GetNyay
🔐
23 items total15 required

UPI / Online Fraud Evidence Checklist

Complete evidence list for UPI fraud, online scam, phishing, and cybercrime complaints

UPI fraud, online scams, phishing, and cyber fraud complaints require specific digital and financial evidence to be admissible before the Cyber Crime Cell, RBI Ombudsman, and the National Cyber Crime Reporting Portal (cybercrime.gov.in). Time is critical — most successful reversals happen within 24–72 hours of the fraud. This checklist helps you gather everything needed to file a complete complaint immediately.

Quick answer

If money has been taken by a UPI or online fraud, call 1930 and register at cybercrime.gov.in immediately — in the first hours the helpline can ask the beneficiary bank to place a lien on the destination account, which is the only realistic chance of stopping the money moving on. Then report to your bank in writing. Under the RBI framework on limiting customer liability, a third-party breach reported within three working days of the bank's alert carries zero customer liability, and the bank must shadow-credit the disputed amount within 10 working days of your notification.

Key takeaways

  • Speed decides recovery. The 1930 helpline can lien the beneficiary account only while the money is still there.
  • Zero liability applies where the loss is due to bank negligence, or to a third-party breach you reported within three working days of the bank's communication.
  • On notification the bank must shadow-credit the disputed amount within 10 working days, without waiting for any insurance claim to settle.
  • A failed transaction and a fraudulent one are different things with different rules — say clearly which you are reporting.
  • The RBI Ombudsman route opened on 1 July 2026 with a 90-day filing window, not the one year most online guidance still quotes.
Progress: 0 / 23 items
Required items: 0 / 15 (0%)

Report First — Before Anything Else

Then Secure the Evidence

Financial Transaction Evidence

Fraudster Communication Evidence

Bank Complaint Evidence

Cyber Crime Filing

Where to File

National Cyber Crime Reporting Portal (cybercrime.gov.in) → RBI Integrated Ombudsman (cms.rbi.org.in) → Local Cyber Crime Cell (nearest police station). For UPI-specific disputes, also file with your bank's Nodal Officer.

Expert Tip

Report before you organise anything. Call 1930 first and register at cybercrime.gov.in — that is the channel through which a request can reach the beneficiary bank about the destination account, and it is the only step aimed at the money itself rather than at liability. Then report to your bank in writing the same day. No channel can promise recovery, and how much of the loss you bear is decided separately by the RBI framework on customer liability, which turns on how quickly you notified the bank after its alert.

Related Resources
UPI Complaint Letter GeneratorUPI Fraud Complaint FormatCyber Fraud Help CenterBank Complaint LetterDraft Your Complaint Now

Ready to Draft Your Complaint?

GetNyay’s AI generates a complete, formatted complaint letter using your specific facts — in Hindi or English.

Draft Complaint with AI →

The first hour: what actually recovers money

Almost everything that determines whether a fraud victim in India gets their money back happens in the first few hours, before any complaint is drafted. Once funds have been layered through two or three mule accounts and withdrawn, no complaint mechanism recovers them.

The single effective intervention is the national cybercrime helpline on 1930, operated by the Indian Cyber Crime Coordination Centre. It can coordinate with your bank and the beneficiary bank to place a lien on the destination account while the money is still sitting in it. Every other step — the bank complaint, the ombudsman, the consumer commission — is about liability and compensation, not recovery.

  1. 1Call 1930 immediately. Have ready: the amount, the date and time, the transaction reference (UTR or RRN), the beneficiary UPI ID or account number if you have it, and your registered mobile.
  2. 2Register the complaint at cybercrime.gov.in (the National Cybercrime Reporting Portal) and note the acknowledgement number. Complete the detailed complaint within 24 hours.
  3. 3Call your bank and block the card, the UPI ID or the account access as appropriate, and note the reference number of that call.
  4. 4Send the bank a written complaint the same day, from your registered email, quoting the NCRP acknowledgement number.
  5. 5Do not delete anything — not the SMS, not the app notification, not the messages from the fraudster.
  6. 6Take screenshots of the transaction screen showing the UTR or RRN, and of the beneficiary VPA where it is visible.
  7. 7Where the fraud involved a call or a link, preserve the number, the URL and any screenshots of the exchange.
⚠️
Never let the bank talk you out of a written complaint

Branch staff frequently say a phone report is enough, or that the matter is "with the fraud team". Neither the RBI Ombudsman nor a consumer commission can act on a phone call. A written complaint from your registered email on the same day, with a reference number, is what every later forum will ask you for first.

How much of the loss you actually have to bear

The RBI framework on limiting the liability of customers in unauthorised electronic banking transactions decides who bears the loss, and it turns almost entirely on how quickly you reported it. This is the section to read before you accept a bank's assertion that the loss is yours because your credentials were used.

Customer liability for an unauthorised electronic transaction
SituationYour liability
The loss is due to the bank's negligence, wherever the deficiency liesNil, regardless of when you reported
Third-party breach, no fault of bank or customer, reported within 3 working days of the bank's communicationNil
Third-party breach, reported on the 4th to 7th working dayCapped by account type — ₹5,000, ₹10,000 or ₹25,000
Reported after 7 working daysAs per the bank's Board-approved policy
Loss due to your own negligence, such as sharing credentials or an OTPThe entire loss until you report it; the bank bears it from the moment you report

The caps in the 4-to-7-day band: ₹5,000 for BSBD accounts; ₹10,000 for other savings accounts, prepaid instruments and gift cards, MSME current and overdraft accounts, individual current accounts with average annual balance up to ₹25 lakh, and credit cards with a limit up to ₹5 lakh; ₹25,000 for other current and cash-credit accounts and credit cards with a limit above ₹5 lakh. Confirm the current position at rbi.org.in.

💡
The three days run from the bank's alert, not from the transaction

The period runs from the date the bank sent you its communication about the transaction. If you did not receive the SMS or email, say so in writing and ask the bank to produce evidence of when the alert was delivered. That single question converts an argument about your diligence into a question about the bank's records.

A failed transaction is not a fraud — and the rules differ

Banks and complainants both routinely conflate two very different situations. A failed transaction is one you authorised where the money left your account but did not reach its destination. A fraudulent transaction is one you never authorised at all. Different frameworks apply, and using the wrong vocabulary in a complaint sends it to the wrong queue.

Failed transactions: the RBI Turn Around Time framework
Transaction typeAuto-reversal deadlineCompensation for delay
UPI — person to person, beneficiary not creditedT + 1 day₹100 per day beyond T + 1
UPI — merchant payment, no confirmation at merchantT + 5 days₹100 per day beyond T + 5
IMPS — beneficiary not creditedT + 1 day₹100 per day beyond T + 1
ATM — cash not dispensed, account debitedT + 5 days₹100 per day beyond T + 5
Card at a point of sale, or online card paymentT + 5 days₹100 per day beyond T + 5
Prepaid wallet (on-us) reversal to remitterT + 1 day₹100 per day beyond T + 1

Source: the RBI circular on Harmonisation of Turn Around Time and customer compensation for failed transactions. The compensation is payable suo motu — the bank owes it without you asking. "T" is the date of the transaction.

⚠️
Bank call centres quote T+5 for everything

A failed UPI transfer to another person is T+1, not T+5. If you have been told to wait five working days for a P2P failure, the compensation clock started four days earlier than you were told, and the bank owes ₹100 for each of those days.

The specific identifiers to capture before anything is deleted

Fraud complaints fail on missing identifiers far more often than on weak facts. Each of the items below appears somewhere in an app screen or an SMS that will be overwritten or deleted within days.

  • The UTR or RRN of the disputed transaction — the unique reference that lets any bank trace it.
  • The beneficiary VPA (the UPI ID) or the beneficiary account number and IFSC, if visible.
  • A screenshot of the transaction detail screen in the UPI app, before the history is cleared.
  • The original bank SMS or email alert, with its timestamp — this is what the three-working-day clock runs from.
  • A bank statement extract covering the full period, showing the debit and the absence of any credit.
  • The NCRP acknowledgement number from cybercrime.gov.in, and the 1930 call reference.
  • The FIR or CSR number if the police registered one.
  • The bank complaint reference number, and the date and time of the written complaint.
  • Any phone number, URL, APK or message from the fraudster, preserved as a screenshot rather than forwarded.
  • The device and app details if a screen-sharing or remote-access application was involved.
ℹ️
Do not forward the fraudster's messages to anyone

Forwarding can strip metadata and, where the message contains a link or an attachment, can spread it. Screenshot the exchange with the sender identifier visible, and keep the original thread intact on the device rather than deleting it.

The escalation ladder after the first 24 hours

  1. 1Written complaint to the bank, from your registered email, quoting the NCRP acknowledgement. Get a complaint reference number.
  2. 2Escalate to the bank's internal grievance redressal officer and then to its Principal Nodal Officer, on the same reference number so the original complaint date is preserved.
  3. 3For a UPI dispute, also raise it in the payment app's own grievance channel — every UPI app is required to publish one — and keep that reference.
  4. 4The RBI Ombudsman at cms.rbi.org.in, free, after 30 days and within 90 days of the expiry of that period or of the bank's last communication, whichever is later.
  5. 5The District Consumer Commission at e-jagriti.gov.in for deficiency in service, within two years of the cause of action.
  6. 6Follow the criminal complaint separately through the NCRP portal and the cyber cell — it runs in parallel and does not replace the bank claim.
⚠️
The RBI Ombudsman window is now 90 days

The Reserve Bank – Integrated Ombudsman Scheme, 2026 came into force on 1 July 2026 and replaced the 2021 scheme. The window to file collapsed from one year to 90 days, running from the expiry of the bank's response period or its last communication, whichever is later. Most guidance still online quotes the old one-year figure. Diarise the date yourself.

Worked examples

Example 1: Unauthorised UPI debit reported the same evening

Amount
₹64,000 across three transactions
Bank alert received
9 July, 8:12 pm
1930 called
9 July, 8:25 pm
Written complaint to bank
9 July, 9:40 pm
Account type
Ordinary savings account
Credentials shared?
No
  1. 1.Reporting happened within three working days of the bank's communication — in fact within twenty minutes.
  2. 2.With no contributory negligence by the customer, this falls in the zero-liability band; the ₹10,000 cap for the 4-to-7-day band never arises.
  3. 3.On notification the bank must shadow-credit the full ₹64,000 within 10 working days, without waiting for any insurance claim to settle.
  4. 4.Counting working days from 9 July, that deadline fell on 23 July.
  5. 5.The NCRP acknowledgement from the 1930 report should be quoted in the written complaint, which turns it into a documented fraud rather than a disputed debit.
Result

Claim zero liability and the full ₹64,000 shadow-credited, plus reversal of any charge or interest triggered by the debit and a written explanation of how the transactions were authenticated. The 8:25 pm call to 1930 is the fact that carries the whole complaint.

Example 2: Failed UPI transfer, still not reversed after 18 days

Amount
₹12,000
Type
UPI person to person
Transaction date (T)
1 August
Beneficiary credited?
No
Reversed?
No, as at 19 August
Bank position
"Please wait T+5 working days"
  1. 1.This is a failed transaction, not a fraud, so the Turn Around Time framework applies rather than the limited-liability framework.
  2. 2.UPI person-to-person carries a T+1 deadline, so auto-reversal was due by 2 August. The T+5 answer is wrong.
  3. 3.Delay to 19 August is 17 days beyond the deadline.
  4. 4.Compensation at ₹100 per day: 17 × ₹100 = ₹1,700, payable suo motu.
  5. 5.Total claim: ₹12,000 principal plus ₹1,700 compensation = ₹13,700, increasing by ₹100 per further day.
Result

Write to the branch and the Principal Nodal Officer claiming ₹13,700, correcting the T+5 answer on the record. Diarise day 30 from the written complaint as the date the RBI Ombudsman becomes available, and day 120 as the end of the 90-day window.

Example 3: Reported on the sixth working day

Amount
₹58,000
Bank alert
Sent, but not seen — phone was abroad
Reported
Working day 6
Account type
Savings account
Credentials shared?
No
  1. 1.Reporting on the sixth working day falls in the 4-to-7-day band, which caps liability by account type rather than making it zero.
  2. 2.For an ordinary savings account the cap in that band is ₹10,000, so the customer bears at most ₹10,000 and the bank bears ₹48,000.
  3. 3.That is the position if the bank's alert was in fact delivered. Ask in writing for evidence of when and to what number the alert was sent.
  4. 4.If the alert was never delivered, or was delivered late, the argument shifts toward bank deficiency — where liability is nil regardless of timing.
  5. 5.The shadow-credit obligation within 10 working days of notification applies in either case.
Result

Claim ₹48,000 as the minimum position under the cap, and in the alternative the full ₹58,000 on the footing that the alert was not effectively delivered — asking the bank to produce its delivery records. Putting both positions is what stops the bank from treating the ₹10,000 cap as agreed.

More questions about this page

What is the first thing to do if money is taken by UPI fraud?▼
Call 1930, the national cybercrime helpline, and register at cybercrime.gov.in. In the first hours the helpline can coordinate with the beneficiary bank to place a lien on the destination account while the money is still there. Every other step is about liability and compensation; this is the only one about recovery.
How much of the loss do I have to bear in a fraud?▼
Nothing, where the loss arose from bank negligence, or from a third-party breach you reported within three working days of the bank's alert. Reporting on the fourth to seventh working day caps your liability by account type — ₹5,000, ₹10,000 or ₹25,000. Reporting later is governed by the bank's Board-approved policy.
What is shadow reversal and when must the bank do it?▼
On being notified of an unauthorised transaction, the bank must credit the disputed amount to your account within 10 working days of your notification, without waiting for any insurance claim to settle. It is a provisional credit pending investigation. Quote the date of your written notification and count the working days from it.
My UPI transfer failed and the money has not come back. Is that a fraud complaint?▼
No — it is a failed transaction, and a different framework applies. Under the RBI Turn Around Time circular a failed UPI person-to-person transfer must be auto-reversed by T+1 day and a UPI merchant payment by T+5 days, with ₹100 per day of delay payable to you automatically. Say clearly in your complaint which of the two you are reporting.
The bank told me to wait T+5 working days for a failed UPI transfer. Is that right?▼
Not for a person-to-person transfer. UPI P2P and IMPS carry a T+1 deadline. T+5 applies to ATM withdrawals, card transactions and UPI payments to merchants. If you have been waiting on a T+5 answer for a P2P failure, the compensation clock started four days earlier than you were told.
Do I need to file a police FIR for online fraud?▼
Register on the National Cybercrime Reporting Portal at cybercrime.gov.in, which is the route the system is built around, and note the acknowledgement number. Depending on the case the portal complaint may be converted into an FIR, or you may be asked to attend a cyber cell. Quote the acknowledgement number in your bank complaint either way.
What transaction details do I need to keep?▼
The UTR or RRN, the beneficiary VPA or account number, a screenshot of the transaction detail screen before the app history is cleared, the original bank SMS or email alert with its timestamp, a bank statement extract covering the period, and the NCRP acknowledgement number. The alert timestamp is what the three-working-day clock runs from.
How long do I have to escalate to the RBI Ombudsman?▼
Ninety days, running from the expiry of the bank's 30-day response period or from its last communication to you, whichever is later. The Reserve Bank – Integrated Ombudsman Scheme, 2026 replaced the 2021 scheme on 1 July 2026 and cut the window from a full year. Diarise it yourself, because a great deal of guidance still online quotes the old figure.
Can I go to the consumer commission as well?▼
Yes, for deficiency in service, within two years of the cause of action and with no filing fee for consideration up to ₹5 lakh. What you cannot do is run the same subject matter before the Ombudsman and a commission at the same time — a matter pending elsewhere is not maintainable before the Ombudsman.
I shared an OTP. Is the claim finished?▼
Not necessarily, but it is harder. Where the loss is due to the customer's own negligence, the customer bears the loss until they report it — and the bank bears everything occurring after the report. So the reporting time still matters a great deal. Separately, if the bank's systems or authentication were deficient, liability can shift back to the bank.
Should I keep talking to the fraudster to get the money back?▼
No. Recovery offers, "refund processing" requests and demands for a further small payment to release funds are a standard second-stage scam. Stop the exchange, preserve it as screenshots, and report the number and any URL through the NCRP portal.
Does GetNyay report the fraud for me?▼
No. GetNyay drafts the complaint to the bank from your facts, free, and you download it as Word or PDF and send it yourself. Reporting on 1930 and cybercrime.gov.in must be done by you, directly and immediately. GetNyay is not a law firm and cannot report or investigate a fraud.

Official sources checked

The statutes, rules and regulator pages the statements on this page were checked against.

Disclaimer: GetNyay is an AI legal drafting platform, not a law firm. This checklist is for general consumer awareness and does not constitute legal advice. Document requirements may vary by state, forum, or specific case facts. Consult a qualified advocate for legal guidance specific to your situation.
All Checklists·Brand Grievance Directory·Deadline Calculators·Complaint Guides·All Guides
Ask GetNyay AI