Introduction
Imagine this.
You receive an SMS from your bank.
₹50,000 has been debited from your account.
You immediately realise that you have been tricked into making a UPI payment.
Your first reaction may be panic.
Your second may be to call the person who received the money.
But the most important thing you can do is act quickly through the proper channels.
Digital payment fraud can happen through fake customer-care numbers, QR-code scams, fraudulent payment requests, impersonation, fake investment opportunities, remote-access applications, phishing links, and social-engineering tactics.
The good news is that India has dedicated mechanisms for reporting financial cyber fraud. The National Cyber Crime Reporting Portal and 1930 cyber-fraud helpline are specifically available for reporting financial cyber fraud. Cyber Crime Portal
This guide explains what you should do immediately after discovering a UPI scam, what information you should preserve, where you should report it, and what you should realistically expect afterwards.
💡 Key Takeaways
- Act immediately. Do not wait until the next day to report a UPI fraud.
- Contact your bank immediately and report the transaction as fraudulent or unauthorised, as applicable.
- Report financial cyber fraud through 1930 and the National Cyber Crime Reporting Portal.
- Raise the transaction complaint through the relevant UPI/payment app as well.
- Keep the UTR/transaction ID, amount, date, time, UPI ID, screenshots, and communication records safely.
- Never share your UPI PIN, OTP, password or banking credentials with anyone claiming to be from your bank or payment provider. NPCI
- Money recovery is not guaranteed, but quick reporting can help authorities and banks take action before funds are moved further.
- Do not pay another person claiming that they can “recover” your lost money.
- A UPI transaction and an unauthorised electronic banking transaction are not necessarily the same situation. The circumstances of the fraud matter.
UPI Scam: Why the First Few Minutes Matter
UPI transactions are designed to move money almost instantly.
That convenience is one of the reasons UPI has become such an important part of everyday payments in India.
But the same speed creates a problem when a fraudulent transaction occurs.
Once money has been transferred, the fraudster may attempt to move it through additional accounts or withdraw it.
This is why immediate reporting is important.
The Government’s Citizen Financial Cyber Fraud Reporting and Management System (CFCFRMS) was created to facilitate immediate reporting of financial fraud and help prevent fraudulent funds from being siphoned away. The Government reported that, through the system, more than ₹11,158 crore had been saved across more than 32.8 lakh complaints up to June 30, 2026. Press Information Bureau
This does not mean that every reported transaction will be recovered.
It means that time can matter significantly when responding to financial fraud.
What to Do in the First 30 Minutes After a UPI Scam
Step 1: Contact Your Bank Immediately
As soon as you realise that money has been transferred fraudulently, contact your bank.
Use the bank’s official customer-care number or banking application.
Do not search for a customer-care number on Google and blindly call the first number you see. Fake customer-care numbers are themselves commonly used in financial scams.
Tell the bank clearly:
“I need to report a fraudulent/unauthorised UPI transaction.”
Provide:
- Transaction amount
- Date and time
- UPI transaction ID/UTR
- Recipient details
- Your bank account details, if required
- Any other information requested by the bank
Do not delay this step.
RBI advises customers to notify their bank immediately after noticing an unauthorised electronic transaction. Under RBI’s customer-liability framework, the circumstances and speed of reporting can affect the customer’s liability.
Step 2: Report the Transaction Through Your UPI App
Open the UPI application through which the transaction was made.
Go to:
Transaction History → Select the transaction → Raise Complaint/Report Issue
The exact menu may differ between applications.
NPCI’s UPI dispute mechanism allows users to raise complaints relating to UPI transactions through their participating UPI/payment application. Google Pay
Keep the complaint/reference number generated by the application.
Important
For fraudulent, unidentified, or unauthorised transactions, NPCI specifically advises customers to raise the matter with their respective bank for redressal.
Therefore, do not treat the UPI-app complaint as a replacement for contacting your bank.
Do both.
Step 3: Call 1930
If you have suffered a financial cyber fraud, call:
1930
This is the National Cyber Crime Reporting Helpline for financial cyber fraud.
The National Cyber Crime Reporting Portal also provides the option to report cybercrime online. The official portal currently instructs victims of cyber financial fraud to call 1930 for immediate reporting. Cyber Crime Portal
When calling, keep the following information ready:
- Your mobile number
- Bank name
- Transaction amount
- Transaction date and time
- UTR/transaction reference number
- Recipient UPI ID
- Details of how the fraud occurred
The faster you provide accurate information, the easier it is for the complaint to be processed.
Step 4: File the Complaint on the National Cyber Crime Reporting Portal
After reporting the fraud through 1930, use the official:
National Cyber Crime Reporting Portal
Select the relevant option for reporting financial cybercrime.
The portal requires complainants to provide details of the incident and supporting information. It also allows complaints to be tracked. Cyber Crime Portal
Keep your complaint reference details safe.
Do not assume that calling 1930 means you no longer need to complete the online complaint process if you are instructed to do so.
Follow the instructions provided during the reporting process.
Step 5: Preserve Every Piece of Evidence
Do not delete the conversation with the scammer.
Do not uninstall the application immediately unless instructed to do so by the relevant authority.
Instead, preserve the evidence.
Keep:
- UPI transaction screenshot
- UTR/transaction number
- Bank SMS
- Bank statement
- UPI app transaction details
- Recipient UPI ID
- Recipient name displayed during payment
- Phone number used by the scammer
- WhatsApp conversations
- SMS messages
- Emails
- Website links
- Screenshots of fraudulent advertisements
- QR codes, if available
- Call details
- Names or identities used by the scammer
The National Cyber Crime Reporting Portal specifically asks complainants to provide supporting information and evidence when reporting cybercrime. Cyber Crime Portal
Do not edit screenshots in a way that removes important information.
Keep the original evidence intact.
Step 6: Secure Your Banking Access If Credentials Were Exposed
Not every UPI scam involves compromised banking credentials.
However, if you have shared or exposed:
- UPI PIN
- Internet banking password
- Debit-card details
- OTP
- ATM PIN
- Account credentials
Take immediate steps to secure the affected accounts.
Contact your bank through its official channel and follow its instructions.
NPCI explicitly advises customers not to share their UPI PIN, and notes that bank customer support should not ask for it. NPCI
Remember:
You never need to enter your UPI PIN to receive money.
A UPI PIN is used to authorise a transaction that sends money from your account.
Common UPI Scams You Should Know
UPI fraud does not always look like a traditional “hack.”
Many scams depend on social engineering—convincing the victim to perform the transaction themselves.
1. Fake Customer-Care Scam
You search for customer support online and contact a fake number.
The person claims to be from your bank, payment app or another company.
They may ask you to:
- share an OTP,
- install an application,
- provide card information,
- or make a “verification” payment.
Stop immediately.
Use only the company’s official website or application to obtain support details.
2. QR-Code Scam
Someone sends you a QR code and tells you:
“Scan this to receive your refund.”
Scanning a QR code can initiate a payment flow.
Receiving money does not normally require you to enter your UPI PIN to receive the funds.
Never approve a payment merely because someone says it is necessary to receive money.
3. Fake Payment Request
A scammer sends a collect/payment request and tells you that you need to approve it to receive money.
Read the transaction screen carefully before authorising anything.
If the transaction requires your UPI PIN to approve a payment, you are authorising a debit from your account.
4. Fake Investment Opportunity
The scam may begin with an attractive investment opportunity, trading group or guaranteed-return promise.
The victim may eventually be asked to transfer money through UPI.
If an investment platform asks you to send money to a personal UPI ID instead of using legitimate payment infrastructure, treat it as a major warning sign.
Niyyam has previously covered how investors can verify whether a financial platform is legitimate before investing.
How to Verify Whether a Mutual Fund Platform Is Legit in India
5. Remote-Access Scam
A fraudster may convince you to install an application that allows remote access to your device.
Once installed, the scammer may attempt to observe or control activities on your device.
Never install remote-access software simply because an unknown person tells you that it is required to process a refund or solve a banking problem.
What If You Approved the UPI Payment Yourself?
This is one of the most confusing situations.
Suppose a scammer tricks you into believing that you are receiving money.
You follow their instructions.
You enter your UPI PIN.
The money is debited.
You may think:
“Because I entered the PIN myself, there is nothing I can do.”
That conclusion is too simplistic.
You should still report the fraud immediately to your bank, the UPI/payment provider and the cyber-fraud authorities.
However, do not assume that the RBI’s rules on unauthorised electronic transactions automatically mean you will receive a refund in every case.
Customer liability depends on the circumstances of the transaction, including issues such as customer negligence and how quickly the bank is notified. RBI’s framework specifically addresses different situations involving unauthorised electronic banking transactions. Reserve Bank of India
Therefore:
Report first. Determine liability later.
Do not give up simply because you authorised the transaction after being deceived.
Can You Get Your Money Back After a UPI Scam?
This is probably the first question most victims ask.
The honest answer is:
Sometimes, but recovery is not guaranteed.
The outcome can depend on:
- how quickly the fraud was reported,
- whether the money is still traceable,
- whether the recipient account can be identified,
- whether funds have already been transferred elsewhere,
- the nature of the transaction,
- the circumstances of the fraud,
- and the findings of the bank and investigating authorities.
The Government’s CFCFRMS is specifically designed to facilitate coordination between stakeholders and help prevent fraudulent funds from being siphoned away.
Therefore, speed matters—but speed is not a guarantee of recovery.
Be especially careful of anyone who contacts you afterwards and says:
“I can recover your money if you pay me a recovery fee.”
That can become a second scam targeting an existing victim.
What You Should NOT Do After a UPI Scam
Do not wait
Thinking that the bank will automatically reverse the payment can waste valuable time.
Do not argue with the scammer
Your priority is reporting and securing your accounts.
Do not delete evidence
Keep messages, screenshots, and transaction records.
Do not share your OTP or UPI PIN
Even after you have been scammed, legitimate bank representatives should not need your UPI PIN.
Do not make another payment
A scammer may claim that another transaction is necessary to “cancel,” “verify,” or “reverse” the first one.
Do not trust recovery agents
Someone promising guaranteed recovery for an upfront fee may be another fraudster.
How to Reduce the Risk of UPI Fraud
Prevention is still better than recovery.
1. Read Before You Pay
Check:
- recipient name,
- amount,
- UPI ID,
- and transaction details.
Don’t approve a payment simply because someone is pressuring you.
2. Never Share Your UPI PIN
Your UPI PIN is for authorising transactions. Keep it private. NPCI
3. Don’t Trust Search Results Blindly
When looking for bank or payment-app customer support, use the official website or official application.
4. Be Suspicious of Urgency
Scammers often create artificial pressure:
“Pay within five minutes.”
“Your account will be blocked.”
“Your refund will expire.”
“Complete this verification immediately.”
Pause.
Verify independently.
5. Don’t Assume a QR Code Is for Receiving Money
Always understand what you are authorising before entering your UPI PIN.
6. Be Careful With Investment Offers
Promises of guaranteed or unusually high returns should immediately raise questions.
Before transferring money to an investment platform, verify its identity, regulatory status and payment process.
UPI Scam vs Unauthorised Transaction: Why the Difference Matters
These terms are sometimes used interchangeably, but they are not necessarily identical.
An unauthorised transaction generally refers to a transaction carried out without the customer’s authorisation.
A scam, however, may involve a victim being manipulated into authorising a payment.
For example:
Case A:
Someone gains unauthorised access and money is transferred without the customer’s involvement.
Case B:
A scammer convinces the customer that they are receiving a refund, and the customer enters the UPI PIN and approves a payment.
Both situations should be reported.
But the applicable customer-liability analysis can differ.
RBI’s framework specifically considers factors including customer negligence and the timing of notification to the bank.
This is why you should report the facts accurately rather than trying to classify the transaction yourself.
A Simple UPI Fraud Action Checklist
If you have just lost money through a UPI scam:
1. Stop communicating with the scammer.
2. Contact your bank immediately.
3. Report the transaction through your UPI/payment application.
4. Call 1930.
5. File/report the complaint through the National Cyber Crime Reporting Portal.
6. Save the UTR/transaction ID.
7. Preserve screenshots and conversations.
8. Secure any exposed banking credentials.
9. Do not make another payment to the scammer.
10. Do not pay anyone promising guaranteed recovery.
The key principle is simple:
Report first. Preserve evidence. Secure your accounts. Then follow the official investigation and grievance process.
Frequently Asked Questions
What should I do immediately after a UPI scam?
Contact your bank immediately, report the transaction through the relevant UPI/payment application, call 1930, and report the financial cyber fraud through the National Cyber Crime Reporting Portal. Preserve all transaction and communication evidence. Cyber Crime Portal
What is the UPI fraud helpline number in India?
For financial cyber fraud, the National Cyber Crime Reporting system uses 1930 for immediate reporting. Cyber Crime Portal
Can I get my money back after a UPI scam?
Recovery is possible in some cases but cannot be guaranteed. The outcome depends on the circumstances and how quickly the fraud is reported, among other factors.
Should I contact my bank even after calling 1930?
Yes. Contact your bank immediately and report the transaction. NPCI also directs customers to their respective bank for fraudulent, unidentified, or unauthorised transactions. NPCI
Can I reverse a UPI payment myself?
A completed UPI payment generally cannot simply be cancelled by the sender after initiation. NPCI’s UPI FAQ states that once a payment is initiated, it cannot be stopped through a simple stop-payment request. NPCI
That is why immediate reporting to the bank and cyber-fraud authorities is important.
What if I shared my UPI PIN with a scammer?
Contact your bank immediately and follow its instructions to secure your account and credentials. Your UPI PIN should never be shared with anyone. NPCI
What if I was tricked into making the payment myself?
Still report it immediately. Being deceived into authorising a payment does not mean you should simply accept the loss without reporting it. However, customer-liability rules depend on the specific circumstances. System Health
Is 1930 available for all types of complaints?
1930 is specifically used for financial cyber fraud. Other types of cybercrime can be reported through the National Cyber Crime Reporting Portal. Cyber Crime Portal
Final Conclusion
UPI has made digital payments faster and more convenient for millions of Indians.
But convenience should never mean blindly trusting every payment request, QR code, phone call or message.
If you become a victim of a UPI scam, do not spend the first few minutes blaming yourself or arguing with the fraudster.
Use those minutes to take action.
Contact your bank.
Report the transaction.
Call 1930.
File the cybercrime complaint.
Preserve your evidence.
Secure your financial accounts.
And remember:
A fast response does not guarantee that your money will be recovered—but delaying the report can reduce the opportunity to act.
Financial security is not only about earning, saving and investing money.
It is also about protecting the money you have already built.
That is why digital financial awareness should be considered an important part of personal financial planning.
Disclaimer
This article is intended solely for educational and informational purposes and should not be considered legal, banking, cybersecurity, or financial advice. Procedures, regulatory requirements and grievance mechanisms may change over time. In case of a UPI or other digital-payment fraud, contact your bank and the appropriate government/cybercrime authorities immediately and follow their instructions