on your instruction alone. It can freeze the beneficiary account on a police or portal request and reverse the amount if the money is still there. Your written complaint and the freeze request are what start that process.

What if the police refuse to register my UPI fraud FIR?

Ask for the refusal in writing and then apply to the Magistrate under section 175(3) of the BNSS, 2023 for a direction to investigate. Attach your written complaint and the portal acknowledgement. The Magistrate can order the police to register and investigate the case.

Which court hears UPI fraud cases in Kolkata?

Financial offence cases are commonly listed before the Bankshall Court, bail applications before the City Sessions Court, and quashing or transfer petitions before the Calcutta High Court. The police station that registers the FIR determines where the case first goes.

How long does a UPI fraud complaint take to resolve?

The RBI direction requires the bank to provide a provisional credit within ten working days and to resolve the complaint within ninety days. If the bank rejects the claim or misses that deadline, you can escalate to the RBI Ombudsman under the Integrated Ombudsman Scheme, 2021 at no cost.

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Cyber crime lawyer in your city · Bank account freeze help · Contact