Lost Money to UPI or Online Fraud? What to Do Right Now -

Quick answer: If you’ve lost money to a UPI, card or online banking scam in India, call the cybercrime helpline 1930 immediately, then report it to your bank and file a complaint at cybercrime.gov.in. Speed matters twice over: police can freeze stolen money before it’s withdrawn, and under RBI rules, reporting a fraud you didn’t cause within three working days means you shouldn’t bear the loss.

It’s natural to feel embarrassed or to wait and hope the money comes back. Don’t. Every hour you wait gives the criminals time to move the money through more accounts, and it can reduce what your bank is obliged to refund.

This guide covers what to do in the first hour, the first day and the weeks after, along with your rights under RBI rules. It’s up to date as of October 2026, including changes coming in January 2027.

Step 1: Call 1930 straight away

1930 is the national cybercrime helpline run under the Ministry of Home Affairs’ Indian Cyber Crime Coordination Centre (I4C). When you report a financial fraud, details go into a system that connects police with banks and payment companies so that the money trail can be blocked.

It works when people are quick. The government told Parliament on 12 August 2026 that more than Rs 11,158 crore had been saved across 3.28 million complaints up to 30 June 2026, according to Outlook Money.

Before you call, keep these ready if you can:

Your bank name and account number, or the card or UPI app used.
The transaction IDs or UTR numbers, amounts and times (they’re in your bank SMS or UPI app history).
The scammer’s phone number, UPI ID, website or social media profile.
Screenshots of chats, messages or payment screens.

Don’t let missing details stop you calling. You can add them later.

Step 2: Tell your bank and block your cards and UPI

Call your bank’s official helpline, using the number on the back of your card, in your banking app or on the bank’s website. Never use a number from a search result or a message, because fake “customer care” numbers are a common trap. Ask the bank to:

Block your debit or credit card, net banking and UPI if they may be compromised.
Register a complaint about the unauthorised transaction, and give you a complaint reference number.
Confirm the date and time of your complaint in writing (an SMS or email acknowledgement counts).

That timestamp matters, because your liability under RBI rules depends on how quickly you reported the fraud to the bank.

Step 3: File a complaint at cybercrime.gov.in

If you called 1930, you may be asked to complete the complaint online. If you couldn’t get through, file it yourself. The steps, as described by Outlook Money, are:

Go to cybercrime.gov.in and click Register a Complaint.
Choose Financial Fraud.
Log in with your state, email and mobile number, and verify with the OTP.
Pick the category and fill in the details of the incident, the suspect and yourself.
Click Preview & Submit, then confirm.
Save the complaint ID you receive by email or SMS, and download the PDF copy.

Share this complaint ID with your bank. If a large amount is involved, you may also need to file an FIR at your local police station; the cybercrime cell will guide you.

Step 4: Secure your accounts so it doesn’t happen twice

Scammers often come back for more. Once the urgent calls are done:

Change your net banking password, UPI PIN and email password from a device you trust.
If you installed any app on the scammer’s instructions, such as a screen-sharing or “support” app, uninstall it. If you’re unsure what’s on your phone, back up your photos and reset it.
Check that your SIM still works. If your phone suddenly loses signal, contact your operator in case of a SIM swap.
Turn on two-step verification on WhatsApp and email, and consider passkeys; see our guide on how to set up passkeys.

Will the bank refund your money? Your rights under RBI rules

The RBI’s customer liability rules from July 2017 still apply as of October 2026. In short:

Situation	Your liability
Fraud caused by the bank’s own lapse	Zero, whenever you report it
Third-party breach (not your fault, not the bank’s), reported within 3 working days	Zero
Third-party breach reported in 4 to 7 working days	Capped per transaction: Rs 5,000 for basic savings (BSBD) accounts, Rs 10,000 for other savings accounts and credit cards up to a Rs 5 lakh limit, Rs 25,000 for higher-limit cards and larger current accounts
You shared your OTP, PIN or password	You bear the loss until you report it; the bank bears losses after that

Once you report a fraud, the bank is supposed to credit the disputed amount to your account, as a “shadow reversal”, within 10 working days, and resolve the complaint within 90 days.

The honest catch: many UPI scams involve the victim approving a payment or sharing an OTP, which counts as customer negligence. Report anyway. The money may still be traced and frozen through 1930, and the rules are changing.

What changes from 1 January 2027

In June 2026, the RBI issued revised rules that take effect on 1 January 2027, as reported by MediaNama and Inc42. The main changes:

Five calendar days to report. Zero liability for third-party breaches applies if you report within five calendar days, through your bank, 1930 or the cybercrime portal.
Compensation even if you were tricked. For losses up to Rs 50,000 involving customer negligence, victims can get 85% of the net loss or Rs 25,000, whichever is lower. It’s a once-in-a-lifetime benefit, available for one year from the rules’ start.
SMS alerts become mandatory and free for transactions above Rs 500.

If the bank doesn’t help: escalate to the RBI Ombudsman

If your bank rejects your complaint or doesn’t reply within 30 days, you can complain to the RBI Ombudsman for free at cms.rbi.org.in or call the RBI helpline 14448. The updated Integrated Ombudsman Scheme took effect on 1 July 2026, according to the scheme summary banks have published.

One more warning: after a fraud, you may get calls from “recovery agents” or “cyber lawyers” who promise to get your money back for a fee. These are often the same scammers again. Genuine police and banks don’t charge you to process a complaint. For more help with scams, see our Cybersecurity and Privacy section.

Frequently asked questions

How long do I have to report UPI fraud?

Report immediately. Under current RBI rules, you get zero liability for a third-party breach if you tell your bank within three working days. From 1 January 2027, that window becomes five calendar days.

Can I get money back if I shared my OTP?

Under the current rules, you bear the loss until you report it. You should still call 1930, because the money may be frozen in the receiving account. From January 2027, a one-time compensation of up to Rs 25,000 applies for losses up to Rs 50,000, even where the customer was negligent.

Is 1930 available 24 hours?

The helpline is meant for immediate reporting of financial cyber fraud. If you can’t get through, file the complaint at cybercrime.gov.in, which is available at any time, and keep trying the phone line.

Do I need to go to the police station?

Not always. The online complaint is often enough to start the process, but for larger amounts police may ask you to file an FIR. Your complaint ID helps the station find your case.

Lost Money to UPI or Online Fraud? What to Do Right Now