UPI Fraud: How to Report It, and What Your Bank Owes You

Money leaves your account through UPI. You spot it twenty minutes later. What you get back depends on something you would have no reason to check: the date on the transaction.

Until 31 December 2026, one set of Reserve Bank rules decides that. From 1 January 2027, a different set does. The new rules were signed on 24 June 2026. They are not a tidy-up. They change what counts as fraud, how long you have to report it, who has to prove what, and for the first time they put money on the table for people who were tricked into paying.

Seven sets of rules, signed on one day

The Reserve Bank did not issue this to one kind of bank. On 24 June 2026 it issued seven matched sets of amendment directions, numbered RBI/2026-27/167 through 173. They cover commercial banks, small finance banks, payments banks, local area banks, regional rural banks, urban co-operative banks and rural co-operative banks.

That list matters because the usual next question is whether it applies to your bank. It does. A customer of a district co-operative bank gets the same framework as a customer of the State Bank of India. The wording differs only in which parent directions each one amends.

The commercial banks version deletes paragraphs 64 to 76 of the 2025 directions and replaces them with a new section running from 76A to 76V. Everything below comes from that text.

What changes on 1 January 2027

Why “fraudulent” is a wider word than “unauthorised”

The old rules turned on whether a transaction was authorised. If you keyed in the PIN, you authorised it, and the protection largely fell away. That left out most of what actually happens to people.

The new definition at paragraph 4(15A) has three limbs. A fraudulent transaction is one carried out by a third party using credentials obtained from you by fraud. Or one carried out by you after granting approval under coercion or duress from a third party. Or an unauthorised transaction in the old sense.

The middle limb is the change. It covers a payment you made with your own thumb, because somebody on a call had frightened you into making it. Scams are built to manufacture exactly that moment, and we have set out the six stages they move through to get there. Until now, reaching that moment usually meant you had no claim.

The clock, from the moment the money moves

Is five calendar days better than three working days?

It reads like a longer window. Often it is not. Calendar days run through weekends and holidays; working days do not.

Take a fraud on Friday 8 January 2027. Five calendar days takes you to Wednesday 13 January. Under the old rule, three working days would have been Monday, Tuesday and Wednesday, so you would have landed on Wednesday 13 January as well. No difference.

Now put a bank holiday on that Monday. The old rule would have given you Tuesday, Wednesday and Thursday, taking you to the 14th. The new rule still stops on the 13th. You lose a day, and the day you lose is the one a holiday was most likely to have cost you anyway. This is an illustration rather than a prediction, and bank holiday calendars differ from state to state.

The practical reading is simple. Treat five calendar days as five days, not as a working week, and do not let a long weekend run out the clock.

Your bank has to prove you were careless

Paragraph 76K is one sentence long and does a lot of work. The burden of proving customer liability in a fraudulent transaction complaint lies on the bank.

That reverses the position most people find themselves in. You are not required to show you were careful. The bank is required to show you were not, and to classify your complaint under one of the defined categories before it can push any loss onto you.

What counts as your carelessness is now written down, at paragraph 4(20C). Failing to take reasonable care of a PIN, password or OTP, which expressly includes handing credentials to another person “whether intentionally or otherwise”. Not telling the bank promptly. Downloading a malicious app. Not updating your registered mobile number or email when it changes.

And one that is new, and cuts the other way: not paying attention to specific, directed and clear warnings from the bank that a transaction you are about to make is likely a scam. If your bank throws up a sharp, targeted warning and you tap through it, that is now listed as your negligence. Generic safety messaging should not qualify. The word in the text is “directed”.

The bank’s own negligence is defined too, at 4(20B): not running the required security systems, not sending the mandatory alerts, not keeping 24x7 reporting channels open, not acting diligently once you notify it, and any system malfunction, security breach or internal fraud. Where the fraud traces to any of those, you bear nothing, and paragraph 76L says that holds whether or not you reported it.

The ₹25,000, and where the money comes from

This is the genuinely new part. Until now, a customer whose own carelessness let the fraud through had no route to compensation. Paragraph 76T creates one.

If you are an individual, including a sole proprietor, and the gross loss was up to ₹50,000, you can be paid 85 per cent of your net loss or ₹25,000, whichever is less. Net loss means what is left after any recovery. It is available once in your lifetime.

Two conditions attach. The loss has to be established as genuine under the bank’s own process. And you must have reported the fraud on the cyber crime portal or the 1930 helpline and to the bank, both within five calendar days. That is a stricter test than the zero-liability route at 76M, which only asks that you told the bank. Many people will do the first and forget the second.

The ₹29,412 figure that appears in the funding rules is not arbitrary. It is the loss at which 85 per cent comes to exactly ₹25,000. Below it you get the percentage; above it you get the flat cap.

Who pays is the surprising part. For a domestic fraud below that threshold, the Reserve Bank bears 65 per cent of the compensation, your own bank 10 per cent, and the bank that first received the stolen money another 10. Above the threshold the split is fixed in rupees: ₹19,118 from the Reserve Bank, ₹2,941 each from your bank and the receiving bank. Banks pay you first, within five calendar days of your application, and reclaim quarterly.

They reclaim it through the Depositor Education and Awareness Fund machinery. The claim form asks each bank for its DEA Fund code and footnotes the 2014 scheme, and the claims go to a DEA Fund mailbox at the Reserve Bank. The DEA Fund is where deposits nobody has touched for ten years end up, and we have written about how to trace and claim money sitting in it. The notification does not say more than that about the source, and neither will we.

One limit is easy to miss and changes how you should think about all of this. Paragraph 76U says the compensation is payable for losses on frauds occurring up to one year from the effective date. The scheme therefore covers frauds in the 2027 calendar year and then stops. The claim form carries the same signal: the only quarters printed on it are March, June, September and December 2027.

What the bank owes you, and by when

Where you are entitled to a reversal, paragraph 76R says it must be value dated to the day the fraud happened. You should not lose interest, and no charge should stick to you because the money was briefly gone. On a credit card, the bank has to put a provisional credit on the account within five calendar days of your notice, before it has finished investigating.

The outer deadline for the whole complaint is 45 calendar days, or 60 where the transaction crossed a border. If the bank rejects your complaint, paragraph 76S requires it to tell you why, with whatever supporting detail it has. A one-line refusal does not meet that.

For a fraud happening before 1 January 2027, the older framework still governs: the three-working-day window, the liability caps that vary by account type, and a ten-working-day provisional credit. Those tables are set out in full in our guide on what to do when a bank account is frozen over someone else’s fraud, which covers the victim’s side of the same circular.

If the bank says no, you have 90 days

The escalation route is the Reserve Bank’s own ombudsman. The scheme that governs it was reissued with effect from 1 July 2026, and it is not the 2021 scheme most articles describe.

You have to complain to the bank first, in writing or by some route you can prove. Then you wait. The scheme says 30 days, or whatever longer period the Reserve Bank, NPCI or the card network specifies. From 1 January 2027 the Reserve Bank specifies 45 days for a fraud complaint, so 45 is the number that applies to this. You do not have to wait at all if the bank has already replied and you are not satisfied with it.

Then the part that catches people. Your complaint has to reach the ombudsman within 90 days of that period running out, or of the bank’s last communication, whichever is later. The scheme it replaced allowed a year. Guidance written against the old scheme is still everywhere, and following it will cost you the complaint.

Filing is free and online at cms.rbi.org.in. Two details are worth knowing before you start. The complaint has to be addressed to the ombudsman directly; copying the Reserve Bank into an email to your bank does not count. And you cannot file through an advocate, unless the advocate is the person who lost the money.

There is no ceiling on the disputed amount an ombudsman can consider. Beyond returning what you lost, the ombudsman can award up to ₹30 lakh for consequential loss, and up to ₹3 lakh for your time, your expenses and the harassment involved. Both figures went up when the scheme was reissued.

If you win, read the award the day it arrives. It lapses and has no effect unless you send the bank a letter accepting it in full and final settlement, within 30 days of receiving it. The bank then has 30 days to pay or appeal. An award you were pleased with and left on the table is simply gone.

Four things people get wrong

The habit worth building now

Almost everything above turns on one fact: when you reported it. The window for zero liability turns on it. The compensation payment turns on it. The ombudsman clock is measured from it.

So when you report a fraud, the thing to hold on to is not the phone call. It is the acknowledgement the bank is now required to send you, carrying a complaint number and the date and time it was received. Screenshot it. Keep the 1930 or portal reference beside it. If the bank later argues you were careless, which is the only argument left open to it, those two references are what fix the date it has to argue against.