The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
If money leaves your bank account through a UPI transaction you did not authorise, contact the account-holding bank immediately through its verified app, website, branch or telephone channel. Ask the bank to register an unauthorised-transaction complaint, give you the reference number and block further unauthorised activity. Then report the financial cyber fraud through 1930 or the National Cyber Crime Reporting Portal, use the UPI app’s complaint option where available, and preserve every transaction and communication record. Fast reporting matters because the Reserve Bank of India’s customer-liability rules depend on the facts and the time at which you notify the bank.
This process is for India and applies to UPI users dealing with an unauthorised debit or suspected UPI scam. A payment you approved after being deceived is not automatically treated the same way as a payment you never approved, so describe exactly what happened rather than assuming reimbursement is guaranteed.
What to do in the first hour
- Call or message your bank through an official channel. Use the number printed on the bank’s website, statement, debit-card material or official app—not a number sent by the person who contacted you. State which UPI debit is fraudulent or unauthorised, its date and amount, and that you want a formal complaint registered. Request the complaint or service reference number and ask what protective action the bank can take, including blocking further unauthorised activity.
- Report the cyber fraud. Call 1930 and follow the operator’s instructions, or file through the National Cyber Crime Reporting Portal. Have the transaction ID or UPI reference, date, amount, bank and payment details, your contact information and screenshots ready.
- Open the transaction in your UPI app. Use its grievance, help or report-issue function and retain the app reference. This is an additional record; it does not replace the bank’s fraud complaint.
- Preserve evidence before deleting anything. Save the account statement or transaction screen, UPI ID, transaction ID/RRN, SMS and email alerts, QR codes or links, chat messages, phone numbers, call times and each complaint reference. Keep a dated log of every bank, app and cybercrime follow-up.
Do not share your UPI PIN, one-time password or full banking credentials with anyone claiming to process a refund. NPCI warns that unknown links and QR codes can be used to trick people into entering a UPI PIN, and the PIN authorises bank transactions. Its fraud-awareness guidance explains this risk.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Choose the right reporting route
Each channel has a different job. Using all relevant channels prevents an app ticket or police report from being mistaken for the bank’s formal transaction-dispute process.
#1 Best Overall
| Route | Main purpose | When to use it | Reference or result to keep | What it does not replace |
|---|---|---|---|---|
| Account-holding bank | Investigates the debit, assesses liability, protects the account and processes the bank-side complaint. | Immediately for every debit you say is unauthorised or fraudulent. | Bank complaint or service-request number, written acknowledgement and later decision. | Cybercrime reporting or, where useful, an app grievance. |
| 1930 and National Cyber Crime Reporting Portal | Records a financial cybercrime incident for law-enforcement and financial-fraud coordination. | As soon as the bank report is made; use both if the reporting channel directs you to do so. | Helpline or portal acknowledgement, complaint number and uploaded evidence. | The bank’s account-dispute investigation. |
| UPI application | Raises a transaction grievance or checks status inside a participating app. | After opening the transaction, especially when the app supplies a report-issue option. | In-app ticket or transaction-status reference. | The bank-first report for an alleged unauthorised debit. |
| RBI CMS/Ombudsman | Reviews an eligible complaint about a regulated entity’s service after its internal grievance process. | When the bank has not replied within the applicable period or you are dissatisfied with its reply. | CMS filing acknowledgement and Ombudsman case details. | Immediate fraud containment or a substitute for first reporting to the bank. |
NPCI’s Register a Complaint page directs fraud, unidentified and unauthorised-transaction complaints to the customer’s bank. NPCI’s UPI FAQ describes app grievance and transaction-status options. The cybercrime portal and RBI Ombudsman routes serve different purposes and should be treated as escalation or incident-reporting channels, not interchangeable dispute forms.
How to raise the dispute with your bank
1. Verify that you are speaking to the real bank
Start from a source you already trust: the bank’s official website, its app, a branch or the contact details printed on your statement or card. Banks may ask you to authenticate yourself, but a genuine support process should not require you to disclose your UPI PIN or approve an unexpected collect request. If a caller supplied the contact number, end the call and redial using an official source.
2. Describe the transaction precisely
Tell the bank the account or UPI-linked instrument affected, transaction date and amount, the UPI app used, the payee or UPI ID shown, and the transaction ID, RRN or UPI reference. Say clearly whether you did not initiate or approve the debit. If you were persuaded to approve a payment, explain the deception, the messages or call involved and what you actually authorised. Accurate wording helps the bank classify the event under the applicable customer-protection rules.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitches3. Ask for a formal complaint and a reference number
Do not settle for an informal promise that someone will “check.” Ask the representative to register an unauthorised or fraudulent electronic-transaction complaint and provide the complaint number, date and expected next step. If you submit a form or email through the bank’s official process, save the submission confirmation and a copy of what you sent.
4. Request immediate account protection
Ask what can be blocked or secured while the investigation runs, such as further UPI debits or other channels connected to the affected account. Follow the bank’s verified instructions for changing credentials or disabling a payment feature. Note the time the protective request was made and any confirmation number.
5. Send only the evidence the bank requests through its official channel
Attach the transaction screen, statement entry, alert messages and relevant conversation or call details when the bank asks for them. The official materials do not establish one universal bank form or document list, so follow your bank’s current instructions rather than relying on a generic checklist. Never email your UPI PIN, full password or an unredacted credential.
Report the financial cyber fraud through 1930 or the portal
The bank report protects your account and starts the bank’s transaction investigation. A separate report through 1930 or the National Cyber Crime Reporting Portal creates a financial-cybercrime record and supplies information that authorities and participating institutions may use to trace the funds.
Information to prepare
- Your name and contact details and the bank or payment account information requested by the reporting channel.
- Transaction date, amount, UPI transaction ID/RRN or other reference, payer and payee details and the bank or payment service involved.
- A short chronological description: how you noticed the debit, whether you entered a PIN or approved a request, and what the suspected fraudster said or sent.
- Screenshots or other images of the transaction, SMS, email, chat, phone number, QR code or link. Keep the original files and do not edit them in a way that removes dates or identifiers.
- The bank complaint number and any UPI-app reference, if already issued.
The portal’s published instructions are titled Citizen Financial Cyber Frauds Reporting and Management System (For Delhi Only). They describe the requested transaction and account details, the evidence upload and the reporting channels. A 24-hour portal-registration follow-up mentioned in those instructions is specific to the Delhi process described there; it is not a nationwide deadline. After calling 1930, follow the instructions given by the operator or your local police and complete any requested portal or station follow-up within the period they specify.
Use the UPI app without losing the bank complaint
Open the payment’s details page and look for labels such as Help, Raise a complaint, Report an issue or Transaction status. Participating banks’ UPI apps can provide grievance and status functions, according to NPCI’s FAQ. Select the closest factual category, enter the same transaction ID and explanation supplied to the bank, submit it and save the ticket number.
BHIM’s information page describes a report-issue route in transaction history for declined transactions; see NPCI’s BHIM UPI App page. A declined transaction that nevertheless appears as a debit should be reported to the bank with both the debit entry and the app’s status. For a suspected unauthorised debit, an in-app ticket supplements the bank report—it does not substitute for it.
Build an evidence file that can be followed
Create one folder, digital or printed, and give each item a clear date and description. A chronological file reduces delays when a bank agent, cybercrime investigator or Ombudsman asks what happened.
Recommended Free Tools
- Transaction proof: statement or ledger entry, app detail page, date, amount, UPI ID, transaction ID/RRN and status.
- Alerts: original SMS, email and push notifications showing when the bank communicated the transaction.
- Social-engineering evidence: screenshots of chats, emails, websites, QR codes, links, caller numbers and the exact instructions you received.
- Identity and account details: supply only what the bank or portal requests through its verified process; redact unrelated balances or personal information when appropriate.
- Case trail: bank, app, 1930 and portal references; dates and times of calls; names or agent IDs when provided; promised response dates; and every subsequent reply.
Keep the files in their original format and maintain a backup that is not dependent on the potentially compromised device. Do not delete the suspicious message or link until the bank or investigators confirm it is no longer needed, but do not open a dangerous link again.
Understand RBI customer-liability rules before expecting reimbursement
The Reserve Bank of India’s framework on limiting customer liability in unauthorised electronic banking transactions is conditional. Whether you receive a credit, how much you may bear and which deadlines apply depend on the transaction classification, the security failure, your conduct and the time you notified the bank.
Unauthorised transaction versus a payment you were tricked into approving
If you never initiated or approved the debit, state that plainly and ask the bank to assess it as an unauthorised electronic transaction. If a fraudster persuaded you to enter the PIN, scan a QR code or approve a collect request, explain those facts instead of describing the payment as something that happened with no action from you. The sources establish protections for unauthorised electronic transactions, but they do not promise reimbursement for every scam or every authorised payment made after deception.
The three-working-day rule is conditional
RBI’s notification provides zero liability in specified third-party-breach situations when the customer informs the bank within three working days of receiving the bank’s transaction communication. That is not a universal three-day deadline for every UPI dispute. The bank must determine whether the facts fit the relevant category and whether another part of the framework applies.
What happens if credentials were shared
The framework says a customer can bear losses until reporting where the customer shared payment credentials. This makes immediate notification especially important, but it does not eliminate the need for an honest factual account. Tell the bank what information was entered or disclosed, when it happened and how the fraudster obtained it; request a written liability assessment under the current RBI rules.
Why a pending or completed UPI payment usually cannot simply be cancelled
NPCI’s UPI FAQ states: No, once the payment is initiated, it cannot be stopped.
That sentence describes the payment rail’s cancellation limitation; it does not prevent the bank from opening a fraud investigation, seeking a hold or recovery where possible, or assessing customer protection. Report immediately even when the app shows “successful,” because the bank and cybercrime channels need the transaction identifiers while records and funds can still be traced.
Escalate an unresolved bank complaint
First complete the bank’s internal complaint process and keep its final response, or proof that no response arrived. If the regulated entity has not replied within 30 days (or an applicable longer period), or you are dissatisfied with its response, the RBI Ombudsman FAQ says you may be able to approach the Ombudsman, subject to the scheme’s eligibility rules.
File through RBI CMS
Use the RBI’s complaint-management route described in its Ombudsman complaints FAQ. Include the bank complaint number, your original representation, transaction evidence, the bank’s reply or proof of non-response and the remedy you seek. The Ombudsman route addresses the regulated entity’s service or grievance handling; it is not a replacement for calling 1930 or reporting a crime.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallObserve the general filing windows
The FAQ gives a general limit of one year after the entity’s reply. Where there is no reply, it describes one year and 30 days from the date of your representation to the entity. These are general scheme periods, not permission to delay: check the current eligibility, exclusions and any applicable longer period before filing.
Common situations and the correct response
“I do not recognise the debit at all”
Mark it as unauthorised with the bank immediately, provide the exact transaction reference and alert time, and ask for protective blocking. Report it through 1930 or the portal, then submit the app ticket and preserve all references.
“I approved it after a caller promised a refund”
Do not conceal the approval. Tell the bank the precise story, including the call, link, QR code, PIN entry or collect request. Ask the bank to assess liability under the current rules and still make the cybercrime report.
“The app says declined, but my account was debited”
Save both screens, use the app’s report-issue function if available and give the bank the debit entry, transaction ID and decline status. Ask the bank to trace the transaction and provide a written outcome.
“The bank has not replied”
Send a dated follow-up through the bank’s official grievance channel, retain proof of delivery and wait only for the applicable internal-response period. If the no-reply threshold is met, review RBI CMS/Ombudsman eligibility and file with the complete case trail.
Quick Recap
Protect yourself after reporting
- Never disclose the UPI PIN; it authorises bank transactions and is not needed to receive money.
- Do not approve an unexpected collect request or scan a QR code presented as a way to receive a refund. Stop and verify independently.
- Do not click an unknown link sent by a supposed bank agent, courier, employer or buyer.
- Keep bank alerts enabled so you see the transaction communication that may start a liability-reporting period.
- Continue monitoring statements and UPI activity and add each new unauthorised debit to the bank and cybercrime case references.
A printable action checklist
- Record the date, amount, UPI ID and transaction ID/RRN.
- Contact the account-holding bank through an official channel.
- State whether you authorised the payment and explain any deception accurately.
- Obtain the bank complaint number and request account protection.
- Call 1930 or use the National Cyber Crime Reporting Portal as instructed.
- Submit the UPI-app grievance and save its reference.
- Preserve statements, alerts, screenshots, messages and a dated follow-up log.
- Ask the bank for its liability assessment and written resolution.
- If the bank’s response is absent or unsatisfactory, check RBI Ombudsman eligibility, deadlines and CMS filing requirements.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
