Lost Money to a UPI or Online Scam? What the Law Says About Getting It Back

Most advice about online fraud begins and ends with "call 1930." That is good advice, and it should be your first move. But it answers only half the question. A cyber fraud creates two separate legal problems that run on different tracks: a crime that the police investigate, and a financial loss that your bank may or may not have to make good. People who understand the difference recover more, and recover faster, than people who treat it as a single complaint.

Two Tracks, Two Different Goals

Track 1: The criminal complaint. This is about catching the fraudster and, just as importantly, getting the receiving accounts flagged or frozen before the money moves on. You report through the National Cyber Crime Reporting Portal (cybercrime.gov.in) or the helpline 1930, and you can also approach your local police or a cyber police station, including in Delhi NCR. The police register the offence and trace the money trail.

Track 2: The bank liability claim. This is about whether your bank has to restore your money, under RBI rules that limit what customers can be made to bear in electronic banking fraud. This runs through the bank, and then the banking regulator's complaint system, not through the police.

You should usually start both at once, and the same day. Reporting to the police does not replace informing the bank, and informing the bank does not replace the police complaint.

Why the Reporting Window Matters So Much

Under the RBI's customer-protection framework that currently applies, the time you take to inform your bank can decide who bears the loss:

• If the fraud results from the bank's own negligence, your liability is zero.
• If it is a third-party breach (neither you nor the bank at fault) and you report within 3 working days, your liability is zero.
• If you report in 4 to 7 working days, your liability is limited and capped.
• Beyond that, liability depends on the bank's board-approved policy.
• If the loss is due to your own negligence (for example, sharing your PIN, OTP, or password), you generally bear the loss until you report it.

Once you report an unauthorised transaction, the framework requires the bank to credit the disputed amount to your account (a "shadow reversal") within 10 working days while it investigates, with the investigation to be completed within 90 days. Any loss after you report is on the bank.

A Significant Change Is Coming on 1 January 2027

On 24 June 2026, the RBI issued amending directions that replace the older "limiting liability" approach with a broader customer-protection framework for fraudulent electronic banking transactions. These apply to electronic banking transactions made on or after 1 January 2027. Until then, the existing framework above continues to govern.

Based on published analyses of the new directions, the key changes include:

• Reporting window: zero liability for third-party breaches where you report within five calendar days of the transaction, rather than three working days.
• Bank negligence: zero liability even if you have not reported the fraud, where the loss is due to the bank's negligence.
• Burden of proof: the burden of proving that the customer was at fault is placed on the bank.
• Defined concepts: the directions define what counts as bank negligence and customer negligence.
• Compensation for small-value frauds: a compensation mechanism for victims of small-value digital frauds.

Because the exact thresholds and amounts matter, and because these rules apply by transaction date, read the RBI's directions or get advice on the precise provisions before relying on a specific figure.

The Grey Zone: "But I Sent the Money Myself"

The hardest cases are not stolen cards. They are the scams where you were deceived into authorising the payment yourself: a fake customer-care number, a "KYC update" link, a fake investment scheme, an impersonator claiming to be a police officer or investigator. Banks often reject these claims on the ground that the transaction was "authorised."

This is where the law is moving. RBI's draft and final directions recognise that a transaction can appear authorised but still involve fraud or coercion, such as being tricked into paying a scammer posing as a legitimate recipient. The new framework is intended to give such victims more protection than before. Courts have also been reinforcing the same direction: the Bombay High Court has observed that the RBI's framework exists to protect customers from unauthorised electronic transactions, and that a bank seeking to impose liability must establish the customer's fault.

None of this means every such claim succeeds. Facts decide the outcome, including how the fraud happened, what you shared, and how quickly you acted. But a rejection letter from your bank is not the end of the matter.

One Thing to Know About "Digital Arrest"

Indian law has no concept of a "digital arrest." No court, police officer, or investigating agency conducts an arrest over a video call or demands that you stay on camera and transfer money to "verify" your funds. If anyone does this, it is a fraud. If you have already transferred money, treat it exactly like any other cyber fraud and report it immediately.

What Offences Does a Cyber Fraud Involve?

A police complaint usually draws on several provisions together:

• Cheating and cheating by personation under the Bharatiya Nyaya Sanhita, 2023 (Sections 318 and 319).
• Identity theft and cheating by personation using a computer resource under the Information Technology Act, 2000 (Sections 66C and 66D).

Which sections are invoked depends on how the fraud was carried out. Whatever sections appear in the FIR, the practical priority is the same: get the complaint registered quickly, with accurate details, so that the receiving accounts can be flagged.

If the Bank Refuses: The Escalation Path

1. Written complaint to the bank. Always put it in writing (email or the bank's complaint portal) and keep the acknowledgement. Phone calls alone leave no record.
2. RBI Integrated Ombudsman. If the bank rejects your complaint or does not resolve it within 30 days, you can escalate to the RBI Ombudsman through the RBI's online complaint portal. This is free and does not require a lawyer.
3. Consumer Commission. Deficiency in banking service can be taken to the consumer forum, which can order refunds and compensation.
4. Civil or writ remedies. In larger or more complex cases, a civil suit or High Court petition may be appropriate.

Mistakes That Weaken a Claim

• Waiting. Every day of delay shrinks both your legal protection and the chance of freezing the money.
• Giving an inaccurate account. If you did share an OTP or click a link, say so. Banks and police can verify the logs, and a story that changes later damages your credibility.
• Deleting evidence. Keep screenshots, call logs, SMS messages, transaction IDs, and chats exactly as they are.
• Paying "recovery agents." People who contact fraud victims promising to recover their money for a fee are very often a second scam.
• Trusting any call back claiming to arrange a refund. Never share another OTP or install any app in the name of getting a refund.

When It Helps to Have a Lawyer

The first hour is something you can do yourself. A lawyer becomes valuable when the bank rejects the claim as "authorised," when the amount is substantial, when you need a well-drafted complaint and a properly framed Ombudsman or consumer filing, or when the police are slow to register or act on your complaint.

Legal7 connects you instantly with Bar Council verified lawyers experienced in criminal and consumer matters, starting at just ₹99, so you can understand which route fits your situation and what to do next.

[ Talk Now — ₹99 ]

Frequently Asked Questions

Is reporting on 1930 enough? No. It is the right first step for flagging the fraud, but you should also inform your bank in writing and make sure a formal complaint or FIR is registered.

Will I definitely get my money back? There is no guarantee. Recovery depends on how fast you reported, whether the money is still in the receiving accounts, who was at fault under the RBI framework, and the facts of the case.

Does the new RBI framework apply to a fraud that happened last month? The June 2026 amending directions apply to electronic banking transactions undertaken on or after 1 January 2027. For earlier transactions, the existing framework continues to apply.

Can I file a complaint if the amount is small? Yes. Small amounts are exactly where the new framework's compensation mechanism is aimed, and you should still report every incident, since patterns across complaints help investigators.

This article is for general information only and is not legal advice. Rules and deadlines may change; consult a qualified advocate for guidance on your specific situation.