If you have lost money through a UPI scam, getting it back may be possible, but recovery is not automatic. What you should do next depends on what actually happened and how quickly you report it.
For example, money taken from your account without your approval is treated differently from a payment you were tricked into authorising with your UPI PIN.
This blog explains what to do after a UPI fraud, where to report it, how the recovery process works and what RBI rules actually say about your liability.
What Is UPI Fraud?
UPI fraud happens when someone uses deception, impersonation or unauthorised access to make you send money, approve a payment or give them access to your bank account through UPI.
For example, suppose someone calls claiming that you are due a ₹2,000 refund. They send you a UPI collect request and ask you to enter your UPI PIN to “receive” the refund. You approve it, and ₹2,000 is deducted from your account instead. That is a UPI scam. You never need to enter your UPI PIN simply to receive money.
Common Types of UPI Fraud
1. Fake Collect Request or Refund Scam
A fraudster sends a UPI payment request while claiming that you need to approve it to receive a refund, cashback, prize or payment. Once you enter your UPI PIN, money is debited from your account.
2. Phishing Links and Fake UPI Pages
You receive an SMS, WhatsApp message or email containing a link that looks like it belongs to a bank or payment app. The page may ask for banking details, login credentials or other sensitive information that can later be misused.
3. Fake Payment Screenshots
A customer or buyer shows an edited payment confirmation or fake payment screenshot even though no money has actually reached the recipient's account. This commonly affects merchants, delivery staff and people selling products directly to buyers.
4. QR Code Scams
A fraudster may replace a merchant's genuine QR code or send you a QR code while claiming that scanning it will help you receive money. If you scan the code and authorise the transaction with your UPI PIN, you may end up paying the fraudster instead.
Understanding how UPI QR code payments actually work can make it easier to recognise suspicious requests.
5. Impersonation Scams
The scammer pretends to be a bank employee, UPI customer support agent, police officer, relative or another trusted person and creates urgency around a payment or account issue. They may then ask you to share sensitive details, approve a transaction or install a remote-access app.
If you realise that you have lost money through a UPI fraud, report it immediately. The sooner the transaction is reported, the sooner banks and cybercrime authorities can begin tracing the money and taking action.
Call the National Cyber Crime Helpline at 1930, which is available 24x7 for reporting financial cyber fraud.
Keep these details ready:
- Your name and registered mobile number
- Name of the bank or payment app
- Transaction ID or 12-digit UTR/RRN
- Date and time of the transaction
- Amount lost
- Recipient's UPI ID, phone number or account details, if available
- A brief explanation of how the fraud happened
Save the acknowledgement or complaint number you receive.
Contact the bank linked to the UPI transaction immediately and report the payment as fraudulent or unauthorised, as applicable.
Share the transaction details and ask the bank to register a formal complaint. Save the complaint or ticket number for future follow-up.
This step is particularly important if the transaction happened without your authorisation, because the time taken to notify the bank can affect your liability under RBI's customer-protection rules.
Step 3: File the Complaint on the National Cyber Crime Reporting Portal
Register the fraud through the National Cyber Crime Reporting Portal at cybercrime.gov.in under Financial Fraud.
Keep the following documents and information ready:
- Transaction ID or UTR
- Bank or payment app name
- Transaction date and fraud amount
- Screenshots of the transaction
- Messages, emails or other communication with the scammer
- Details such as the scammer's phone number, UPI ID or account number, if available
Save the complaint reference number so you can track the complaint later.
Step 4: Report the Transaction in Your UPI App
Open the UPI app used for the payment, find the transaction and use the available Help, Report Issue or Raise Complaint option.
This creates an additional record of the disputed transaction. However, for fraudulent, unidentified or unauthorised transactions, NPCI advises customers to raise the matter with their respective bank for redressal.
If the issue involves money accidentally sent to the wrong person rather than a scam, check how to file a complaint for a wrong UPI transaction.
Step 5: Secure Your Account if You Suspect It Has Been Compromised
If you think someone has gained access to your phone, SIM, banking credentials or UPI account, take steps to prevent further transactions.
Depending on what has been compromised, you may need to:
- Ask your bank to temporarily disable UPI or other digital transactions
- Change your UPI PIN and banking credentials
- Remove suspicious or remote-access apps
- Block your SIM if your phone or SIM has been compromised
If you were tricked into approving one payment but there is no indication that anyone has gained access to your account or device, blocking all UPI access may not be necessary.
You should also be careful about installing unknown payment applications. Fraudsters may distribute fake payment apps designed to imitate legitimate banking or payment interfaces.
Step 6: Preserve All Evidence
Do not delete anything related to the fraud.
Keep copies of:
- Transaction receipts and screenshots
- UPI ID and recipient details
- SMS and WhatsApp messages
- Phone numbers used by the scammer
- Suspicious links or QR codes
- Emails or social media messages
- Bank, UPI app and cybercrime complaint reference numbers
These details may be required by your bank or the investigating authorities while reviewing the complaint.
Can You Get Your Money Back After UPI Fraud?
Yes, money lost through UPI fraud may be recoverable, but a refund is not guaranteed. Recovery depends on factors such as how quickly the fraud is reported, whether the money can still be traced and whether the transaction was authorised by you.
If the Fraudulent Money Can Be Traced
Financial fraud complaints reported through 1930 or the National Cyber Crime Reporting Portal can be processed through the Citizen Financial Cyber Fraud Reporting and Management System (CFCFRMS).
The system enables law-enforcement agencies, banks and other financial institutions to coordinate so that fraud proceeds can be traced and, where possible, placed on hold before they are moved further.
The Ministry of Home Affairs has also introduced a Money Restoration Module to help return funds that have been blocked within the banking system to victims through the applicable verification and legal process.
For example, if you lose ₹50,000 and ₹30,000 can still be traced and placed on hold, that ₹30,000 may potentially be restored. The remaining amount may require further tracing or investigation.
If the Transaction Was Unauthorised
If money left your account without you approving the transaction, RBI's rules on unauthorised electronic banking transactions may apply.
Under RBI's framework, you can have zero liability when:
- The unauthorised transaction happened because of fraud, negligence or deficiency on the bank's part.
- The transaction resulted from a third-party breach where neither you nor the bank was responsible, and you informed the bank within three working days of receiving the transaction communication.
For a qualifying third-party breach reported within four to seven working days, the customer's liability is limited according to RBI's prescribed limits. If it is reported after seven working days, liability is determined according to the bank's Board-approved policy.
If the loss occurred because the customer shared payment credentials, RBI states that the customer bears the loss up to the point at which the unauthorised transaction is reported. Any further unauthorised loss after reporting must be borne by the bank.
For eligible zero or limited liability cases, the bank must provide a shadow reversal within 10 working days of receiving the notification. The complaint and customer liability must be resolved within the timeline specified in the bank's policy, which cannot exceed 90 days.
What If You Were Tricked Into Approving the Payment?
This is different from an unauthorised transaction.
For example, suppose someone pretending to be a bank employee convinces you to transfer ₹20,000. You enter your UPI PIN and approve the transaction because you believe what they told you.
You have still been a victim of fraud, but because you authorised the payment yourself, RBI's zero and limited liability rules for unauthorised electronic transactions do not automatically apply.
You should still report the fraud immediately through 1930 and your bank. If the money can be traced and placed on hold through CFCFRMS, some or all of the available funds may still be recoverable through the restoration process.
How Long Does UPI Fraud Recovery Take?
There is no fixed recovery timeline for every UPI fraud case.
For eligible unauthorised transactions, RBI requires the applicable shadow reversal within 10 working days of notification, while the bank's complaint-resolution process cannot exceed 90 days.
For a scam payment that you authorised, the recovery period depends on whether the money can be traced and held, the amount available for restoration and the investigation and verification involved.
Read More: How to File a Complaint for a Wrong UPI Transaction
How to Protect Yourself From UPI Fraud
A few simple checks can help you avoid common UPI scams:
- Never share your UPI PIN, OTP or banking credentials, even with someone claiming to be from your bank or a UPI app.
- You do not need to enter your UPI PIN to receive money. A PIN is used when authorising a payment.
- Check the recipient's name, UPI ID and amount before approving any transaction.
- Do not scan an unknown QR code to receive money. Scanning a QR code is generally used to initiate a payment.
- Avoid suspicious links and payment requests received through SMS, WhatsApp, email or social media.
- Do not install screen-sharing or remote-access apps when instructed by an unknown caller claiming to provide customer support.
- Use official customer-support channels provided by your bank or UPI app instead of numbers shared through unsolicited messages or random online listings.
- Check transaction alerts regularly and report any unfamiliar UPI payment to your bank immediately.
Merchants should also avoid treating screenshots as proof that a payment has been received. Always verify the transaction in your bank or payment application. You can read more about how fake payment screenshot scams work and the checks businesses can use to spot them.
Conclusion
UPI fraud recovery depends heavily on how quickly you act and what actually happened during the transaction. If you notice a fraudulent payment, report it immediately through 1930, inform your bank, raise the issue in your UPI app and preserve all transaction details and evidence.
Recovery is not guaranteed, but early reporting can improve the chances of tracing and holding the funds before they move further. If the transaction was unauthorised, RBI's customer-protection rules may also limit or remove your liability depending on the circumstances and when you reported it.
The most important thing is to act quickly, use official reporting channels and keep a record of every complaint and reference number until the case is resolved.
Frequently Asked Questions
1. What is UPI fraud recovery?
UPI fraud recovery is the process of trying to recover money lost through a fraudulent UPI transaction. It may involve reporting the transaction to your bank, UPI app, the National Cyber Crime Helpline at 1930 and the National Cyber Crime Reporting Portal.
2. How can I get money back after UPI fraud?
Report the fraud immediately by calling 1930, informing your bank, filing a complaint on cybercrime.gov.in and reporting the transaction through your UPI app. Recovery depends on whether the funds can still be traced or held and whether the transaction qualifies for protection under applicable RBI rules.
3. How do I report UPI fraud?
You should report UPI fraud through multiple official channels:
- Call the National Cyber Crime Helpline at 1930.
- Inform the bank linked to the UPI transaction.
- File a complaint at cybercrime.gov.in.
- Report the transaction through the complaint or support option available in your UPI app.
Keep all complaint and reference numbers for follow-up.
4. What is the UPI scam refund process?
After you report a UPI scam, the bank and relevant authorities may attempt to trace the transaction and identify where the money was transferred. If funds can be located and placed on hold, they may potentially be restored after the applicable verification and legal process. A refund is not automatic.
5. What are RBI's rules for UPI fraud complaints?
RBI's customer-protection framework applies to unauthorised electronic banking transactions. Liability depends on factors such as whether the bank or customer was responsible, whether a third-party breach occurred and how quickly the customer reported the unauthorised transaction.
6. Can a fraudulent UPI transaction be reversed?
It may be possible to recover money from a fraudulent UPI transaction, particularly when the fraud is reported quickly and the funds can still be traced or placed on hold. However, reversal is not guaranteed and depends on the circumstances of the transaction and investigation.
7. What if I sent money to the wrong UPI ID?
A mistaken transfer is different from a fraud. Report the transaction to your bank or UPI app immediately and provide the transaction details. For the complete process, read our guide on how to reverse or complain about a wrong UPI transaction.
8. How long does UPI fraud recovery take?
There is no standard recovery period for every fraud case. For eligible unauthorised transactions, RBI requires the applicable shadow reversal within 10 working days of the bank receiving the notification. Other fraud recovery cases may take longer depending on tracing, investigation and verification.
9. Will I get a refund if I entered my UPI PIN myself?
Not automatically. If a scammer tricked you into entering your UPI PIN and authorising a payment, the transaction is different from one that occurred without your authorisation. RBI's zero and limited liability framework for unauthorised transactions does not automatically guarantee reimbursement in such cases. You should still report the scam immediately because recoverable funds may be traced and held.
10. Can scanning a QR code make money leave my account?
Scanning a QR code can initiate a payment request, but money is generally transferred only after you review and authorise the payment. You do not need to scan a QR code and enter your UPI PIN simply to receive money. Learn more about how UPI QR code payments work.
