Yes, UPI fraud is legally actionable in India. A fraudulent UPI transaction can lead to criminal proceedings, banking complaints, recovery or reversal efforts, and other legal remedies depending on how the fraud occurred. UPI is an instant payment system operated through the banking system, and both banks and customers have defined responsibilities when unauthorised transactions occur.
The legal response depends on the nature of the fraud, whether the transaction was genuinely unauthorised, whether the customer shared credentials, and how quickly the incident was reported.
What Is UPI Fraud?
UPI fraud generally involves obtaining money through deception, unauthorised access, manipulation or misuse of UPI-related credentials.
Common examples include:
- Fraudulent UPI transfers made without the account holder’s permission
- Fake customer-care scams
- Fraudulent QR-code schemes
- Fake cashback or reward links
- Impersonation of bank officials
- Phishing or social-engineering scams
- Fraudulent payment requests
- Use of compromised banking credentials
NPCI specifically warns users about fake cashback links, QR-code scams, fake customer-support channels, unknown applications and social-engineering techniques. It also explains that scanning a QR code and entering a UPI PIN is intended for making a payment, not receiving money.
Is UPI Fraud a Criminal Offence?
It can be.
The Bharatiya Nyaya Sanhita, 2023 (BNS), which came into force on 1 July 2024, contains provisions that can apply to fraudulent conduct involving money and deception. Section 318 defines cheating as deception that fraudulently or dishonestly induces a person to deliver property or take an action causing or likely to cause harm.
For example, if a fraudster impersonates a bank employee and deceives a victim into transferring money through UPI, the facts may support allegations of cheating, along with other applicable offences depending on the method used.
The exact criminal provisions depend on the facts of each case.
What If Someone Accesses Your Account Without Permission?
Unauthorised access or misuse of digital credentials can involve additional legal issues beyond cheating.
Depending on the circumstances, conduct involving unauthorised access, identity misuse, fraudulent electronic activity or manipulation of digital information may attract provisions under applicable cyber and criminal laws.
The fact that a transaction occurred through UPI does not prevent the police from investigating the underlying conduct. Investigators may examine transaction records, beneficiary accounts, mobile numbers, device information, communications and other available digital evidence.
Can the Money Be Recovered?
Potentially, yes, but recovery is not guaranteed.
A victim should immediately report the fraudulent transaction to the bank and request that the transaction be investigated and appropriate action taken. Banks have mechanisms for handling unauthorised electronic transactions, and RBI’s customer-protection framework provides liability rules for eligible unauthorised electronic transactions.
Where an unauthorised electronic transaction results from a third-party breach and neither the bank nor the customer is responsible, reporting within three working days can result in zero customer liability under the RBI framework. Delayed reporting can affect the customer’s liability depending on the applicable rules and circumstances.
Recovery ultimately depends on the circumstances, including whether the funds can be traced or frozen and whether the bank determines that the customer qualifies for protection.
What Should You Do Immediately After UPI Fraud?
Speed is extremely important.
The victim should:
- Immediately contact the bank through its official customer-service channel.
- Report the unauthorised UPI transaction and obtain a complaint/reference number.
- Ask the bank to block or restrict further unauthorised transactions where necessary.
- Report the incident through the appropriate cybercrime reporting mechanism.
- Preserve transaction IDs, screenshots, messages, phone numbers and other evidence.
- Change compromised passwords or credentials and follow the bank’s security instructions.
- Monitor the account for additional suspicious transactions.
NPCI also provides a mechanism through which customers can register complaints with the relevant member bank and track complaint status.
Does Sharing the UPI PIN Affect Recovery?
It can.
The circumstances under which the transaction occurred are important when determining customer liability. NPCI expressly advises customers never to share their UPI PIN, and states that bank customer support will not ask for it.
RBI’s framework distinguishes between transactions caused by bank negligence, third-party breaches and customer negligence. Where the customer’s own negligence contributed to the loss, the customer may bear the loss until the transaction is reported to the bank.
Therefore, voluntarily sharing a UPI PIN or other authentication credentials can materially affect the liability assessment.
Can a Fraudster’s Bank Account Be Frozen?
A fraud investigation can involve tracing the account into which the stolen funds were transferred and taking appropriate action through the banking and law-enforcement system.
The victim should provide the transaction ID, beneficiary UPI ID or account details, date, amount and other available information to the bank and investigating authorities. Prompt reporting can be important because funds may be transferred through multiple accounts after the initial fraudulent transaction.
However, freezing or recovering funds is not automatic and depends on the investigation and applicable legal process.
What Evidence Is Useful in a UPI Fraud Case?
Victims should preserve as much evidence as possible, including:
- UPI transaction ID
- Date and amount of the transaction
- UPI ID or beneficiary details
- Bank statement
- SMS and email alerts
- Screenshots
- Phone numbers used by the fraudster
- WhatsApp or other chat records
- Fake links or website addresses
- Call details and other relevant communications
Digital records can help banks and investigating authorities trace the transaction and identify the persons or accounts involved.
Is the Bank Always Responsible for the Fraud?
No.
UPI fraud does not automatically make the bank financially responsible in every case. Liability depends on the circumstances and applicable RBI rules.
For example, RBI’s framework provides zero liability in specified circumstances involving bank negligence or certain third-party breaches reported within the prescribed period. Where the customer has been negligent, the treatment can be different.
Each dispute therefore requires an examination of how the transaction occurred and when it was reported.
Conclusion
UPI fraud is legally actionable in India. Depending on the facts, fraudulent UPI activity can result in criminal investigation for offences such as cheating and may also trigger banking complaints and recovery procedures. The BNS provides a legal framework for dealing with deceptive conduct involving delivery of property, while RBI rules provide customer-protection mechanisms for unauthorised electronic transactions.
The most important step after discovering UPI fraud is immediate reporting. Customers should contact their bank, preserve transaction evidence and report the incident through the appropriate cybercrime and banking channels. NPCI also provides complaint-registration and status-tracking facilities through participating banks.
Ultimately, whether money can be recovered and who bears the loss depends on the nature of the fraud, customer conduct, reporting time, banking investigation and applicable law.
