Can I recover money lost in a UPI fraud?

Yes, but the odds depend almost entirely on speed. If you report through the 1930 helpline or cybercrime.gov.in while the money is still moving between accounts, banks can freeze it in the chain and a court can later order its return. Once the fraudster withdraws the money as cash, recovery becomes far harder and shifts to criminal prosecution and civil remedies.

What is the time limit to report UPI fraud in India?

There is no statutory deadline, but the first few hours decide whether the money can be frozen inside the banking chain. Separately, the RBI's zero-liability protection for unauthorised transactions requires you to notify your bank within three working days of learning of the transaction. Reporting within four to seven working days caps your liability at Rs 10,000 for most savings accounts; beyond seven days, the bank's board-approved policy applies.

Is calling 1930 the same as filing an FIR?

No. The 1930 call registers a complaint on the Citizen Financial Cyber Frauds Reporting and Management System, which triggers the freeze mechanism but is not an FIR. An FIR under Section 173 BNSS (formerly Section 154 CrPC) is registered separately by the police, and you will usually need one for a full investigation and for the court to release frozen money back to you.

Does RBI zero liability apply if I transferred the money to the scammer myself?

No. The RBI circular of 6 July 2017 protects unauthorised transactions — debits you never approved. If a scammer deceived you into authorising a UPI payment with your own PIN, the transaction is treated as authorised, and your remedies are the 1930/NCRP freeze, the criminal case and a court application for refund, not the liability framework.

How long does the bank have to resolve a UPI fraud complaint?

For unauthorised electronic transactions, the RBI circular requires the bank to give shadow credit of the disputed amount within 10 working days of notification and to resolve the complaint within 90 days. If the bank rejects the claim or does not reply within 30 days, you can escalate to the RBI Ombudsman free of cost at cms.rbi.org.in.

What happens to my money if it gets frozen in the fraudster's account?

It stays on hold under Section 106 BNSS (formerly Section 102 CrPC) until a court deals with it. The victim can apply to the jurisdictional magistrate for release of the identified amount under Sections 497 to 505 BNSS (formerly Sections 451 to 459 CrPC), supported by the NCRP acknowledgment, the FIR and the bank trail. Magistrates can order refund of traceable amounts to victims on such applications.

UPI Fraud: From Complaint to Recovery — Every Remedy, in Order

If money has just left your account through a UPI fraud, call the national cyber fraud helpline 1930 or file a complaint at cybercrime.gov.in immediately — this is the only mechanism that can freeze the money while it is still inside the banking system. Then notify your bank in writing the same day, because the RBI’s limited-liability rules for unauthorised transactions run on a three-working-day clock. Everything after that — the FIR, the ombudsman, the court application for refund — builds on those first two steps. This article walks through every remedy, in the order it should be used.

What should I do in the first hour after a UPI fraud?

Fraud proceeds rarely sit still. They are pushed through a chain of mule accounts and wallets within hours, then withdrawn as cash or converted at an ATM. Practitioners and police call the reporting window the “golden hour” for a reason: a freeze only works on money that is still inside the system.

Do these five things, in this order:

Call 1930. The helpline runs 24×7. The operator records the transaction details and pushes the complaint into the Citizen Financial Cyber Frauds Reporting and Management System (CFCFRMS), which alerts the receiving bank or wallet.
File on the National Cyber Crime Reporting Portal (NCRP) at cybercrime.gov.in under the financial fraud category. Save the acknowledgment number — every later step, including the court application, will refer to it.
Write to your bank the same day. Email the fraud/dispute address and your home branch, describing the transaction and asking the bank to attempt recall and to note the date of your notification. This starts the RBI liability clock in your favour.
Preserve the evidence. Keep the 12-digit UPI transaction reference number, screenshots of the payment and chat, the fraudster’s UPI ID and phone number, and any SMS alerts. Do not delete the conversation.
Ignore “refund officers”. A common second-round scam is a call claiming to process your refund and asking for an OTP or a small “verification” payment. No bank, police unit or NPCI official asks for an OTP to return money.

How does the 1930 freeze-the-chain mechanism actually work?

The CFCFRMS, operated by the Indian Cyber Crime Coordination Centre (I4C) under the Ministry of Home Affairs, connects banks, wallets and payment intermediaries to one backend. When your complaint is registered, it travels along the money trail: the first beneficiary bank checks whether the amount is still in the account and, if so, places a hold or lien on it. If the money has already hopped to a second or third account, the alert follows it, and each bank in the chain marks a hold on whatever landed with it.

The frozen amount does not come back to you automatically. It stays on hold — typically under Section 106 BNSS (formerly Section 102 CrPC), the police power to seize property connected with an offence — until the investigation progresses and a court orders its release. What the golden-hour report achieves is preservation: it stops the money leaving the system, so that there is something left for a court to return.

The complaint is simultaneously escalated to the State police. In Kerala, financial fraud complaints from NCRP are routed to the district cyber police stations, and larger cases may be taken up by specialised units.

Will the bank refund me? The RBI limited-liability rules

For unauthorised transactions — debits you never approved — the RBI circular Customer Protection – Limiting Liability of Customers in Unauthorised Electronic Banking Transactions (RBI/2017-18/15, DBR.No.Leg.BC.78/09.07.005/2017-18, dated 6 July 2017) gives you enforceable rights against your own bank:

Zero liability if the fraud arose from the bank’s own contributory fraud, negligence or deficiency — regardless of when you report. Zero liability also applies to a third-party breach (neither you nor the bank at fault) if you notify the bank within three working days of learning of the transaction.
Limited liability if you notify a third-party breach within four to seven working days: your loss is capped at ₹5,000 for basic savings (BSBD) accounts, ₹10,000 for most savings accounts and prepaid instruments, and ₹25,000 for current accounts and higher-end products — or the transaction value, whichever is lower.
Beyond seven working days, your liability is decided by the bank’s board-approved policy, which the bank must publish.
Where the loss is due to your own negligence — such as sharing a PIN or OTP — you bear the loss until you report; losses after your report fall on the bank.
The bank must give shadow credit of the disputed amount within 10 working days of your notification and resolve the complaint within 90 days. The burden of proving that you are liable lies on the bank, not on you.

A parallel circular of 4 January 2019 (DPSS.CO.PD.No.1417/02.14.006/2018-19) extends the same framework to wallets and prepaid instruments issued by non-banks.

The critical distinction: if a scammer tricked you into approving a payment with your own UPI PIN, the transaction is authorised, and this framework does not apply. Your remedies then are the CFCFRMS freeze, the criminal case and a court application over the frozen money — which is why the golden-hour report matters most in exactly these cases.

How do I raise a dispute in the UPI app itself?

NPCI, which operates UPI under authorisation from the RBI under the Payment and Settlement Systems Act, 2007, runs an in-app dispute redressal mechanism (the Unified Dispute and Issue Resolution framework, UDIR). Open the transaction in your UPI app, select “raise dispute” or “report an issue”, and the complaint flows to the banks involved through automated channels; unresolved disputes escalate to NPCI. NPCI’s toll-free helpline is 1800-120-1740.

This route is most effective for failed or duplicated transactions and transfers to a wrong UPI ID. For fraud, treat it as a complement to — never a substitute for — the 1930/NCRP report and the written bank complaint.

Do I need an FIR, and which offences apply?

Yes, for anything beyond a trivial amount. The NCRP complaint triggers the freeze; the FIR drives the investigation, the chargesheet and, ultimately, the court’s power to return frozen money. Under Section 173 BNSS (formerly Section 154 CrPC), an FIR in a cognizable offence can now be registered at any police station irrespective of where the offence occurred — the “Zero FIR” is statutory — and information can even be given by electronic communication, to be signed within three days. Kerala has cyber police stations attached to each police district.

The offences that typically apply to a UPI fraud:

Provision	Offence	Punishment
Section 318(4) BNS (formerly Section 420 IPC)	Cheating and dishonestly inducing delivery of property	Up to 7 years and fine
Section 319(2) BNS (formerly Section 419 IPC)	Cheating by personation	Up to 5 years, or fine, or both
Section 66C, IT Act 2000	Identity theft — fraudulent use of another’s password or unique identification	Up to 3 years and fine up to ₹1 lakh
Section 66D, IT Act 2000	Cheating by personation using a computer resource	Up to 3 years and fine up to ₹1 lakh

A fuller treatment of the IT Act offences is in IT Act offences explained.

What if the bank stalls or rejects the claim? The RBI Ombudsman

If the bank rejects your unauthorised-transaction claim, misses the 90-day deadline, or simply does not respond, the Reserve Bank – Integrated Ombudsman Scheme, 2021 (RB-IOS) is the escalation route. The sequence matters:

First complain in writing to the bank and keep proof of the date.
Wait 30 days. If the bank rejects the complaint, gives an unsatisfactory reply, or stays silent for 30 days, the ombudsman complaint becomes maintainable.
File online at cms.rbi.org.in — free of cost, no lawyer required — within one year of the bank’s reply (or within one year and 30 days of your complaint if the bank never replied).

The Ombudsman can award the actual loss caused by the deficiency in service up to ₹20 lakh, plus up to ₹1 lakh for loss of time, expenses and mental anguish. In UPI fraud matters, the ombudsman route works best where the dispute is really with the bank — a genuinely unauthorised debit, a missed shadow-credit deadline, a failure to act on your golden-hour report.

What can courts do — and how do I get frozen money released?

Once CFCFRMS or the police freeze money in a beneficiary account, the path back to the victim runs through the jurisdictional criminal court:

Application for release of property. Under Sections 497 to 505 BNSS (formerly Sections 451 to 459 CrPC), the magistrate dealing with the case can order interim custody or release of seized property — including a specific frozen amount traceable to your transaction. The application is supported by the NCRP acknowledgment, the FIR, your bank statement and the beneficiary bank’s confirmation of the hold.
Attachment and restitution. Section 107 BNSS is a new provision with no CrPC equivalent: on a police application, the court can attach property identified as proceeds of crime and, after a show-cause process, order its distribution to the persons affected — through the District Magistrate, within 60 days. It is an emerging but promising restitution route in multi-victim UPI frauds.
Consumer commission. Where the loss flows from the bank’s deficiency in service — for example, ignoring your timely report — a complaint lies before the District Consumer Commission (pecuniary jurisdiction up to ₹50 lakh) under the Consumer Protection Act, 2019. See the civil and consumer practice overview.
Civil suit against identified beneficiaries for recovery of money, realistic only where the fraudster or account holder is traceable and has assets.

In practice, the single most common bottleneck is not the law but the paper trail: victims who kept their NCRP acknowledgment, wrote to the bank on day one and obtained the FIR find the release application straightforward; those who only called 1930 and stopped there do not.

Which remedy does what? The full map

Remedy	Where	Realistic timeline	What it can achieve
1930 / NCRP complaint	Phone / cybercrime.gov.in	Hours (freeze), weeks (police action)	Freezes money still in the banking chain; starts the police process
Bank complaint (RBI framework)	Your bank, in writing	10 working days shadow credit; 90 days resolution	Full refund of unauthorised transactions if reported in time
UPI app dispute (UDIR)	In-app / NPCI 1800-120-1740	Days	Reversal of failed, duplicated or wrong-recipient transactions
FIR	Any police station (Zero FIR) / cyber police station	Months	Investigation, arrest, chargesheet; foundation for court release of funds
RBI Ombudsman (RB-IOS 2021)	cms.rbi.org.in	Months	Award up to ₹20 lakh + ₹1 lakh against the bank for deficiency
Magistrate application (ss.497–505 BNSS)	Jurisdictional criminal court	Months	Release of frozen, traceable amounts back to the victim
Consumer commission / civil suit	District Commission / civil court	1–3 years	Compensation from the bank; recovery from identified beneficiaries

What are the realistic chances of recovery?

Honest expectations, by scenario:

Reported within hours, money still in the chain. The best case. Holds are commonly secured on part or all of the amount; the fight then shifts to the magistrate application for release, which takes months but has a defined path.
Unauthorised transaction, reported within three working days. Strong position even if the fraudster is never caught, because the refund right under the RBI circular runs against your own bank, with the burden of proof on the bank.
Authorised-but-induced payment, reported late. The hardest case. Money withdrawn as cash or converted through layered mule accounts is usually beyond the freeze mechanism; recovery then depends on the criminal case, Section 107 BNSS attachment, or a civil claim against traceable beneficiaries.

No remedy guarantees recovery, and anyone who promises otherwise should be treated with suspicion. Speed of reporting is the one variable fully in the victim’s control, and it dominates every other factor.

What if I unknowingly received fraud money?

The other side of the freeze mechanism: if a fraudster routed tainted money through your account — a marketplace sale, a “work-from-home” payout, a stranger’s “wrong transfer” you returned — your account may be frozen or lien-marked in a cyber case registered far from Kerala. That does not make you an accused, but it does require a considered response: identifying the freezing authority, replying to notices with your own paper trail, and moving the jurisdictional court or the High Court where the freeze is disproportionate. That situation has its own detailed guide: bank account frozen by a cyber cell — what to do, and the broader practice context is at cyber crime practice.