Grievance & Safety
What to do in the first hour after UPI or bank fraud
Money moves through mule accounts within minutes. This is the exact order of actions for the first hour, and the RBI rule that decides whether you bear the loss or the bank does.
Speed is the whole game. Fraudulent money is moved through layers of mule accounts within minutes of leaving yours, and every hour that passes makes a freeze less likely to catch anything. There is also a hard legal deadline: under the Reserve Bank's customer protection framework, reporting within three working days is what separates zero liability from partial liability.
Do these things in this order. Do not spend the first hour arguing with a call centre or searching for a customer care number on Google — fake helpline numbers planted in search results are themselves a common second-stage scam.
Before you start
- Your phone, your bank's official app, and the transaction SMS or app notification.
- Note the exact time of the debit, the amount, and the UPI reference or transaction ID.
- Do not delete any message from the fraudster. It is evidence.
Step by step
-
Call 1930 immediately
1930 is the national cyber crime helpline. This is the first call, before your bank. The operator files a report on the National Cyber Crime Reporting Portal and triggers the process that flags the receiving account. Have the transaction ID and amount ready.
-
File the complaint on cybercrime.gov.in in parallel
Register the same incident at cybercrime.gov.in under financial fraud. You get an acknowledgement number. Keep it — every later escalation asks for it.
-
Report to your bank through the app or official number only
Use the number printed on your debit card or inside your bank's own app. Never a number from a search result or a social media reply. Ask them explicitly to record the report and give you a complaint reference number. Verbal assurances are worth nothing later.
-
Block the payment channel
Ask the bank to block the card or freeze the account or UPI handle involved, so no further debits go through while this is being investigated. In your UPI app, disable the UPI ID if the app allows it.
-
Get the report in writing within three working days
Send the bank a written complaint — email to their grievance address, keeping the acknowledgement. This creates the dated record that your zero-liability claim depends on. The clock runs from when the bank's alert reached you, not from when you noticed.
-
File a police complaint if the amount is significant
Take the NCRP acknowledgement to your local cyber cell or police station and get an FIR or a written acknowledgement. Banks move faster on cases with a police reference.
-
Escalate if the bank stalls
If the bank has not resolved it in 30 days, escalate to the RBI Ombudsman through cms.rbi.org.in. Attach the NCRP number, the bank complaint reference and the dated written complaint.
Fees, timelines and key facts
| Cyber crime helpline | 1930 — call first, before anything else |
|---|---|
| Reporting portal | cybercrime.gov.in |
| Reported within 3 working days | Zero liability, where neither you nor the bank was negligent (RBI customer protection framework) |
| Reported in 4–7 working days | Limited liability — capped at ₹5,000, ₹10,000 or ₹25,000 depending on account and instrument type |
| Reported beyond 7 working days | Governed by the bank's own board-approved policy |
| Bank's reversal obligation | Shadow credit within 10 working days of your notification, without waiting for any insurance settlement |
| If unresolved in 30 days | RBI Ombudsman at cms.rbi.org.in |
If something goes wrong
The bank says 'OTP was used, so it is your fault'
An OTP having been used does not automatically end the inquiry. SIM swap, malware, device compromise and spoofed banking screens all produce a valid OTP without your consent. Insist in writing that they examine the transaction trail, and escalate to the Ombudsman if they refuse.
You cannot get through on 1930
Keep trying while simultaneously filing on cybercrime.gov.in. The portal filing is itself a valid report and is timestamped.
You realise only after a week
Report anyway. Late reporting weakens the zero-liability claim but does not extinguish it — banks may still waive liability, and recovery is sometimes possible if the money is still sitting in an identified account.
Someone calls offering to recover your lost money
This is a second scam targeting fraud victims. No agency charges a fee to recover defrauded money. Hang up and report the number.
Questions people ask
Will I definitely get my money back?
No guarantee. Recovery depends on how fast the receiving account is frozen and whether funds remain in it. What the RBI framework guarantees is the allocation of liability — if you reported within three working days and were not negligent, the loss should not fall on you.
Should I call the bank or 1930 first?
1930 first. It initiates the account-freeze machinery across banks, which is time-critical. Then your bank, within minutes.
Does the three-day clock start when I notice the fraud?
It starts from your receipt of the bank's communication about the transaction — typically the SMS or email alert. This is why ignoring transaction alerts is expensive.
What if the fraud was on a wallet or a small finance bank?
The same RBI customer protection framework was extended to cover these entities. The reporting timelines and liability structure apply.
Official pages for this task
These are the only sites that can actually do this for you. Everything else is a middleman.