iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
If you have just spotted an unauthorised UPI or online banking debit, contact your bank immediately through a verified channel, ask it to stop further activity and register your complaint, then call 1930 and file or track a report on the National Cyber Crime Reporting Portal. Act quickly and keep the acknowledgement numbers. Reporting is essential, but it does not guarantee that the money will be recovered.
What to do immediately
- Contact your bank or payment provider now. Use a reporting route you can verify in the bank’s official app or website, or use its phone-banking number or another official channel. Report the transaction as unauthorised, ask the bank to secure affected access or instruments and block further unauthorised activity, and request a complaint acknowledgement or number. RBI’s customer directions require banks to provide 24×7 reporting channels and take immediate steps to prevent further unauthorised transactions after a report. Read the Reserve Bank of India’s customer-liability direction.
- Call 1930 promptly. The National Cyber Crime Reporting Portal directs people to call 1930 for immediate reporting of cyber financial fraud. Follow the current instructions and keep the acknowledgement details. Open the official National Cyber Crime Reporting Portal.
- File or track the online complaint. Use the official portal and provide accurate, complete incident information. The portal says police and law-enforcement agencies handle complaints based on the details supplied; submitting a report does not itself establish that funds can be recovered.
- Preserve evidence. Keep transaction IDs, dates, amounts, relevant account or UPI details, bank messages, screenshots and communications related to the incident. Save the bank’s acknowledgement and the portal or helpline reference details. A government instruction lists key account and transaction details to have available: Citizen Financial Cyber Fraud Reporting and Management System citizen manual.
- Keep a written record of follow-up. Note when and how you contacted the bank, what you reported and the complaint number. If you need to follow up, use documented official channels and retain copies of messages. The available RBI direction requires banks to acknowledge reports, but it does not establish a universal current timeline for each bank’s individual complaint escalation.
Was the debit unauthorised, or were you tricked into approving it?
This distinction matters. An unauthorised transaction is one you did not initiate or approve. A different situation is when a scammer deceives you into approving a UPI request, sharing a one-time credential, or sending a transfer yourself. Report either kind of suspected fraud to your bank and 1930, but do not assume the same reimbursement rule applies to both. RBI’s customer-liability direction addresses unauthorised electronic transactions and sets conditional rules; a payment you authorised under deception may require a fact-specific assessment.
How RBI’s customer-liability rules work
RBI’s direction dated 6 July 2017 sets liability according to the circumstances and how quickly the customer reports an unauthorised electronic transaction after receiving the bank’s communication about it. These rules are not a promise that every fraud report will result in a refund.
| Situation under the 2017 direction | What the direction says |
|---|---|
| Third-party breach; neither the bank nor the customer is at fault; report within three working days of receiving the bank’s transaction communication | Zero customer liability. |
| Same third-party breach; report within four to seven working days of receiving that communication | Limited customer liability applies. |
| Report later than seven working days | Liability is determined under the bank’s board-approved policy. |
| Customer negligence, such as sharing credentials, caused the loss | The customer bears losses up to the time of reporting; losses after reporting are borne by the bank. |
The bank bears the burden of proving customer liability under the direction. Where a customer is entitled to zero or limited liability, the direction specifies a shadow credit within 10 working days. That conditional credit rule should not be read as a guaranteed refund for an authorised payment made after deception. See the RBI direction for its full terms.
#1 Best Overall
Check for changes to RBI rules
The 2017 direction is not necessarily the final word on current policy. On 24 March 2026, the Ministry of Finance reported that RBI had issued revised instructions, including a proposed compensation mechanism for small-value fraudulent electronic transactions, for public consultation on 6 March 2026. That report does not establish whether the revisions were finalized afterward. Before relying on a specific liability or compensation rule, check RBI’s current notices and ask your bank which current instruction it is applying. Read the Ministry of Finance statement dated 24 March 2026.
What 1930 and the cybercrime portal can—and cannot—do
The National Cyber Crime Reporting Portal describes 1930 as the immediate reporting route for cyber financial fraud. Its wording is: “In case of Cyber Financial Fraud, For immediate reporting ,Call 1930 (Earlier 155260).” A prompt report can help the authorities and participating institutions act to stop funds being siphoned, but neither a helpline call nor a portal acknowledgement is a recovery guarantee.
In a parliamentary answer dated 24 March 2026, the Ministry of Home Affairs said the Citizen Financial Cyber Fraud Reporting and Management System was launched in 2021 for immediate reporting and stopping funds from being siphoned, and that a comprehensive standard operating procedure was issued on 2 January 2026. The Ministry reported that more than ₹8,690 crore had been saved in more than 24.65 lakh complaints through 31 January 2026. These are aggregate programme figures, not an estimate of an individual complainant’s chance of recovery. Read the Ministry of Home Affairs’ parliamentary answer dated 24 March 2026.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →If you reported by phone, follow the portal’s current instructions
A government citizen-instruction PDF says that a person reporting by 1930 should complete registration on the portal within 24 hours using the acknowledgement or login details. Because the document’s current nationwide applicability is not established, follow the instructions currently shown by the helpline or portal rather than treating that timing as confirmed current policy. Consult the citizen manual.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Details to have ready when reporting
- Transaction date, time, amount and transaction ID or reference number.
- The affected bank account or UPI details requested by the bank or portal.
- Relevant bank alerts, screenshots, messages and communications with the suspected fraudster.
- The time you first noticed the debit, when you notified the bank, and the complaint acknowledgement numbers.
Give accurate information and keep the original records. Do not delete messages or alter screenshots that may help explain what happened.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
