If you have lost money to a UPI scam, mistakenly sent rupees to a wrong account, woken up to find your account drained at 3am by an OTP you never shared, or transferred a deposit to a fake landlord posing as the real one, you are far from alone. UPI processes more than 20 billion transactions a month in India. A small but punishing fraction of those go wrong every day, through phishing calls, fake KYC updates, fake QR codes, SIM swap fraud, deepfake video calls, screen-mirroring apps, and good old typing the wrong UPI ID. The law has more for you than most banks let on. This blog walks through the framework that decides who pays and how you actually get your money back.
The Golden Hour: Why the First 60 Minutes Matter
The first hour after discovering a UPI fraud is often called the 'Golden Hour'. Victims should immediately contact the bank, call 1930, and file a complaint on the National Cyber Crime Reporting Portal. Early reporting increases the possibility of placing a hold on the beneficiary account before funds are withdrawn or layered through multiple accounts. Although not a statutory limitation period, prompt reporting is repeatedly emphasised by cyber-crime authorities and significantly improves recovery prospects.
Customers should ensure that the complaint is also made in writing, preferably through email or by obtaining a written acknowledgement from the bank. A written complaint serves as crucial evidence before the RBI Integrated Ombudsman, Consumer Commission, or the courts if the dispute subsequently escalates.
The architecture rests on three pillars. The Reserve Bank of India Circular dated 6 July 2017 on limiting liability of customers in unauthorised electronic banking transactions defines when the bank pays and when the customer pays. The Information Technology Act, 2000 criminalises and compensates for cyber fraud and unauthorised access to your account. And Section 72 of the Indian Contract Act, 1872 governs accidental transfers and creates a hard legal duty on the recipient to return money paid by mistake. Recent Supreme Court and High Court decisions, including a March 2025 Supreme Court order in State Bank of India v. Pallabh Bhowmick, have made the customer position significantly stronger than it was even three years ago.
The two situations: fraud versus mistake
UPI complaints fall into two analytically distinct buckets, and the legal route depends on which bucket you are in.
Unauthorised transactions are debits from your account that you did not authorise. Phishing calls that trick you into sharing an OTP, fake KYC update calls that get you to download a screen-sharing app, SIM swap fraud where the fraudster uses a duplicate SIM to harvest your OTPs, malware that captures your credentials, or unauthorised use of your card or UPI ID after the device is lost or stolen, all fall here. The RBI 2017 Circular is the primary framework.
Mistake transfers are debits you authorised, but to the wrong person or in the wrong amount. You meant to send Rs 5,000 to a friend with the UPI ID rahul@oksbi and typed rahull@oksbi by accident. Or you used a QR code scanned from a marketplace and the merchant later confirmed they never received it. Mistake transfers are governed by Section 72 of the Indian Contract Act and recovery is a civil matter[1].
The two categories are sometimes blurred in practice. A fraud victim who was tricked into sending money to a fake landlord through a UPI link technically authorised the transaction. Whether courts treat such transfers as fraud (calling in the IT Act and the RBI Circular) or as mistake (calling in Section 72) depends on the specific deception and the evidence available.
The Information Technology Act and UPI fraud
The Information Technology Act, 2000 creates both criminal and civil consequences for UPI fraud. Section 43 of the Act provides for penalty and compensation where a person accesses a computer system without authorisation, downloads or copies data, introduces a virus or contaminant, disrupts access, charges services to another account, or destroys data. The section creates statutory liability to pay damages by way of compensation to the affected person[2].
The criminal side adds Section 66 (computer-related offences), Section 66C (identity theft, punishable with up to three years imprisonment and a fine of up to Rs 1 lakh), and Section 66D (cheating by personation using a computer resource, with up to three years imprisonment). These are typically applied alongside Section 318 of the Bharatiya Nyaya Sanhita 2023 (formerly Section 420 of the Indian Penal Code) for cheating. A UPI fraud FIR will routinely invoke all of these together.
For the victim, the criminal route exists primarily to identify and prosecute the fraudster, not to recover money. Recovery typically runs through the RBI customer protection circular and, if necessary, the courts.
The RBI 2017 Circular: the heart of the customer protection framework
The Reserve Bank Circular dated 6 July 2017 titled Customer Protection - Limiting Liability of Customers in Unauthorised Electronic Banking Transactions is the single most important text for any UPI fraud victim. The Bombay High Court in Jaiprakash Kulkarni v. Banking Ombudsman set out the operative clauses in full[3]. The framework establishes three categories of customer liability.
Zero liability of the customer arises when the fraud or negligence is on the bank side (contributory fraud, negligence or deficiency by the bank, regardless of whether the customer reports), or when there is a third-party breach where the deficiency lies neither with the bank nor with the customer but elsewhere in the system, and the customer notifies the bank within three working days of receiving the communication about the unauthorised transaction.
Limited liability of the customer caps the customer loss based on the type of account and the time taken to report. If the customer reports between four and seven working days, the loss is capped at a Reserve Bank-prescribed amount (Rs 5,000 for basic savings accounts, up to Rs 25,000 for other savings and most credit cards). If the customer was actually negligent (sharing the OTP, for example) the customer bears full loss until reporting, but the bank carries liability for losses after the report.
Full liability of the customer applies where the customer reports beyond seven working days, and the bank policy permits limiting that liability.
The procedural counterpart matters as much. As the Bombay High Court quoted directly from the circular, the bank is obliged to credit (shadow reversal) the disputed amount to the customer account within 10 working days of notification, value-dated to the date of the unauthorised transaction. The bank does not get to wait for an insurance claim to settle or for the police investigation to complete before reversing the debit[3].
On being notified by the customer, the bank shall credit (shadow reversal) the amount involved in the unauthorised electronic transaction to the customer's account within 10 working days from the date of such notification by the customer (without waiting for settlement of insurance claim, if any). Banks may also at their discretion decide to waive off any customer liability in case of unauthorised electronic banking transactions even in cases of customer negligence. The credit shall be value dated to be as of the date of the unauthorised transaction.
Importantly, the circular places the burden of proving customer liability on the bank, not on the customer. The customer evidence requirement is limited to showing that the transaction was unauthorised and that they reported it within the prescribed period. Once that is on record, the bank must prove customer negligence to escape liability[3].
How the NPCI UPI Dispute Mechanism Works
When a UPI dispute is raised, the complaint generally moves from the remitter bank to NPCI and then to the beneficiary bank. If the beneficiary account still contains the disputed amount, the bank may mark a lien or freeze the amount pending investigation. If the claim is established, the amount may be reversed. Victims should regularly seek written status updates from their bank.
What the courts have actually done
The post-2017 case law has been overwhelmingly pro-customer where the customer reported promptly and did not deal away credentials. The Supreme Court March 2025 order in State Bank of India v. Pallabh Bhowmick settled the position at the highest level. The customer, an advocate from Guwahati, received a fraudulent customer-care call and lost Rs 94,204 in three transactions on 18 October 2021. He reported within 24 hours. The Banking Ombudsman rejected his complaint citing customer negligence. The Gauhati High Court reversed, and the SBI special leave petition reached the Supreme Court. Justices Pardiwala and Mahadevan recorded the Court full agreement with the High Court that there was no customer negligence, that the transactions were unauthorised and fraudulent, and that the bank had the technology and the responsibility to prevent them. The SLP was dismissed[4].
The original petitioner who suffered the loss was not negligent in any manner. All transactions relating to the account were found to be unauthorized and fraudulent. It is the responsibility of the bank so far as such unauthorized and fraudulent transactions are concerned. The Bank should remain vigilant. The Bank has the best of the technology available today to detect and prevent such unauthorized and fraudulent transaction. Further, clauses 8 and 9 respectively of the RBI Circular dated 6-7-2017 make the position further clear.
The Rajasthan High Court in Rakesh Totuka v. Department of Financial Services (August 2025) went further. The petitioner had lost Rs 58,93,000 to unauthorised transactions from an IDBI Bank Dropline OD account in February 2022 and had reported within two days. The Banking Ombudsman had partly allowed his complaint, awarding only Rs 15,60,000. The High Court applied the RBI Circular and judgments from other High Courts and the Supreme Court to direct IDBI Bank to pay the entire amount with 6 percent interest per annum from December 2022 until actual payment[5].
The Bombay High Court in Jaiprakash Kulkarni is one of the most useful decisions for non-individual customers. A family company had Rs 76,90,017 debited through a third-party breach where unknown beneficiaries were added without an OTP being received by the petitioners. The court ordered Bank of Baroda to refund the full amount within six weeks with 6 percent interest, quashing the Banking Ombudsman contrary order[3].
The Kerala High Court in Tony Enterprises v. Reserve Bank of India (2019) addressed SIM swap fraud specifically. The Court coined the useful concept of a disputed transaction as one prima facie tainted by fraud and supported by independent investigation. In such cases, the RBI Circular presumes customer innocence; the bank cannot recover from the customer and must restore the amount, with the bank remedy lying in approaching the civil court against the fraudsters[6].
The exception: where the customer credentials were used deliberately
The customer protection framework has a clear limit. The Allahabad High Court in Suresh Chandra Singh Negi v. Bank of Baroda (July 2025) declined relief where the bank produced evidence showing the transactions had been made by the customers themselves using their internet banking credentials with knowledge of their passwords and OTPs[7]. The court distinguished Pallabh Bhowmick and Jaiprakash Kulkarni on the ground that those cases involved third-party breaches without customer involvement.
The lesson is sharp. Customers who deliberately initiated the transfer, even if they were later deceived about its purpose, are unlikely to recover under the RBI Circular. They retain a remedy under the Bharatiya Nyaya Sanhita and the IT Act against the fraudster, and against the recipient under Section 72 of the Contract Act for mistaken payment. They do not, however, have an automatic claim against the bank.
Section 72: the law of mistake transfers
For accidental UPI transfers, Section 72 of the Indian Contract Act, 1872 is the cornerstone. The provision is brief and powerful[1]:
A person to whom money has been paid, or anything delivered, by mistake or under coercion, must repay or return it.
The Kerala High Court applied Section 72 to a banking context in Ameen Trading Co v. Bank of Baroda (1993). A bank had credited Rs 50,000 twice to a customer account due to a duplicate transfer telegram and sued to recover the second amount. The Court held that the customer was bound to return the money under Section 72 unless they had altered their position to their detriment based on the mistaken payment[8]. The principle applies identically to a person who receives money sent to the wrong UPI ID by mistake. They must return it. They do not get to retain the windfall on the ground that the sender was careless.
There are two practical problems with the Section 72 remedy. The first is that you must identify the recipient, which requires the cooperation of the banks involved (the sender bank can request the recipient bank to share account-holder details, but the recipient bank often refuses citing data protection without a court order). The second is that recovery requires either voluntary return or a civil suit. Section 72 does not give a self-executing right to claw back the amount.
Civil Recovery and Interim Injunctions
Where the mistaken transfer involves a substantial amount, the sender may institute a civil recovery suit under Section 72 of the Indian Contract Act and simultaneously seek an interim injunction restraining the recipient from withdrawing or dissipating the amount. Early judicial intervention may preserve the disputed funds until final adjudication.
Although civil proceedings for recovery are governed by the applicable limitation law, victims should not delay initiating legal action. In cases involving mistaken UPI transfers, prompt action not only strengthens the legal claim but also increases the practical likelihood of tracing the funds and securing interim relief before the amount is withdrawn, transferred, or otherwise dissipated.
Digital Evidence Checklist:-
Transaction ID and UPI Reference Number
Screenshots of the transaction
Bank SMS alerts
Emails from the bank
Complaint acknowledgement
Cyber Crime Portal complaint number
1930 complaint reference
FIR copy
WhatsApp chats
Fraudster’s phone number
Call recordings
What to do if money has left your account
The first 48 hours after a UPI fraud or mistake transfer matter more than anything else in the recovery process.
For an unauthorised transaction
Block UPI, internet banking and cards immediately. Call your bank helpline and use the in-app freeze if available.
Send a written notification to the bank. Email and a registered letter both, within three working days, mentioning the transaction date, amount, beneficiary if known, and the words unauthorised electronic banking transaction so the RBI 2017 Circular is clearly triggered.
File a complaint on the National Cyber Crime Reporting Portal or call the helpline 1930. Early reporting can sometimes enable a fund hold on the recipient account before the money is withdrawn or moved.
Lodge an FIR at the local police station or cyber crime cell, particularly when the loss exceeds Rs 50,000.
Track the 10-working-day shadow reversal deadline. If the bank does not credit your account by then, escalate to the Banking Ombudsman.
For a mistake transfer
Contact the recipient directly if you have their phone number. Most mistaken transfers, particularly for small amounts, can be resolved this way.
Raise a complaint on the UPI app or with your bank within 24 to 48 hours. Use the NPCI UPI Dispute Redressal Mechanism, which lets banks coordinate beneficiary contact.
If the recipient refuses or cannot be reached, send a legal notice citing Section 72 of the Indian Contract Act demanding return of the amount within a specified time.
File a complaint with the Banking Ombudsman if the banks are not cooperating.
File a civil suit for recovery under Section 72 if the amount justifies the litigation cost.
Where to escalate when the bank refuses
If the bank does not act within 30 days of your complaint, the Banking Ombudsman under the Reserve Bank of India Integrated Ombudsman Scheme, 2021, is the next step. The scheme handles deficiency of service complaints, including unauthorised electronic transactions and the bank failure to comply with the RBI Customer Protection Circular. Complaints can be filed online through the RBI complaints portal, and the Ombudsman is required to dispose of them within 30 days of receiving a written response from the bank.
If the Banking Ombudsman declines relief, your remedy is a writ petition before the High Court under Article 226, as the petitioners in Pallabh Bhowmick, Jaiprakash Kulkarni, Rakesh Totuka and several other recent cases successfully did. The writ route is especially powerful where the Ombudsman has misapplied the RBI Circular or where the bank has refused to follow it.
Consumer Commission as an Additional Remedy
The Banking Ombudsman is not the only forum available to an aggrieved customer. Where a bank fails to comply with the RBI Circular dated 6 July 2017, unreasonably delays the investigation of an unauthorised electronic transaction, refuses to grant the mandatory shadow reversal, or otherwise acts in breach of its statutory or contractual obligations, the customer may also approach the Consumer Commission under the Consumer Protection Act, 2019. Banks provide “services” within the meaning of the Act, and any failure to exercise due care, follow RBI directions, or address a genuine grievance may amount to a deficiency in service.
Depending on the facts of the case, the Consumer Commission may direct the bank to refund the disputed amount, pay interest on the delayed refund, compensate the customer for financial loss, mental agony and harassment, and award litigation costs. In appropriate cases, the Commission may also issue directions requiring the bank to rectify its deficient practices. Consumer proceedings are particularly useful where the bank has ignored the RBI Customer Protection Circular, failed to maintain adequate security standards, or has rejected a legitimate claim without conducting a fair and reasoned investigation.
The availability of a remedy before the Consumer Commission does not necessarily exclude recourse to the RBI Integrated Ombudsman Scheme or other remedies available under law. The choice of forum depends upon the nature of the dispute, the relief sought, and the facts of the individual case. However, where there is clear deficiency in banking service or non-compliance with RBI directions, the Consumer Commission remains an effective and independent forum for obtaining monetary compensation and other appropriate relief.
Common mistakes that destroy UPI fraud recovery
Three mistakes recur in failed recovery cases.
The first is delayed reporting. The RBI Circular places strict liability on customers who fail to notify within seven working days. The shorter window of three working days for zero liability is even tighter. Banks routinely use the timing argument to push customers into the limited or full liability buckets. Always report on the day the fraud is discovered, in writing.
The second is sharing credentials and then claiming unauthorised transaction. If you shared the OTP, downloaded a screen-mirroring app, or read out your CVV to a customer-care caller, you have a much harder case. The Allahabad High Court in Suresh Chandra Singh Negi shows the limit. Document the deception carefully and never admit, in writing, to having shared anything. Let the bank prove the negligence.
The third is treating the FIR as the recovery mechanism. The First Information Report is essential for the criminal route and is sometimes a precondition the bank insists on before refunding, but the FIR is not the recovery mechanism. The recovery happens through the RBI Circular and the Ombudsman, or through a writ petition. Pursuing only the criminal complaint while the 10-working-day reversal deadline expires is the most common path to a permanent loss.
Common Myths vs Reality
Misconceptions about UPI fraud often prevent victims from taking timely and effective action. Understanding the correct legal position can significantly improve the chances of recovering the lost amount.
Myth 1: Filing an FIR is enough to recover the money.
Reality: An FIR is essential for initiating criminal investigation and prosecuting the offender, but it is not, by itself, a recovery mechanism. Victims must simultaneously notify their bank in writing, report the incident through the National Cyber Crime Helpline (1930) or the Cyber Crime Reporting Portal, and invoke the protections available under the RBI Circular dated 6 July 2017. Delaying banking remedies while relying solely on the criminal process may substantially reduce the chances of obtaining a refund.
Myth 2: Scanning a QR code always receives money.
Reality: In most cases, scanning a QR code initiates a payment from the customer’s account after authentication through a UPI PIN. Genuine receipt of money generally does not require the payer to enter a UPI PIN. Fraudsters frequently exploit this misconception by persuading victims to scan QR codes under the false pretext of receiving a refund, prize, advance payment, or salary. Customers should remember that entering a UPI PIN ordinarily authorises a debit, not a credit.
Myth 3: Banks must wait for the police investigation before reversing the transaction.
Reality: The RBI Customer Protection Circular requires banks, in eligible cases of unauthorised electronic banking transactions, to credit the disputed amount to the customer’s account within the prescribed period by way of a shadow reversal, without waiting for the completion of a police investigation or settlement of an insurance claim. A pending criminal investigation does not, by itself, justify withholding the customer protection mandated by the RBI framework.
Myth 4: Once a UPI transaction is successful, the money can never be recovered.
Reality: Recovery remains possible, although the legal route depends on the nature of the transaction. Unauthorised transactions may attract protection under the RBI Circular, while mistaken transfers can be recovered through Section 72 of the Indian Contract Act, 1872, by seeking repayment from the recipient or instituting appropriate civil proceedings. Prompt reporting also increases the possibility of freezing the beneficiary account before the funds are withdrawn or transferred further.
Myth 5: Reporting the fraud after a few days makes no difference.
Reality: Time is one of the most critical factors in UPI fraud recovery. The RBI Circular links customer liability to the time taken to report the unauthorised transaction, and delayed reporting may reduce or even eliminate the customer’s entitlement to reimbursement. Equally, early reporting enhances the likelihood of the beneficiary account being frozen before the proceeds of fraud are dissipated.
Frequently Asked Questions (FAQs)
1. Can a bank refuse to refund money lost in a UPI fraud?
It depends on the facts of the case. If the transaction was unauthorised and the customer reported it within the time prescribed under the RBI Circular dated 6 July 2017, the bank cannot reject the claim without establishing customer negligence. The burden of proving such negligence lies on the bank. A mere allegation that the customer was careless is insufficient; the bank must support its conclusion with credible evidence. If the bank wrongly refuses the claim, the customer may approach the RBI Integrated Ombudsman, the Consumer Commission, or the High Court, depending on the circumstances.
2. Can the police recover money lost in a UPI fraud?
Yes, but recovery is not guaranteed. The police can investigate the offence, identify the fraudsters, trace the flow of funds, and request freezing of beneficiary accounts. However, the criminal investigation is separate from the customer’s right to reimbursement under the RBI Circular. Victims should therefore pursue both criminal remedies and banking remedies simultaneously rather than waiting for the outcome of the police investigation.
3. Can a wrong UPI transfer be reversed?
A mistaken UPI transfer cannot ordinarily be reversed automatically once it has been successfully processed. However, the sender should immediately report the error to the bank or UPI service provider and request that the beneficiary bank contact the recipient. If the recipient refuses to return the amount, the sender may seek recovery under Section 72 of the Indian Contract Act, 1872, by issuing a legal notice and, if necessary, filing a civil suit for recovery.
4. What happens if the recipient has already spent the money?
The recipient does not acquire a legal right to retain money received by mistake. Even if the amount has been withdrawn or spent, Section 72 of the Indian Contract Act continues to impose an obligation to repay the sender. The sender may institute a civil recovery suit and, where appropriate, seek interim relief against the recipient’s assets. In cases involving fraud, criminal liability may also arise.
5. How long does the RBI Integrated Ombudsman usually take to decide a complaint?
Under the RBI Integrated Ombudsman Scheme, 2021, a customer should ordinarily first give the bank an opportunity to resolve the grievance. If the bank fails to respond within 30 days or the response is unsatisfactory, the customer may approach the Ombudsman. The Scheme envisages expeditious disposal of complaints, although the actual time may vary depending on the complexity of the dispute and the volume of pending cases.
6. What if I shared my OTP or UPI PIN with the fraudster?
Sharing confidential credentials may amount to customer negligence and can affect the customer’s entitlement under the RBI Circular. However, every case depends on its facts. Courts have recognised that sophisticated frauds involving deception, impersonation, malware, or other cyber techniques may not necessarily amount to negligence in every situation. Customers should avoid making admissions regarding negligence and should provide the bank with a complete and accurate account of how the fraud occurred.
7. Can I sue the person who received my money?
Yes. Where money has been transferred by mistake, the sender may institute a civil suit under Section 72 of the Indian Contract Act seeking repayment of the amount. If the transfer forms part of a fraudulent scheme, criminal proceedings under the Information Technology Act, 2000 and the Bharatiya Nyaya Sanhita, 2023 may also be initiated against the wrongdoer, in addition to the civil remedy.
8. Can Google Pay, PhonePe or Paytm refund my money?
UPI applications such as Google Pay, PhonePe and Paytm primarily function as payment service providers facilitating transactions through the UPI network. They generally do not have unilateral authority to reverse successful transactions or debit money from the recipient’s account. Refunds usually depend upon the cooperation of the remitter bank, the beneficiary bank, and the NPCI dispute resolution mechanism. Customers should therefore report the incident immediately through the UPI application, notify their bank in writing, and, where necessary, invoke the remedies available under the RBI Circular and applicable law.
9. Does reporting the fraud to the 1930 Cyber Helpline improve the chances of recovery?
Yes. Prompt reporting to the National Cyber Crime Helpline (1930) and the National Cyber Crime Reporting Portal significantly increases the likelihood of the beneficiary account being frozen before the fraudulently transferred funds are withdrawn or layered through multiple accounts. Although there is no statutory “golden hour” rule, early reporting is strongly encouraged by cyber law enforcement agencies and can materially improve recovery prospects.
10. What documents should I preserve after discovering a UPI fraud?
Customers should preserve all relevant evidence, including bank SMS alerts, UPI transaction IDs, screenshots, emails, complaint acknowledgements, call records (where lawfully available), FIRs, Cyber Helpline reference numbers, and all correspondence with the bank. Proper documentation is often decisive in proceedings before the bank, the Ombudsman, the Consumer Commission, or the courts.
Conclusion
UPI has transformed digital payments in India by making transactions faster, simpler, and more accessible. At the same time, it has created new opportunities for cybercriminals to exploit unsuspecting users through increasingly sophisticated methods of fraud. While technological advancements continue to evolve, so too has the legal framework governing unauthorised electronic transactions and mistaken transfers.
The combined effect of the RBI Circular dated 6 July 2017, the Information Technology Act, 2000, Section 72 of the Indian Contract Act, 1872, the Consumer Protection Act, 2019, and the evolving jurisprudence of the Supreme Court and various High Courts provides customers with substantial legal protection. The decisions in State Bank of India v. Pallabh Bhowmick, Jaiprakash Kulkarni, Rakesh Totuka, and other recent cases demonstrate that courts are increasingly willing to enforce customer rights where banks fail to comply with their statutory obligations.
The key to a successful recovery, however, lies in prompt action. Victims should immediately report the incident to their bank in writing, contact the National Cyber Crime Helpline (1930), preserve all digital evidence, and pursue the appropriate legal remedies without delay. Whether the dispute involves an unauthorised electronic transaction or a mistaken transfer, understanding the applicable legal framework and acting within the prescribed timelines can significantly improve the prospects of recovering the lost amount.
Ultimately, UPI fraud may be technologically sophisticated, but the law is not powerless. An informed customer who understands the available legal remedies, acts swiftly, and relies on the protections recognised by statute and judicial precedent is in a far stronger position than many banks and fraudsters would have them believe.