News · BFSI
India's central bank has a customer protection framework that can limit or eliminate a victim's liability in UPI fraud cases, but the outcome depends heavily on how quickly the bank is informed.
✦ AI SUMMARY 30-second read
- Zero liability is possible if the bank is at fault or if a third-party breach is reported within three working days of the bank's communication.
- If the customer shared their UPI PIN or approved a collect request, the bank may treat the transaction as customer-authorised, shifting liability to the account holder.
- Victims should contact their bank, call the cybercrime helpline 1930, and file a written complaint while preserving all transaction evidence.
Why it matters: Millions of Indians use UPI daily, and knowing the reporting window and liability rules can determine how much of stolen money is recovered.
This summary was generated by AI. Editors may review and update it.
UPI fraud can drain a bank account within minutes, with scammers using tactics such as impersonating bank officials, fake customer-care numbers, fraudulent payment requests or screen-sharing applications to trick account holders into losing money.
The Reserve Bank of India has a framework that limits customer liability in unauthorised electronic banking transactions. Under this framework, customers may have zero liability in certain circumstances, but the protection depends on how the fraud occurred, whether the customer shared credentials or approved the transaction, and how promptly the bank was notified.
Experts advise that the first few hours after a fraud is discovered are as critical as the formal three-working-day reporting window that governs liability under the RBI framework.
When zero liability applies
If an unauthorised transaction occurs because of the bank's own negligence, fraud or deficiency, the customer has zero liability regardless of when it is reported. Where the breach is attributable to a third party and neither the bank nor the customer is at fault, zero liability applies provided the transaction is reported within three working days of the bank's communication to the customer.
Rohit Mahajan, Founder and CEO of Plutos ONE, notes that RBI requires banks to provide provisional credit in eligible cases within 10 working days, while the complaint must be resolved within 90 days. The responsibility for establishing customer liability rests with the bank, not the customer.
The three-working-day clock does not start from the date of the fraudulent transaction. It begins from the date the customer receives communication from the bank about the unauthorised transaction, with that date itself excluded from the count, and working days calculated according to the working schedule of the customer's home branch.
When the customer may bear the loss
If a customer enters their UPI PIN, shares an OTP or approves a fraudulent collection request, the bank may classify the transaction as customer-authorised. Mandar Patil, EVP at Cyble, explains that in such cases the bank may treat the loss as resulting from customer negligence, meaning the customer generally bears the loss up to the point the fraud is reported.
However, this does not automatically relieve the bank of all responsibility. If a system failure, security lapse or other deficiency on the bank's part contributed to the transaction, liability may shift. Each complaint must be examined on its own circumstances and evidence.
A basic safety point: a UPI PIN is used only to authorise a debit from an account. It is never required to receive money, claim a refund or verify an incoming payment.
Steps to take immediately after a fraud
Victims should call the bank's official helpline at once to report the transaction and request that UPI services or the linked account be blocked. They should then call the national cybercrime helpline 1930 and retain the acknowledgement number, as a prompt report can help authorities alert the receiving bank before funds are moved further.
A dispute should also be raised through the UPI application used for the payment, though this should not replace a direct complaint to the bank. A written complaint must be submitted to the bank, and all evidence — including the UPI transaction ID or UTR, bank statements, SMS alerts, screenshots and details of any communication with the fraudster — should be preserved.
Dr Raj P. Narayanam, Founder and Executive Chairman of Zaggle, stresses that customers should keep a record of every reporting step and its timing, as this timeline can become important if the bank later disputes the complaint.
Escalating a rejected complaint
If the bank rejects a fraud complaint, customers should request the decision in writing along with the reasons, complaint reference number, investigation findings and authentication records. The matter can then be escalated through the bank's internal grievance redressal mechanism, including its grievance redressal officer and principal nodal officer.
If the bank does not resolve the complaint within 30 days, or if the customer is dissatisfied with the response, the matter can be taken to the RBI Integrated Ombudsman under the RBI Integrated Ombudsman Scheme, 2021. The scheme provides a free redressal mechanism for eligible complaints against regulated entities. A complaint must generally be filed within one year of receiving the bank's reply; if the bank does not respond, the limit is one year and 30 days from the date of the original complaint.
The Ombudsman may direct redressal or compensation where the facts support the customer's case, but a refund is not automatic, particularly where the customer knowingly approved the payment or shared credentials.
