What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
If you spot a UPI debit you did not authorize, contact your bank immediately through its official app, website, statement or card details. Report the financial cyber fraud through 1930 or the National Cybercrime Reporting Portal, and raise a complaint in your UPI app. Save every acknowledgment and transaction detail. A completed UPI payment cannot be cancelled with a stop-payment request, and reimbursement depends on the circumstances and how quickly you report it.
What to do first after an unauthorized UPI debit
Use the bank, cybercrime and UPI-app channels in parallel. They have different jobs: the bank handles account security and the transaction complaint; 1930 and the National Cybercrime Reporting Portal record the financial cyber fraud; the UPI app provides a transaction-level grievance route.
As an Amazon Associate I earn from qualifying purchases.
- Contact your bank immediately. Use a reporting channel listed in the bank’s official app, website, account statement or card. State clearly that the UPI transaction was unauthorized. Ask the bank to take immediate steps to prevent further unauthorized transactions and secure the affected account or payment access. Request an acknowledgment and complaint reference, and save them. RBI requires banks to provide round-the-clock reporting channels and take immediate preventive steps after notification. RBI customer-protection direction.
- Report the financial cyber fraud. Call 1930 or use the National Cybercrime Reporting Portal. The portal’s published instructions ask for information including your mobile number, bank or wallet, the account or UPI identifier debited, transaction ID and date; provide card details if card credentials were involved. Keep screenshots if available. If you report by helpline, the instructions say to complete portal registration within 24 hours using the acknowledgment/login ID. Save the SMS or email acknowledgment.
- Raise a complaint in the UPI app. Open the transaction in its history and use the app’s help or grievance option. Save the app’s reference number. NPCI says customers can raise a grievance or check transaction status through a participating bank’s UPI app; for a fraudulent, unidentified or unauthorized transaction, its complaint portal directs customers to their bank. NPCI UPI FAQ and NPCI complaint portal.
- Keep the evidence together. Record the transaction reference or RRN if shown, date and time, amount, payer or beneficiary details displayed, UPI app and linked bank account. Add the bank complaint number, cybercrime acknowledgment, app reference, screenshots, and relevant calls or messages. These are among the details requested by the official NPCI complaint portal and cybercrime reporting instructions.
- Secure any exposed access. Ask the bank what steps apply to your situation and follow its official procedure. If your phone or SIM is lost, NPCI advises contacting your bank and blocking the mobile number used for UPI device registration. Never disclose your UPI PIN, OTP, password or remote-access code to someone claiming to help. NPCI says bank support will never ask for your UPI PIN. NPCI UPI FAQ.
Can you stop or reverse a fraudulent UPI payment?
Not with a stop-payment request once the payment has been initiated. NPCI’s UPI FAQ says an initiated payment cannot be stopped. Contacting the bank and reporting to 1930 are still important: they support account containment, complaint handling and possible recovery efforts, but neither guarantees that a completed transfer will be reversed.
Recommended Free Tools
Keep a completed unauthorized transfer separate from a failed or declined transaction. NPCI describes real-time reversals for declined transactions and advises contacting the bank if an amount debited for a failed transaction is not returned. That guidance does not establish the outcome for a completed fraudulent transfer. NPCI UPI FAQ.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
How RBI rules affect liability and refunds
RBI’s customer-liability direction applies to unauthorized electronic banking transactions. The outcome depends on who was responsible and when the customer reported the transaction after receiving the bank’s communication; it does not guarantee a refund in every UPI-fraud case. Under the direction dated 6 July 2017, the specified third-party breach case—where neither the bank nor the customer was at fault—has these reporting windows:
| When the customer reports | Liability under the specified third-party breach case |
|---|---|
| Within three working days of receiving the transaction communication | Zero customer liability. |
| In four to seven working days | Limited to the transaction amount or the applicable amount in RBI’s table, whichever is lower. |
| After seven working days | The bank’s board-approved policy applies. |
If the loss is due to customer negligence, such as sharing credentials, the customer bears the loss until reporting; losses after reporting are borne by the bank. RBI directs banks to provide a shadow credit within 10 working days after customer notification in eligible zero- or limited-liability cases, without waiting for an insurance claim. The bank must resolve the complaint and establish liability within its policy timeline, capped at 90 days. The bank bears the burden of proving customer liability. These are rules for covered cases, not a finding that a particular transaction qualifies. RBI customer-protection direction.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
How to follow up if the complaint is unresolved
Use the bank’s own grievance escalation route and quote the bank complaint number and cybercrime acknowledgment. Check the complaint status through the relevant channel, but do not treat an NPCI status check as the bank’s final decision: NPCI says complaints are routed to the member bank or institution, which is responsible for resolution. NPCI complaint portal.
Quick Recap
Best Value
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
