The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →If a UPI debit was not authorised by you, contact the bank that holds the debited account immediately through an official channel. Ask it to register a fraud or unauthorised-transaction complaint, block further unauthorised activity and give you the complaint reference number. Then report the financial cyber fraud through 1930 or the National Cyber Crime Reporting Portal, preserve every transaction identifier and alert, and use your UPI app’s grievance option where available. These routes serve different purposes; an app complaint does not replace the bank report.
Recovery is not automatic. RBI customer-liability protections depend on what happened, how quickly you notified the bank and whether you shared credentials such as your UPI PIN. Follow the sequence below even if the payment was made only minutes ago.
As an Amazon Associate I earn from qualifying purchases.
What to do in the first 15 minutes
- Call or message the account-holding bank through a verified channel. Use the phone number on the bank’s official website, its official mobile app or the number printed on your card or statement. Tell the bank that you are reporting an unauthorised or fraudulent UPI debit, identify each disputed transaction and request a complaint reference number. Ask what immediate account-protection measures it can apply, including blocking further unauthorised activity.
- Do not approve another request. Fraudsters may send a collect request, QR code or link while pretending to issue a refund. A UPI PIN authorises a bank transaction; it is not needed to receive money. Do not disclose the PIN, one-time passwords or card credentials. NPCI’s fraud-awareness guidance warns about links and QR codes designed to make users enter their PIN.
- Report the financial cyber incident through 1930 or the National Cyber Crime Reporting Portal. Keep the transaction date, amount, UPI reference or RRN, bank details, screenshots and messages in front of you while reporting.
- Record the app complaint as a separate reference. If your UPI app offers “Report issue,” “Raise dispute” or a transaction-status grievance, submit it after the bank report and save its acknowledgement.
- Preserve the original evidence. Do not delete SMS alerts, email notices, chat messages, call records, the payment screen or the suspected link. Take screenshots that show the date, amount and transaction identifier.
NPCI directs complaints about fraudulent, unidentified or unauthorised transactions to the customer’s bank. Its complaint-registration page is useful for understanding the routing, but it does not replace reporting to the bank that holds your account.
Which reporting route does what?
Use more than one route, but do not confuse their roles. The bank investigates the debit and applies its customer-liability process; the app handles an in-app transaction grievance or status request; 1930 and the cybercrime portal create a financial-cybercrime report; and RBI’s Ombudsman process addresses an eligible service complaint after you have first complained to the regulated entity.
#1 Best Overall
| Route | Main purpose | When to use it | Reference to retain | What it does not replace |
|---|---|---|---|---|
| Account-holding bank | Fraud complaint, transaction investigation and account protection | Immediately, for every unauthorised debit or suspected UPI fraud | Bank complaint or service-request number | Cybercrime reporting where criminal fraud is suspected |
| UPI app | Transaction grievance, status check or app-level issue report | After or alongside the bank report, when the option is available | In-app ticket or acknowledgement | The bank’s fraud complaint |
| 1930 and National Cyber Crime Reporting Portal | Report a financial cybercrime and provide evidence for the relevant response process | As soon as possible after discovering the debit | Helpline or portal acknowledgement | Notice to the bank and a request for bank liability assessment |
| RBI CMS/Ombudsman | Escalate an eligible complaint about a regulated entity’s service or response | After the bank’s grievance process, if there is no reply within the applicable period or the reply is unsatisfactory | CMS complaint number | An emergency fraud report or first-line bank complaint |
How to raise the dispute with your bank
1. Reach the bank without relying on a message or caller
Use a channel you independently verify: the bank’s official website, its official app, a branch or the number printed on a genuine statement or card. Do not call a number sent by the suspected fraudster. If you go to a branch, take identification and the relevant account or statement details, but do not delay the notification while gathering paperwork.
2. State exactly what you dispute
Say which debit you did not authorise, its date and amount, and that it appears in your account as a UPI transaction. Give the UPI app name and the transaction ID, UPI reference or RRN shown in the app or bank statement. If more than one debit is involved, list them individually rather than describing them as one total.
If you were tricked into approving a payment, describe the events accurately: for example, a person promised a refund, sent a collect request or persuaded you to scan a QR code. Do not describe an authorised action as “no activity” if you actually entered the PIN. The distinction affects how the bank assesses liability, but you should still report the incident as suspected fraud immediately.
Recommended Free Tools
3. Request registration and protective action
Ask the bank to register the complaint as an unauthorised or fraudulent electronic transaction, investigate the recipient and transaction path, and advise what account, UPI or credential blocks are appropriate. Request the complaint reference number, the date and time it was opened, and the bank’s instructions for submitting supporting documents. Keep the name or employee identifier of the person who accepted the report when the channel provides one.
4. Follow the bank’s verified evidence process
Banks may request a written declaration, identity verification, a transaction statement or screenshots. The official material does not establish one universal form or checklist for every bank, so follow the instructions given through your bank’s verified channel. Send only what the bank requests and never send your UPI PIN, password or a full one-time password to a caller.
5. Continue to follow up using the reference
Write down every call, email, branch visit and promised date. When contacting the bank again, quote the original complaint number and ask whether the transaction investigation is open, whether more information is required and what the next review step is. Keep copies of submissions and delivery confirmations.
Report the financial cyber fraud through 1930 or the portal
Bank reporting and cybercrime reporting are complementary. The cybercrime channel records the suspected criminal incident and the bank handles the account transaction complaint. Use 1930 as soon as you discover the loss, or submit through the National Cyber Crime Reporting Portal’s financial-fraud process.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsInformation to prepare
- Your name and contact details requested by the reporting channel.
- The bank or payment details associated with the debit.
- Transaction date, amount, UPI transaction ID, reference number or RRN.
- The account or instrument from which the money was debited, as requested through the official form.
- Screenshots of the transaction, SMS or email alerts, chats, phone numbers, links, QR codes and other images that show how the fraud occurred.
- The bank complaint number and any UPI-app ticket number, if already issued.
Submit carefully and save the acknowledgement
Check every number before submitting. A single wrong digit in a transaction reference can make matching the debit harder. Save the acknowledgement page, message or call reference and add it to your incident log.
The cited portal instructions describe a follow-up registration within 24 hours for the Delhi process. That local instruction should not be treated as a nationwide deadline. If the helpline or portal gives you a different instruction for your location, follow that instruction; if in doubt, ask the reporting channel or local police what follow-up is required.
Use the UPI app’s grievance feature without mistaking it for a fraud report
Participating banks’ UPI apps can provide a transaction grievance or status-check route, according to NPCI’s UPI FAQ. Open the transaction history, select the disputed payment and choose the available option such as “Report issue” or “Raise dispute.” Enter the reason accurately and retain the ticket number.
BHIM’s product information describes a report-issue route for declined transactions; other apps may label their options differently. An in-app ticket can help correct a status or route a payment complaint, but it is not a substitute for telling the account-holding bank that you suspect fraud. If the app shows “successful” while you did not authorise the payment, report it to the bank and cybercrime channel even if the app ticket is still pending.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Can a UPI payment be stopped after it starts?
NPCI’s UPI FAQ gives a direct answer: “No, once the payment is initiated, it cannot be stopped.” That statement concerns stopping an initiated payment inside UPI. It does not prevent the bank from recording a fraud complaint, investigating the debit, seeking recovery where possible or assessing whether RBI customer protections apply. Report immediately even when the transaction already shows successful.
How RBI customer-liability rules affect your dispute
RBI’s framework on limiting customer liability in unauthorised electronic banking transactions is conditional. The bank will classify the facts and apply the relevant rules; a report does not guarantee a refund in every scam.
Unauthorised debit versus payment made after deception
An unauthorised debit is one you did not initiate or approve. A payment made after someone deceived you into entering your PIN or approving a request is factually different, even though you may still have been the victim of fraud. Tell the bank exactly what you did, what the other person said and whether you shared a PIN, password, OTP or remote access. Request a written explanation of the liability assessment rather than assuming that every scam is treated identically.
The three-working-day condition
For specified third-party breaches, the RBI framework provides zero liability when the customer notifies the bank within three working days of receiving the bank’s transaction communication. This is a conditional rule, not a universal three-day deadline for every UPI dispute. It depends on the type of breach and the facts the bank establishes, so report immediately even if three working days have passed.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What happens when credentials were shared
Where a customer shares payment credentials, the framework says the customer can bear losses until reporting the transaction to the bank. That does not make reporting pointless: notification stops the period during which the customer may continue to bear losses under the applicable rule, and the bank must still assess the entire incident. Do not conceal credential sharing; provide a complete account and ask which provision the bank applied.
Why timing still matters after a successful payment
Early notification gives the bank and cybercrime authorities the best chance to trace or restrict funds and establishes when you discovered the incident. The exact recovery outcome depends on the transaction, the recipient account, the investigation and the applicable RBI and bank procedures.
Build an evidence file that another investigator can follow
Create one folder, digital or physical, and keep an incident log with the date and time of every action. Include:
- A downloaded statement or transaction screen showing each disputed debit.
- The UPI transaction ID, RRN or other reference exactly as displayed.
- Date, time and amount for every transaction, including small test debits.
- SMS, email and push notifications from the bank or UPI app.
- Screenshots of chats, caller IDs, links, QR codes, profiles and advertisements involved in the deception.
- The bank complaint number, cybercrime acknowledgement, 1930 reference and UPI-app ticket.
- Notes of calls and branch visits: date, channel, person or team, advice received and promised follow-up.
Do not crop away the transaction reference or alter screenshots. Keep the original files and make a separate copy. Share them only through the bank’s or reporting channel’s verified upload or email process.
What to do if the bank’s response is unsatisfactory
Complete the bank’s internal complaint process first
Ask for a written response explaining the decision, the transaction classification, the evidence considered and any appeal or nodal-officer route. If the bank says it needs more information, provide it through the verified channel and note the submission date.
Check whether RBI Ombudsman escalation is available
RBI’s Ombudsman FAQ says a customer may approach the Ombudsman when the regulated entity has not replied within 30 days, or the applicable longer period, or when the customer is dissatisfied with the reply. Eligibility and scheme conditions apply, so read the current instructions before filing.
Observe the general filing windows
The FAQ describes a general limit of one year after the entity’s reply. Where there is no reply, it describes one year and 30 days after the customer’s representation to the entity. These are general limits under the cited scheme; confirm the current rule and any exceptions in RBI’s complaint-management system before submitting.
File through RBI CMS with a complete chronology
Use RBI’s CMS route specified in the current Ombudsman instructions. Attach the bank complaint, response or proof of no response, transaction records and your dated follow-up log. Explain the service failure or unresolved complaint, state the remedy you seek and identify the documents by date. RBI Ombudsman escalation is not a replacement for the 1930 or cybercrime report and does not turn an ineligible dispute into an eligible one.
Common situations and the right response
Money disappeared and you never opened the UPI app
Treat it as an unauthorised debit: notify the bank immediately, ask for protective blocks, report through 1930 or the portal, save the transaction identifiers and submit the app grievance if available.
You entered your PIN after a caller promised a refund
Report the fraud promptly and describe the deception and the approval accurately. Ask the bank to assess liability under the current RBI framework. Preserve the caller’s number, messages, link or QR code and any screen recording.
The app shows a failed or declined transaction but money is missing
Capture the status and account statement, raise the app’s transaction issue and notify the bank. BHIM, for example, documents a report-issue route for declined transactions. Ask the bank to reconcile the debit rather than retrying the payment yourself.
The fraudster still has access to your phone or account
From a clean device, contact the bank through an official channel and ask what credentials or UPI access must be blocked or reset. Change passwords through official applications, remove unknown remote-access software and secure the email and mobile-number accounts linked to banking. Do not use a link supplied by the suspected fraudster to “secure” the account.
Prevent a second loss while the complaint is open
- Never share the UPI PIN, OTP, card PIN, net-banking password or full card details with a caller, chat contact or “support” account.
- Remember that entering a UPI PIN sends money; it is not required to receive a refund.
- Read the payee name and amount on the confirmation screen before approving a collect request.
- Do not scan an unknown QR code to receive money, and do not open unsolicited links that request a PIN.
- Enable bank transaction alerts and review statements frequently so an unfamiliar debit is reported quickly.
- Use only the bank’s and payment app’s official support paths; ignore search-result ads, forwarded numbers and social-media messages claiming to recover funds.
Bottom line
For an unauthorised UPI debit, the correct order is bank first and immediately, cybercrime report next, app grievance alongside it, and meticulous evidence preservation throughout. RBI protections are fact- and timing-dependent, so accurate disclosure and rapid notification matter more than arguing that every scam has the same legal result. If the bank’s response remains unresolved, use RBI’s Ombudsman route only after checking its current eligibility and filing windows.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
