UPI and cyber fraud: how to report on 1930 and cybercrime.gov.in

The money in a UPI fraud usually leaves your account in a minute and leaves the fraudster’s first account within a few minutes more. That is why every official page on this subject says the same thing in different words: report fast. This page is the step-by-step for the first hour, what to keep as evidence, what the RBI’s rules say about your bank’s side and the three-working-day window, and what to do when the bank does not help. It does not ask for any of your details. We do not take complaints, we do not collect screenshots and nobody from this site will ever message you about a fraud. Please do not send your account number, UPI PIN, OTP or card details to us or to anyone who says they can get your money back.

In short

• Call 1930 at once. It is the national helpline for cyber financial fraud and it runs in all States and Union Territories.
• Then report on cybercrime.gov.in, the National Cybercrime Reporting Portal, and note the acknowledgement number.
• Tell your bank and the UPI app straight away, in writing if you can, so that further debits stop. Under the RBI’s 2017 rules the days you take to report matter.
• Keep every proof. Do not delete chats, call logs or screenshots, even if the fraudster’s number goes dead.
• Do not pay anyone who promises to recover your money. Recovery agents are the second scam.

The first hour, step by step

1. Stop. Do not send more money, do not argue with the caller, and do not click anything else. If a remote access app is on your phone, such as a screen sharing or support tool, switch off the internet and uninstall it once you have taken screenshots.
2. Call 1930. Say it is a financial fraud, give the amount, the time, the transaction ID and the account or UPI ID the money went to. The Indian Cybercrime Coordination Centre, which runs the system, says the Citizen Financial Cyber Fraud Reporting and Management System connects 85 banks, payment intermediaries and wallets to the cybercrime backend, so that quick action can be taken to stop the money moving on. The idea is to catch it early, before it is split across accounts and withdrawn.
3. Report on cybercrime.gov.in. The Indian Cybercrime Coordination Centre’s own one-minute explainer for the portal shows four steps. Choose the complaint type, such as financial fraud. Fill in the details, which are your identity, the incident and the transaction information. Submit. Then track the status with the acknowledgement number. The portal has an online status tracking facility for the complainant. Screens change, so follow what the portal shows.
4. Tell your bank. Call the customer care number printed on your card or shown in your bank’s official app, never one that came from a search result or a message. Say that you want the transaction reported as fraud and further debits stopped. Follow up with an email or the complaint option in the app, and keep the complaint number. The RBI says a bank must give customers 24×7 ways to report, and that on receiving a report it must take immediate steps to prevent further unauthorised transactions on the account.
5. Tell the UPI app too. Raise a complaint on the specific transaction in the app you paid from. Block the app or the card if your credentials were shared.
6. Change what the fraudster saw. Change your UPI PIN, net banking password and the passwords of any account on that phone, and block the SIM if the fraudster had your number.

What to keep as evidence

• The UTR or transaction ID, the date, the time and the amount, taken from the bank SMS or the app’s history.
• The UPI ID, account number, phone number or name that received the money.
• Screenshots of chats, links, payment requests, the fake website or app, and the QR code if one was used.
• Call logs, recordings if you have any, and the number or email address that contacted you.
• The names of any apps the caller asked you to install.
• The complaint numbers from 1930, the portal and your bank, with the date and time you made each call.

Keep this in a safe place on your own device or on paper. Do not post it on social media and do not send it to a stranger offering help. Write the timeline while you remember it, in plain order: what you were told, what you did, and when the money left.

The bank window: what the RBI circular says

The RBI’s circular of 6 July 2017 on limiting the liability of customers in unauthorised electronic banking transactions applies to scheduled commercial banks, small finance banks and payments banks. Co-operative banks were covered by a separate circular. Here is what it says in plain terms.

• Zero liability if the fault lies with the bank, or if the fault lies elsewhere in the system and you tell the bank within three working days of receiving the bank’s message about the transaction.
• Four to seven working days: your liability is limited to the transaction value or a cap, whichever is lower. The cap is 5,000 rupees for basic savings accounts, 10,000 rupees for other savings accounts, prepaid instruments, MSME current accounts, individual current accounts with a small average balance and credit cards up to 5 lakh rupees, and 25,000 rupees for other current accounts and larger credit cards.
• Beyond seven working days, it depends on the bank’s board-approved policy, which the bank must display publicly.
• Within ten working days of your report the bank must credit the amount back to your account while it looks into the matter, and it has up to 90 days to settle the complaint.
• If you shared your payment credentials, such as an OTP or PIN, the circular treats it as customer negligence. You bear the whole loss until you report it, and the bank bears any loss after you report it.

That last point is the hard one. In many UPI scams the victim types the PIN or approves the request, so the transaction is not obviously unauthorised in the bank’s eyes. The three-day window does not promise your money back. It promises only that reporting late can make things worse and reporting at once can stop further loss. The count of working days follows your home branch’s schedule and leaves out the day you received the message. Ask your bank for its customer protection policy in writing. This circular is from 2017, so check for later changes on the RBI website.

If the bank does not resolve it

1. Complain to the bank in writing and keep proof. Ask the grievance redressal or nodal officer for a reply with dates.
2. If it is not settled in 30 days, or the reply does not satisfy you, you can take it to the RBI Ombudsman. The Reserve Bank Integrated Ombudsman Scheme, 2021 says a complaint can be filed if the bank has not replied within 30 days of receiving it, or within the time set under RBI or NPCI guidelines, whichever is later, or if you are not satisfied with the reply. Complaints go in online at cms.rbi.org.in. The scheme’s help line, 14448, is toll free. Its automated line works round the clock, and staff are available from 8 am to 10 pm, Monday to Saturday except national holidays. The Ombudsman will not act unless you have complained to the bank first.
3. For UPI itself, NPCI runs the UPI system and has a complaint route that opens after the app and the bank. We could not open NPCI’s page for this guide, so check npci.org.in for the current steps.
4. Keep your 1930 and cybercrime.gov.in complaint numbers. A police FIR may follow, depending on your state and the amount.

The scams that start most UPI fraud

• A collect request disguised as a refund or a prize. You never need to enter your UPI PIN to receive money. If a screen asks for the PIN, you are paying.
• Scan to receive. A QR code is for paying, not receiving. Nobody needs you to scan their QR to send you money.
• Fake customer care numbers from a search result, which lead to a remote access app.
• Remote access and KYC calls. A caller says your account will be blocked and asks you to install an app or share an OTP.
• Fake sellers and buyers on classifieds and marketplace apps, who send a payment request, not a payment.
• Digital arrest and fake investment groups, which we cover in separate guides.

For scams in the festival season, see our guide to online shopping and payment scams. For a caller who says you are under arrest, read what to do in a digital arrest call. For a message that looks like it is from a relative or a boss, read how to verify an urgent request for money. For fake trading apps, see WhatsApp stock-tip groups and fake trading apps. Our emergency numbers guide lists 1930 among the numbers to save.

The numbers behind the system

The government said in December 2025 that more than 7,000 crore rupees had been saved across more than 23 lakh complaints through the reporting system. That is the government’s own figure and we cannot check it. The Indian Cybercrime Coordination Centre’s page says complaints can be reported on the helpline 1930 or on the National Cybercrime Reporting Portal.

What we could not confirm

• The exact screens of cybercrime.gov.in. The portal did not open for us in a way we could read, so the steps follow the I4C’s own explainer and may change.
• Any official time limit for the so-called golden hour. Officials and news reports say the sooner the better. We found no official figure.
• Whether your complaint will lead to a refund. That depends on how fast the money is frozen and on your bank’s findings.
• NPCI’s current complaint steps, which we could not open.
• We found no public Instagram, Facebook or LinkedIn video we could open and match, so the videos below are from YouTube.

Do this today

Save 1930 on your phone and on the phones of your parents. Find the fraud reporting option in your bank’s official app and note where it is. Turn on SMS alerts for every account, because the RBI’s clock runs from the bank’s message. Tell one older relative that you never need a PIN to receive money. Checked 28 October 2026.