If money has just left your account through a UPI scam, stop reading after this line and call 1930, the national cybercrime helpline. Then come back. The first hour matters more than anything else in this guide, because the police can only ask the receiving bank to freeze the money while it is still sitting in the fraudster’s account.
Once that call is done, there are three more things to finish: a complaint on cybercrime.gov.in, a written complaint to your own bank, and, if the bank does not help, an escalation to the RBI. Below I walk through each step in the order I would do it, what details to keep ready, the deadlines that decide whether you get a refund, and the mistakes that quietly ruin many complaints.
The short answer: what to do, in order
- Call 1930 immediately and note the acknowledgement number you get.
- File the full complaint on cybercrime.gov.in under Financial Fraud, using that number, within 24 hours.
- Report the transaction to your bank in writing (app, email or branch letter) within 3 working days.
- Raise a dispute inside your UPI app for the same transaction.
- Escalate to the RBI Ombudsman at cms.rbi.org.in if the bank does not reply in 30 days or rejects you unfairly.
Step 1: Call 1930 first, not the website
1930 is the toll-free helpline run by the Ministry of Home Affairs for reporting online financial fraud (it replaced the older 155260 number). It is linked to banks and wallets, so a complaint made here can be passed to the receiving bank quickly. I always tell people to call before opening the website, because the portal can be slow when many people are using it, and a phone call gets your case into the system faster.
Details to keep ready before you call
The official citizen manual on cybercrime.gov.in lists what the operator will ask for. Open your UPI app and bank SMS and keep these on screen:
- Your mobile number
- Name of the bank or wallet the money was debited from
- Your account number, wallet ID or UPI ID that was debited
- The transaction ID (the 12-digit UPI reference number, also called UTR)
- Date and time of the transaction
- Card number, only if the fraud used your debit or credit card details
- Screenshots of the transaction, chats or the fake website, if you have them
After the call you will receive a system-generated login ID or acknowledgement number by SMS or email. Do not lose it. You need it for the next step and for your bank complaint.
Step 2: Complete the complaint on cybercrime.gov.in within 24 hours
The 1930 call is only the first half. The citizen manual clearly says the complainant must complete the complaint on the National Cyber Crime Reporting Portal within 24 hours using the acknowledgement number. Many people skip this, thinking the phone call was enough.
Here is the path on the portal:
- Open cybercrime.gov.in in Chrome or Firefox (the site itself recommends these browsers).
- Go to Register a Complaint > Financial Fraud, or click Register a Complaint under the Financial Fraud card on the home page.
- Sign in with your mobile number and the OTP sent to it.
- Fill in the incident details: date, time, how it happened (fake call, QR code, job offer, OLX buyer, and so on).
- Add each fraudulent transaction separately with its UTR number, amount and the account or UPI ID it went to.
- Upload screenshots of the payment and the chats. Keep each file small and clear.
- Review everything once and submit. Save or screenshot the final complaint number.
You can follow up later using Track your Complaint on the same site. If the response from the police is not proper, the portal also lists State and UT nodal officers and grievance officers you can contact.
Step 3: Report it to your bank in writing within 3 working days
This is the step that decides whether the bank has to refund you. Under the RBI circular “Customer Protection – Limiting Liability of Customers in Unauthorised Electronic Banking Transactions” (6 July 2017), your liability depends on how fast you tell your bank. The clock starts from the day you receive the bank’s SMS or email about the transaction, and that day itself is not counted.
| When you report to the bank | Your liability (third-party breach) |
|---|---|
| Within 3 working days | Zero |
| 4 to 7 working days | Transaction value or a fixed cap, whichever is lower (₹10,000 for most savings accounts, ₹5,000 for basic BSBD accounts) |
| After 7 working days | As per your bank’s Board-approved policy |
The same circular says that once you notify the bank, it must credit the amount back to your account (called a shadow reversal) within 10 working days, and it must settle the complaint within 90 days. Banks must also give you 24×7 ways to report, such as a toll-free number, SMS reply, website or email.
An honest catch you should know
The zero-liability rule covers unauthorised transactions, where someone else used your account without you. If you shared your UPI PIN or OTP, the circular says you bear the loss until you report it, and anything taken after you report is the bank’s responsibility. If you yourself entered the PIN and sent money to a scammer, the bank may treat it as an authorised payment. In that case your best chance of recovery is the 1930 freeze, which is why speed matters so much. Report to the bank anyway, and mention your 1930 and portal complaint numbers.
What to write in the bank complaint: your name, account number, the date, amount and UTR of each transaction, a line saying you did not authorise it (only if true), and your 1930 acknowledgement and cybercrime portal complaint numbers. Ask for a written complaint number in reply.
Step 4: Raise a dispute in your UPI app
Open the transaction in the app you paid from (Google Pay, PhonePe, Paytm, BHIM or your bank’s app) and use its help or report option to raise a complaint on that exact payment. Menu names change from app to app and update to update, so look for the help or support option on the transaction details screen. This creates one more timestamped record and alerts the app’s fraud team. It does not replace the 1930 call or the bank complaint.
Step 5: Escalate to the RBI Ombudsman if the bank does not help
According to the RBI’s own FAQ, you must first complain to your bank. If the bank does not reply within 30 days, rejects the complaint, or you are not happy with the answer, you can file a free complaint with the RBI Ombudsman online at cms.rbi.org.in. Attach the bank’s reply (or proof that you complained), your cybercrime complaint number and transaction proofs.
Where to report what: a quick comparison
| Situation | Where to report | Deadline to remember |
|---|---|---|
| Money already lost | 1930 and cybercrime.gov.in (Financial Fraud) | Call at once, portal within 24 hours |
| Unauthorised debit from your account | Your bank, in writing | Within 3 working days for zero liability |
| Bank not resolving it | RBI Ombudsman, cms.rbi.org.in | After 30 days with no reply, or after rejection |
| Fraud call, SMS or WhatsApp, but no money lost | Chakshu on sancharsaathi.gov.in | Within 30 days of the message |
| Want to check a suspicious number or UPI ID | Suspect Repository on cybercrime.gov.in | Anytime, before you pay |
Got a scam call but did not lose money? Use Chakshu
If someone called pretending to be from your bank, sent a fake KYC SMS, or messaged you on WhatsApp with a “part-time job”, you can report the number on Chakshu, a facility of the Department of Telecommunications on the Sanchar Saathi website. Go to sancharsaathi.gov.in/sfc, choose Report Suspected Fraud, pick Call, SMS or WhatsApp, and fill in the details. The page asks you to report within 30 days for action.
Remember that Sanchar Saathi itself says Chakshu is not the place to report money already lost. For that, it points you back to 1930 and cybercrime.gov.in.
Common mistakes that hurt your chances
- Waiting until the next morning. UPI money moves in seconds, and fraudsters shift it through several accounts quickly. A late report often finds an empty account.
- Calling 1930 but never finishing the portal complaint. The citizen manual makes the portal step mandatory within 24 hours.
- Only calling the bank, never writing. A phone call is hard to prove. An email, in-app complaint or stamped letter gives you a dated record for the 3-day rule.
- Searching “customer care number” on Google. Fake helpline numbers are a common trap. Use the number printed on your card, inside your bank’s official app, or on its official website.
- Paying a “recovery agent”. Anyone who asks for a fee to get your money back is very likely running a second scam. Filing on 1930 and cybercrime.gov.in is free.
- Deleting the chats in anger. Screenshots of chats, numbers and UPI IDs are your evidence. Take them before blocking the scammer.
Simple habits that stop most UPI scams
- You never need to enter your UPI PIN to receive money. If a screen asks for your PIN to “receive” a payment, it is a collect request taking money out.
- Never share OTPs or your UPI PIN with anyone, including people claiming to be bank staff or police.
- Do not scan QR codes sent by strangers to “get” a refund or prize. Scanning a QR is for paying.
- Check unknown numbers and UPI IDs on the Suspect Repository at cybercrime.gov.in before sending money.
- Keep SMS alerts on for your bank account, so you see a debit the moment it happens.
Frequently asked questions
Will I definitely get my money back after calling 1930?
No one can promise that. 1930 helps the police ask the receiving bank to block the money. If the amount is still in that account, the chance of recovery is good. If it has already been withdrawn or moved, it becomes much harder, which is why calling quickly is so important.
Is 1930 available at night and on holidays?
1930 is the national helpline meant for immediate reporting of online financial fraud, and you can always file on cybercrime.gov.in at any hour as well. If you cannot get through on the phone, file on the portal straight away and keep trying the number.
Do I also need to go to the police station for an FIR?
Start with 1930 and the online complaint. Complaints on the portal are handled by the police of your State or UT. If they contact you for more details or ask you to visit, carry printouts of your complaint number, bank statement and screenshots.
Does the 3-working-day rule apply if I shared my OTP?
The zero-liability rule is for cases where neither you nor the bank was at fault. If you shared your PIN or OTP, the RBI circular puts the loss on you until you report it to the bank. Losses after you report are borne by the bank, so report immediately in any case.
Can I report a fraud that happened weeks ago?
Yes. You can still file on cybercrime.gov.in and complain to your bank. Recovery is less likely and the bank’s own policy will decide your liability after 7 working days, but a complaint also helps the police trace the same fraudster for other victims.
Final word
Save 1930 in your contacts today, and share this page with your parents and anyone at home who uses UPI. When a fraud happens, people panic and waste the first hour searching for what to do. Knowing the order (1930, then cybercrime.gov.in, then a written bank complaint within 3 working days) can be the difference between getting your money back and losing it.