UPI fraud: what to do in the first hour (India)
Last updated: 2026-07-11
Just lost money to a UPI or payment scam? Act now — call 1930, tell your bank, and report online:
- Call 1930 AND tell your bank — do both as fast as you can. Call 1930, the national cyber-crime helpline, to report the transaction, and tell your bank to flag it as unauthorised and block further debits. If you can only do one at a time, call 1930 first — it fans the transaction details out to every bank in the chain so the money trail can be held. Do this alongside telling your bank, not instead of it. Before you open your bank app, read the warning just below — if the scammer had you install an app, share your screen, or read out an OTP, reach your bank from a different phone instead.
- Report online at cybercrime.gov.in — this creates an official record and can help stop the money trail.
First, if your phone may be compromised: if a scammer had you install an app they sent, share your screen (AnyDesk or any remote-access app), or read out an OTP, do not open your bank app on that phone — call your bank from another phone or device. Opening the app on a phone the scammer can see hands them a live, logged-in session. If your number suddenly has no signal and you have stopped getting OTPs, your SIM may have been swapped — see SIM swap fraud: signs and what to do, and reclaim your number first.
This applies to any bank transfer, not only UPI — the same first-hour steps apply to a large NEFT / IMPS / RTGS transfer.
Speed matters for two reasons. First, the reporting system behind 1930 and cybercrime.gov.in — run by the national cyber-crime coordination body under the Ministry of Home Affairs — passes the transaction details to the banks and payment systems involved, so the money trail can be followed and there is a chance the funds are held before the fraudster withdraws them. This often fails once the money has been moved on, which is exactly why speed helps. Second, the Reserve Bank of India's framework on limiting a customer's liability in unauthorised electronic transactions is time-tiered — reporting promptly, in writing, can keep more of the loss off you; the exact time limits are set by the RBI and are on the linked source. That is the real reason to act in the first hour. Recovery, and a limited or zero-liability outcome, are possible but never guaranteed.
The first hour, step by step
| When | Do this |
|---|---|
| First — in parallel | Call 1930 and tell your bank at the same time. If you can only do one at a time, call 1930 first (it holds the money trail across banks), then tell your bank. Have the transaction ID / UTR, the amount and the time ready — do not delete the fraud SMS or bank alert, and do not uninstall the app: that is where those details live, and both 1930 and your bank ask for them. Note the reference number 1930 gives you. Ask the bank to flag the debit as unauthorised and block further debits — if your phone may be compromised (see the warning above), do this from another phone, not by opening the app on the affected one. |
| Next | File a complaint on cybercrime.gov.in. Save the acknowledgement number and any screenshots. |
| Then | Change your UPI PIN and account passwords; check for any other unauthorised debits; keep all reference numbers together. Do this from a different, trusted device — never from a phone that may be compromised. If your number was SIM-swapped (no signal, no OTPs), reclaim your number first: changing PINs before then can send the reset OTP to the fraudster. See SIM swap fraud. |
Beware a second scam: the only ways to report are 1930, cybercrime.gov.in, and your own bank. Anyone who phones or messages offering to recover your lost money for a fee — a "recovery agent", "refund officer", or fake "cyber cell" — is a fresh fraud. Never pay to get your money back.
Narrow it to your situation
Three questions. Everything happens on this phone — nothing is saved, and nothing is sent to us or anyone else. The steps above apply to everyone; these are the parts that change.
Answer a question above and the parts that apply to you appear here.
If the scammer was inside your phone. Treat that phone as unsafe until it is cleaned. Do not open your bank app on it — every step above (reaching the bank, changing your PIN) should happen from another phone or device. The full warning is at the top of this page. How the scam itself works: screen-sharing app scam (AnyDesk, TeamViewer).
If your number has gone dead. No signal and no OTPs is the tell-tale sign of a SIM swap. Reclaim your number from your mobile operator first — changing PINs or passwords before then can send the reset code to the fraudster. See SIM swap fraud: signs and what to do, then how to secure your accounts after a SIM swap.
If nothing was installed and nothing shared. Your phone is not the problem — carry on with the steps above from it. Keep the fraud SMS and the bank alert: that is where your transaction ID is.
If the money was taken. This is fraud, and the first-hour steps above are the right path — 1930, your bank, then cybercrime.gov.in. What happens once you call: the 1930 helpline, and what it can and cannot do.
If you sent it yourself, to the wrong person. A payment you approved yourself is a mistake, not fraud, and it runs on a different route: your UPI app and your bank or payment provider, not the 1930 fraud path. It is also harder to reverse — the money is already in someone else's account, so getting it back depends on that person agreeing or the bank helping you ask. See sent money to the wrong UPI ID? If you were tricked into sending it, it is fraud after all — stay on this page.
If you haven't told the bank yet. Do it now, and get it in writing — a phone call on its own leaves no record you can point to later. Ask for a complaint reference number and keep it with your 1930 reference. See how to file a bank dispute for an unauthorised transaction.
If you've told them and you're waiting. Keep the complaint reference and the date you reported. Whether the loss ends up staying with you turns on two separate things: who was at fault, and how quickly you told the bank. Sharing an OTP or PIN, or approving the payment yourself, is treated very differently from a third party acting without you. See when the bank bears the loss, and when it does not.
If the bank has refused, or gone quiet. You are past the first hour and into escalation — the RBI Ombudsman, the National Consumer Helpline (1915), and e-Daakhil. That ladder is set out further down this page.
Free action card — no sign-up
Open / print the one-page UPI Fraud Action Card
It's free, asks for nothing, and is easy to keep on your phone or share with family.
What to do if the bank doesn't help
Keep every complaint acknowledgement number. If your bank does not resolve the matter within a reasonable time, you can escalate to the RBI Ombudsman (cms.rbi.org.in). You can also seek redress through the consumer grievance system via the National Consumer Helpline (1915) and file a case online through e-Daakhil. All of these are linked below so you can act directly.
Was this helpful? (anonymous — no sign-up, nothing stored about you)
Official sources (verify everything here — and you can act directly through them)
- 1930 — National Cyber Crime Helpline (call to report fraud)
- cybercrime.gov.in — National Cyber Crime Reporting Portal
- Reserve Bank of India — "Limiting Liability of Customers in Unauthorised Electronic Banking Transactions" (time-tiered liability framework)
- RBI Integrated Ombudsman Scheme (cms.rbi.org.in)
- National Consumer Helpline (1915)
- e-Daakhil — online consumer complaint filing