Lost money in a UPI fraud? What to do in the first hour, and how to complain on 1930

AI-generated editorial illustration by CyberShitty. Not a photograph or a document from the organisations named.

Speed decides whether scammed money can be frozen. Call 1930, report on cybercrime.gov.in, alert your bank within RBI's reporting windows, block your UPI and cards, and get an FIR on record.

01 / The first hour: why speed matters

If money has left your account in a UPI scam, what you do in the next hour matters most. Fraudsters move stolen money onward quickly, and the sooner the banks involved hear about it, the better the chance of stopping it. The government says the 1930 cybercrime helpline helps victims of online financial fraud by speeding up reporting and, where possible, freezing fraudulent transactions. The Home Ministry says that by 30 June 2026 its Citizen Financial Cyber Fraud Reporting and Management System had saved more than ₹11,158 crore across 32.80 lakh complaints (Lok Sabha, July 2026).

• Now: call 1930.
• Straight after: call your bank's official helpline to block the account, card and UPI.
• Same day: complete or check your complaint on cybercrime.gov.in and keep the acknowledgement number.

02 / Calling 1930 and filing on cybercrime.gov.in

1930 is the national cybercrime helpline. The online equivalent is the National Cyber Crime Reporting Portal, cybercrime.gov.in, which has a separate Financial Fraud category. The government says complaints made there are turned into FIRs and followed up by the police in your state or union territory.

Have these details in front of you before you call or file:

• Your bank, your account number or UPI ID, and the phone number linked to it.
• For each debit: date, time, amount and the transaction ID or UTR from your UPI app or bank SMS.
• The UPI ID, account or QR code the money went to.
• The scammer's phone numbers, links, app names and profile names.

The portal's FAQ lists the evidence that helps: bank statements, receipts for online transfers, emails, website addresses, chat transcripts, screenshots of the suspect's number, and images or videos. Take screenshots before anything disappears, and do not delete chats or call logs.

03 / Tell your bank, and know RBI's liability rules

Report the fraud to your bank directly as well, and do it in writing (the app, email or a branch letter) so you have a timestamp. Customer liability is set by RBI's circular of 6 July 2017, "Customer Protection – Limiting Liability of Customers in Unauthorised Electronic Banking Transactions" (RBI/2017-18/15). It requires banks to offer 24x7 reporting channels and to reply straight away with a complaint number.

• Zero liability if the bank was at fault. You also owe nothing if the breach was a third party's, with no fault by you or the bank, and you report within three working days of the bank telling you about the transaction.
• Four to seven working days: your liability is capped at ₹5,000, ₹10,000 or ₹25,000, depending on the type of account or card.
• More than seven working days: your liability depends on the bank's board-approved policy.
• If you were negligent, for example by sharing your payment credentials, you bear the whole loss until you report it. Any loss after you report falls on the bank.

Working days are counted by your home branch's schedule, not counting the day you received the communication. The bank must credit the disputed amount to your account within 10 working days of your report, and resolve the complaint within 90 days. The bank has to prove you were liable; you do not have to prove you weren't.

Changes on the way. On 24 June 2026 RBI issued amended directions that apply to transactions made on or after 1 January 2027. They extend protection to more kinds of fraudulent electronic transactions, shorten complaint timelines and add compensation for small-value frauds.

04 / Block UPI and cards, clean up and file an FIR

• Find your bank's helpline on its official website, app or the back of your card. RBI warns that fake bank helpline numbers turn up in search results and on social media.
• Ask the bank to block your debit card, net banking and UPI, and to raise a fraud dispute for each transaction.
• If you installed an app at a caller's request, uninstall it. RBI warns that such apps can give fraudsters access to all your data. Change your UPI PIN and banking passwords from a different, trusted device.
• FIR: I4C's e-Zero FIR started as a Delhi pilot in May 2025, for losses above ₹10 lakh. On 28 July 2026 the Home Ministry told the Lok Sabha that it had been rolled out in 18 States and UTs: a complaint to 1930 or on cybercrime.gov.in with a loss above a threshold set by each State or UT is registered automatically as an e-Zero FIR, and you then have three days to visit the police station and convert it into a regular FIR. Below the threshold, or in a State or UT not on the list, take your acknowledgement number to your local cyber cell or police station. If the police will not register it, see what to do when the police won't register your FIR, which lists the 18 States and UTs.

05 / Common UPI scams to recognise

One rule catches most of them. RBI says that receiving money never requires you to scan a QR code or enter your PIN.

• Collect requests: a so-called refund, prize or buyer payment arrives as a request. Entering your UPI PIN approves money going out.
• QR codes: you are sent a code and told to scan it to receive money. Scanning and entering your PIN pays the scammer.
• Screen-sharing apps: a fake support agent asks you to install an app so they can help, then watches your OTPs and PIN.
• Fake customer care: you search for a helpline, call a number planted by fraudsters, and are talked into paying or installing an app.

Never share your UPI PIN or OTP with anyone, whoever they say they are. If a message about a new 'UPI fee' asks you to pay, register or enter your PIN, first read what the delayed UPI merchant charge (MDR) means for you.

06 / Your checklist

• Call 1930 right away.
• Block your card, UPI and net banking through the bank's official channel.
• Report in writing to your bank within three working days.
• File under Financial Fraud on cybercrime.gov.in and save the acknowledgement number.
• Keep transaction IDs, screenshots and chats.
• Uninstall any remote-access app and change your PIN and passwords.
• Get an FIR or e-FIR on record.
• If the bank does not resolve your complaint, escalate it to the RBI Ombudsman at cms.rbi.org.in. A new RBI Ombudsman scheme replaced the 2021 Integrated Ombudsman Scheme from 1 July 2026 and shortened the time limit for filing, so act quickly — see our money recovery guide for the current rules.

Update, 2 October 2026: the FIR point in section 04 now follows the Home Ministry's Lok Sabha answer of 28 July 2026: e-Zero FIR runs in 18 States and UTs. It previously described the Delhi pilot and cyber-fraud e-FIRs in six States and UTs.