I was scammed on UPI. Can I get my money back?

Do three things in parallel, within minutes:

(1) Call 1930 — the Citizen Financial Cyber Fraud Reporting Helpline. The complaint is routed to your bank, the beneficiary bank, and the payment platform (NPCI) to freeze the funds before they can be withdrawn;
(2) File an online complaint on the National Cyber Crime Reporting Portal with the transaction ID, UPI reference number, amount, and screenshots of the fraudulent request;
(3) Notify your bank by calling the customer-care helpline, AND by sending a written complaint via email — the email creates documentary proof of reporting time.

Block your UPI ID and any linked cards on your banking app as a precaution. If the fraudster has access to your phone or apps, also change your banking passwords immediately.

The 'Golden Hour' refers to the first 1-2 hours after a cyber fraud, when funds are most likely still in the beneficiary's account and can be frozen before withdrawal or transfer to a mule account. Practically:

(1) Within minutes — call 1930. Quick reporting allows NPCI and banks to put a debit-freeze on the beneficiary account, halting further movement;
(2) Within 24 hours — file the cybercrime portal complaint with transaction details. This formalises the cyber cell's investigation;
(3) Within 72 hours (3 working days) — report to your bank in writing. This is the critical deadline for the RBI's 'zero liability' protection (see next section);
(4) Within 7 working days — last window for 'limited liability'.

The longer you wait, the harder recovery becomes. Money frozen within the Golden Hour is much more likely to be returned.

The RBI Master Direction dated 6 July 2017 sets a clear liability framework:

(1) Zero customer liability when:
- The fraud is due to a deficiency on the bank's side, regardless of when you report;
- The fraud is due to a third-party breach (phishing, SIM swap, malware) and you report within 3 working days.

(2) Limited liability — ₹5,000 to ₹25,000 when:
- You report within 4 to 7 working days of receiving the bank's transaction alert;
- The exact cap depends on account type (₹5,000 for basic savings; ₹10,000 for regular savings; ₹25,000 for current accounts).

(3) Full customer liability when:
- You report after 7 working days;
- OR the fraud is due to your own negligence — sharing OTP/PIN/CVV, writing PIN on the card.

Bottom line: report fast, in writing, and the bank must reimburse.

Once you report within the eligible window, the bank must:

(1) Provisionally credit the disputed amount to your account within 10 working days, irrespective of whether the investigation is complete;
(2) Complete the investigation and confirm or reverse the credit within 90 days;
(3) If the bank fails to credit within 10 days, you can file a complaint at the RBI Integrated Ombudsman for the delay itself.

If the bank rejects your claim citing customer negligence, demand the rejection in writing with reasons. The 90-day deadline is binding even on rejection — you cannot be left in limbo.

For PPI (wallet) frauds, the same framework applies under the RBI PPI circular dated 4 January 2019.

Escalate in this sequence:

(1) Internal complaint — write to the bank's Principal Nodal Officer (contact published on every bank's website). Wait 30 days for response;
(2) RBI Integrated Ombudsman — file at cms.rbi.org.in. The Ombudsman can direct refund up to ₹20 lakh and compensation up to ₹1 lakh for mental agony. Procedure is free and online;
(3) Consumer Commission — for amounts up to ₹50 lakh, file via E-Daakhil under the Consumer Protection Act, 2019 (see our consumer complaint guide);
(4) Writ petition in the High Court for systemic non-compliance with RBI directions;
(5) Consumer/cyber lawyer — for large amounts or sustained denial, engage a reputable, specialised banking/cyber-law lawyer to coordinate parallel remedies.

For related SIM-swap or KYC-breach situations, see our SIM swap guide.