If money has gone out of your account through a UPI or other online payment fraud, three things matter most: how quickly you report it, where you report it, and what proof you keep. This guide sets out the official channels in India and the Reserve Bank of India's rules on who bears the loss.
Report immediately - the three places
- Cyber crime helpline 1930. The government's Sanchar Saathi portal says: "If you have already lost money, please report at cyber crime helpline 1930."
- National Cyber Crime Reporting Portal - cybercrime.gov.in. File a written complaint online with your evidence.
- Your bank. Tell the bank through its helpline, app, website or branch, and note the complaint number. This step decides your rights under RBI rules (see below).
Do all three. The helpline and portal bring in the police; the bank complaint starts the clock on the bank's own obligations.
How to file a complaint on cybercrime.gov.in
According to the portal's FAQ, online financial fraud is reported under Report Other Cybercrimes, the section that also covers ransomware, hacking and cryptocurrency crimes.
- Open cybercrime.gov.in and choose the financial fraud option under "Register a Complaint".
- Register with your name and a valid Indian mobile number.
- Pick the category and sub-category that fits what happened.
- Fill in the form. Fields marked with a red asterisk are mandatory. The portal advises giving as much information about the incident as possible.
- Upload your evidence and submit.
After you submit, you get a confirmation on the portal, and an SMS and e-mail with a complaint reference number. The FAQ says complaints "shall be handled by the concerned State/UT police authorities".
Evidence to keep ready
The portal lists these as examples of evidence:
- Bank statement showing the transaction
- Online money transfer receipt
- Copy of the e-mail, if the fraud came by e-mail
- URL of the web page involved
- Chat transcripts
Take screenshots before you block the number or delete the chat. Note the date, time, amount and the transaction reference shown in your UPI app.
Tracking the complaint
Use the acknowledgement number. Log in to the portal and click the check status option. A complaint in this section can be withdrawn before it is converted into an FIR.
What RBI rules say about your loss
RBI's circular "Customer Protection - Limiting Liability of Customers in Unauthorised Electronic Banking Transactions" (RBI/2017-18/15, dated 6 July 2017) applies to scheduled commercial banks, small finance banks and payments banks. It covers remote and online payment transactions - internet banking, mobile banking, card-not-present transactions and prepaid payment instruments - as well as ATM and point-of-sale transactions.
How much you bear depends on who was at fault and when you reported.
| Situation | Customer's liability |
|---|---|
| Fraud, negligence or deficiency on the bank's part | Zero, whether or not the customer reports it |
| Third-party breach, reported within 3 working days | Zero |
| Third-party breach, reported in 4 to 7 working days | The transaction value or the cap below, whichever is lower |
| Third-party breach, reported after 7 working days | As per the bank's board-approved policy |
| Customer's own negligence, such as sharing payment credentials | Entire loss until the customer reports it; losses after reporting are the bank's |
Working days are counted from the day after you receive the bank's communication about the transaction, on the working schedule of your home branch.
The cap for 4 to 7 working days
| Type of account | Maximum liability |
|---|---|
| Basic Savings Bank Deposit accounts | Rs 5,000 |
| All other savings accounts, prepaid instruments and gift cards, MSME current accounts, individual current accounts with average balance or limit up to Rs 25 lakh, credit cards with limit up to Rs 5 lakh | Rs 10,000 |
| All other current, cash credit and overdraft accounts; credit cards with limit above Rs 5 lakh | Rs 25,000 |
What the bank has to do
- Send SMS alerts for electronic transactions, and e-mail alerts where the customer has registered for them.
- Provide 24x7 reporting channels - website, phone banking, SMS, e-mail, IVR, a toll-free helpline and the home branch - and a direct link on its home page for reporting unauthorised transactions.
- Give an immediate acknowledgement with a registered complaint number.
- Act at once to prevent further unauthorised transactions.
- Credit the disputed amount to the account (a "shadow reversal") within 10 working days of being told, without waiting for any insurance claim.
- Resolve the complaint within the time set by its board, which cannot be more than 90 days. If it cannot decide liability in 90 days, it has to pay the compensation due under the circular.
The burden of proving that the customer is liable lies on the bank.
The catch: money you sent yourself
The zero-liability protection is for unauthorised transactions. Where a customer has been negligent, for example by sharing payment credentials, the circular puts the whole loss on the customer until the bank is informed. That is why most scams are built to make the victim approve the payment or hand over the PIN or OTP personally. Reporting still matters in these cases: any loss after you inform the bank is the bank's, and the police complaint is the route to tracing the money. The circular also lets a bank waive a customer's liability at its discretion.
Scam patterns the government asks you to report
Chakshu, the reporting tool on sancharsaathi.gov.in, is for suspected fraud communication received by call, SMS or WhatsApp. Its own examples show the common patterns:
- Messages about your bank account, payment wallet or SIM being blocked
- "KYC update" requests
- Gas connection or electricity disconnection warnings
- Callers impersonating government officials
- Sextortion threats
If you received such a call or message but did not lose money, report it on Chakshu within 30 days. If you lost money, Chakshu is not the place - go to 1930 and cybercrime.gov.in.
The cybercrime portal also has a "Report Suspect" facility for passing on suspicious website URLs, phone numbers, WhatsApp numbers, Telegram handles, e-mail IDs, SMS headers and social media links, and a "Check Suspect" search for looking up a number or website.
Checklist after a UPI fraud
- Call 1930.
- Inform your bank and save the complaint number. Do it within three working days.
- File on cybercrime.gov.in with the bank statement, transfer receipt and chat screenshots.
- Save the acknowledgement number and check status on the portal.
- Report the scam number on Chakshu.
- Do not share an OTP, PIN or screen-sharing access with anyone who calls offering to "reverse" the transaction.
Fraud on a loan or credit card in your name can also show up on your credit report; our guide on how to check your CIBIL score and credit report for free explains how to look for accounts you did not open.
Frequently asked questions
What is the helpline number for UPI fraud in India?
The cyber crime helpline is 1930. The government's Sanchar Saathi portal tells people who have already lost money to report on 1930, and complaints can also be filed online at cybercrime.gov.in.
Can I file a cyber fraud complaint without going to a police station?
Yes. The National Cyber Crime Reporting Portal, cybercrime.gov.in, accepts online complaints of financial fraud. You register with your name and a valid Indian mobile number, and the complaint is handled by the State or Union Territory police concerned.
Will the bank return my money after an unauthorised transaction?
It depends on whose fault it was and how fast you reported it. Under RBI's 2017 circular, a customer has zero liability if the bank was at fault, or if a third party was at fault and the customer told the bank within three working days. If the customer shared payment credentials, the customer bears the loss up to the time of reporting.
How do I track a complaint on cybercrime.gov.in?
You get an acknowledgement number when you file under the Report and Track or Report Other Cybercrime options, along with an SMS and e-mail. Log in to the portal and use the check status option.
Where do I report a scam call if I have not lost any money?
Use Chakshu on sancharsaathi.gov.in. It takes reports of suspected fraud calls, SMS and WhatsApp messages, such as fake KYC update or electricity disconnection messages. Report within 30 days.
Can I withdraw a complaint filed on the cybercrime portal?
According to the portal's FAQ, a complaint filed under the Report Cyber Crime section can be withdrawn before it is converted into an FIR. Complaints under the women and child related crime section cannot be withdrawn.
