UPI Fraud: Money Gone From Bank Account, What Should I Do First?

The First 30 Minutes Decide Almost Everything

It is 9:47 PM. You are sitting on the sofa scrolling your phone when an SMS lands: "Rs. 48,000 debited from a/c xx4321 to VPA rajeshkumar@oksbi". You did not send any money. Your hands start shaking. You open the UPI app — the transaction is real. Then a second SMS: "Rs. 22,000 debited". Your salary is gone. Your child's school fee is gone. The fraudster called you twenty minutes ago pretending to be from "KYC update", and somewhere in that chaos you read out an OTP, or tapped a link, or clicked "approve" on a request you thought was your own.

This article is for that moment. Not a textbook on cyber law — a practical roadmap of what to do tonight, what to do tomorrow morning, and which laws will protect you. Most of all, it is a reminder that you are not the first person this has happened to and you are not alone.

What Is the Golden Hour and Why Does It Matter?

In every UPI fraud, there is a short early window — often described in policing and banking circles as the "golden hour" — when the money sent to the fraudster's account has not yet been withdrawn at an ATM or layered through three more accounts. If you can get a complaint into the system in that window, banks and the National Payments Corporation of India can flag the receiving account, freeze the balance and pull the money back.

This is why every minute matters. The faster the report, the higher the chance of a real refund — not after a year-long police investigation, but within days through bank-to-bank reversal. The two channels designed for this speed are the national cyber helpline 1930 and the National Cyber Crime Reporting Portal cybercrime.gov.in. Both feed into the same backend system.

Which Laws Apply When UPI Money Is Stolen?

UPI fraud is not a single offence — it is a bundle of offences. The investigating officer typically registers one FIR but cites multiple sections.

Sections 43 and 66 of the IT Act — the foundation

Section 43 of the Information Technology Act, 2000 (the law that governs computers and digital data in India) creates civil liability for unauthorised access to a computer or computer system, downloading data, introducing a virus, or causing damage. The commentary explains that Section 43 "covers everybody" — individuals, banks, payment companies. When somebody dishonestly or fraudulently does any of those Section 43 acts, Section 66 turns it into a criminal offence with imprisonment up to three years or a fine up to five lakh rupees, or both.

"If any person, dishonestly or fraudulently, does any act referred to in section 43, he shall be punishable with imprisonment for a term which may extend to three years or with fine which may extend to five lakh rupees or with both." — Section 66, IT Act

Section 66C — identity theft

Section 66C punishes the fraudulent or dishonest use of someone's electronic signature, password or "any other unique identification feature" of any person. Punishment is imprisonment up to three years and fine up to one lakh rupees. The commentary highlights that the words "any other unique identification feature" are deliberately broad and futuristic — they cover UPI PINs, MPINs, biometric data and any other credential that uniquely identifies a person on a computer or communication device. When the fraudster uses your OTP or UPI PIN to authorise a debit, that is identity theft under Section 66C.

Section 66D — cheating by personation using a computer

Section 66D punishes "cheating by personation" using any communication device or computer resource. If the caller pretends to be from your bank, from "the RBI", from a courier company, from a relative — and uses that pretence to extract money or credentials — Section 66D applies. The commentary points out that 66D imports the IPC concept of "cheating by personation" (Section 416 IPC) and applies it specifically to the digital world. Punishment again is imprisonment up to three years and fine up to one lakh rupees.

Sections 415 and 420 IPC — the cheating layer

Section 415 of the Indian Penal Code defines cheating: deception of any person, dishonest inducement to deliver property, with damage or harm. Section 420 punishes cheating where property is dishonestly delivered, with imprisonment up to seven years and fine. Indian courts have consistently held that for a Section 420 case to stick, there must be fraudulent or dishonest intention at the very inception — the moment the deception begins. As the Supreme Court explained in Hridaya Ranjan Pd. Verma v State of Bihar (2000), mere breach of contract is not cheating; the dishonest intent must exist when the inducement starts. In a UPI scam, that intent is obvious — the fraudster set up the call to deceive you from the first second.

How Do I Use 1930 and the Cyber Portal?

Within the first hour, do these three things in sequence:

1. Call your bank's 24×7 fraud-helpline number printed on the back of your debit card. Ask them to (a) freeze the account or block UPI, (b) raise a chargeback / transaction dispute, and (c) record the complaint number.
2. Call 1930 — the national cyber-fraud helpline. The operator opens an "acknowledgement number" and routes details to your bank, the receiving bank and law enforcement.
3. File on cybercrime.gov.in — choose "Report Financial Fraud", enter your bank details, transaction reference numbers, the fraudster's UPI ID / mobile number, and upload SMS screenshots and statements.

Keep every reference number — bank ticket number, 1930 acknowledgement number, portal complaint ID. They are your paper trail.

Filing the FIR — and What If the Police Refuse?

Calling 1930 is not a substitute for an FIR. The FIR is the formal document under Section 173 of the Bharatiya Nagarik Suraksha Sanhita, 2023 (the new code that replaced Section 154 of the old Code of Criminal Procedure). The commentary on FIR procedure makes the point clearly — the FIR is the foundation of the investigation, the document on which the police's powers under the criminal procedure are activated.

Go to your local police station, or your city's cyber police station, with: bank statement, SMS screenshots, the 1930 acknowledgement number, the cybercrime.gov.in complaint ID, your ID proof and a one-page written statement. Ask for an FIR under Sections 66C, 66D of the IT Act and Section 420 IPC. If the matter has any tinge of forged screenshots or fake KYC papers, also ask for Sections 467, 468 and 471 IPC (forgery and use of forged documents).

If the FIR is refused — which still happens — the law gives you a layered remedy:

1. Step up to the SP/SSP: a written complaint by registered post under Section 173(4) BNSS (corresponding to Section 154(3) CrPC).
2. Move the magistrate: a complaint under Section 175(3) BNSS (corresponding to Section 156(3) CrPC) asking the Judicial Magistrate to direct the police to register and investigate. The Supreme Court in Sakiri Vasu v State of Uttar Pradesh (2008) held that this is the appropriate remedy when the police do not act on a citizen's complaint.
3. Private complaint: a complaint to the Magistrate under Section 200 of the CrPC / corresponding BNSS provision, with sworn statements, where the Magistrate may take cognizance directly.

Where the harassment overlaps with broader cyber crime under criminal law, the cyber police station has both jurisdiction and specialised tools to extract logs from banks, telecom operators and the payment system.

Will the Bank Refund My Money?

This is the question that haunts every victim. The Reserve Bank of India's customer-protection circular on unauthorised electronic banking transactions (issued in 2017 and updated since) divides the world into three buckets:

• Zero customer liability — where the loss is due to the bank's contributory fraud, negligence or deficiency. The bank must refund regardless of whether you reported.
• Limited customer liability — where a third party caused the breach and the customer reports promptly. The customer's loss is capped at small statutory amounts based on account type, provided notification is within the prescribed days.
• Customer's own negligence — where the customer shared credentials or PINs. The customer bears the loss until the bank is informed. Once reported, further loss shifts to the bank.

The earlier you report, the better you sit on this ladder. Banks now publish a complaint-acknowledgement form for unauthorised transactions; insist on a written acknowledgement of the date and time of your first complaint, because that is what fixes liability.

Evidence You Must Preserve Today

Cyber fraud investigations live and die on digital evidence. Save and back up the following in their original form, do not edit:

• Every SMS alert from the bank, with the timestamp.
• The fraudster's mobile number, UPI ID, WhatsApp profile, the exact words they used.
• Call logs of the day — incoming and outgoing.
• Any link sent — copy the full URL before deleting.
• UPI app transaction history with reference numbers (RRN / UTR).
• Bank statement (last seven days as PDF).
• Screenshots of any "KYC", "courier", "loan offer", "police", "customs" message that triggered the fraud.

If a police officer asks for your phone, give an extracted copy and a hash value where possible — never hand over the only copy.

What Should I Actually Do Now?

If you are reading this in panic, here is the exact order:

1. Stop talking to the fraudster. Hang up. Block the number after noting it. Do not "verify" anything else.
2. Call your bank's 24×7 number on the back of your card. Freeze UPI and the card. Get a complaint number in writing.
3. Call 1930. Stay on the line. Note the acknowledgement number.
4. File at cybercrime.gov.in. Use the same details. Upload screenshots.
5. Within 24 hours, write to the bank by email and registered post describing the unauthorised transaction. Quote the RBI circular on customer liability. Demand reversal.
6. Visit the cyber police station within 48 hours with all evidence and lodge an FIR under Sections 66C, 66D IT Act and 420 IPC.
7. If the FIR is refused, escalate to the SP/SSP under Section 173(4) BNSS, then to the Magistrate under Section 175(3) BNSS.
8. If your bank refuses to refund after thirty days, escalate to the Internal Ombudsman, then the RBI Banking Ombudsman, and consider a complaint to the District Consumer Commission for banking deficiency in service.
9. Change every password — UPI PIN, net-banking, email, SIM PIN. Enable two-factor authentication everywhere.
10. Pull your CIBIL report two weeks later to check that no fraudulent loan or card has been issued in your name.

When Calling a Lawyer Actually Helps

For small UPI frauds caught early, the 1930-and-FIR path is enough. Where the amount is significant, where the FIR is being stalled, where the bank is refusing in writing, or where the fraud has spilled into a fake loan or a forged identity, that is when professional help saves you weeks. At Pinaka Legal we have walked clients through this exact sequence — written escalations to the bank, a Section 175(3) BNSS complaint to the Magistrate, and a parallel consumer-forum claim — and recovered amounts that the victim had given up on. If you are stuck, a single one-hour consultation often unlocks the next door.

A Calmer Path Forward

UPI fraud preys on speed and shame — the speed of a panic call that pushes you to share an OTP, and the shame of telling family that the salary is gone. Both fade once you start the formal process. The law gives you Sections 66C and 66D of the IT Act, Section 420 of the IPC, an RBI customer-protection framework, an FIR right backed by Section 175(3) BNSS, and a Banking Ombudsman. Used together, these are not a guarantee — but they are far more than most victims realise on the worst night of the week. Tomorrow morning, work the list. Today, stop the bleeding. The next call you make should be to your bank.

Frequently Asked Questions

What should I do first if money is gone from my bank account through UPI fraud?

Treat it as a race against time. Within minutes, call your bank to freeze the account and stop further debits, then call the national cyber helpline 1930 and file a complaint at cybercrime.gov.in. The reason this matters is the "golden hour" — a window of roughly the first few hours when banks and the payment system can still flag and reverse a transfer before the money is withdrawn or layered. After this, lodge an FIR at your local police station or online cyber portal citing Section 66C, 66D of the IT Act and Section 420 IPC.

Can I get my money back if I sent the UPI payment myself after a fraud call?

It depends on how quickly you report and on the bank's response under the RBI customer-protection framework. If a third-party fraudster tricked you and you report within the time limits laid down by the RBI customer-liability circular, banks are expected to limit your loss. If you delay or share OTPs and PINs carelessly, the bank may treat the loss as your own negligence. The earlier you report, the stronger the case to recover funds through chargeback, transaction reversal or legal action.

Which sections will the police use in an FIR for UPI fraud?

For a typical UPI fraud, the police register an FIR primarily under Section 66C of the Information Technology Act for misuse of unique identification features such as your UPI PIN, OTP or password, and Section 66D for cheating by personation using a computer resource or communication device. Because the fraudster also induced you to part with money by deception, Section 420 of the Indian Penal Code (cheating) is added. Where forged documents or screenshots are used, Sections 467, 468 and 471 IPC may also apply.

What is the "golden hour" in UPI fraud?

The "golden hour" is the early window after a fraud transaction when banks, the National Payments Corporation of India (NPCI) and law-enforcement agencies can still trace and freeze the money in the receiving account before it is withdrawn or moved further. It is not a single statutory period, but the RBI cyber-fraud framework and the 1930 helpline are designed around fast reporting. Practically, every minute matters; complaints lodged within the first few hours have a much higher chance of recovering money.

The police are refusing to register my FIR. What can I do?

You have two layers of remedy. First, send a written complaint by registered post to the Senior Superintendent of Police of the district under Section 173(4) of the Bharatiya Nagarik Suraksha Sanhita (which corresponds to Section 154(3) CrPC), demanding that the FIR be registered. If the police still do not act, file a complaint to the Judicial Magistrate under Section 175(3) BNSS / Section 156(3) CrPC asking for an order to register and investigate. The Supreme Court in Sakiri Vasu v. State of UP (2008) confirmed this layered remedy, and you can use it for cyber-fraud cases too.

Will I lose my money if I just shared a screenshot or call recording of the fraudster?

No, sharing screenshots and call recordings does not by itself cost you money. In fact, those screenshots, SMS alerts, call logs and email confirmations are exactly the evidence the cybercrime cell needs. Save them in their original form, do not edit them, and back them up to email or cloud storage. Note timestamps. Bring printouts to the police station along with your bank statement. A clear evidence trail dramatically improves the chance of tracing the receiving account and recovering money.

Can I file a UPI fraud complaint online without going to a police station?

Yes. The National Cyber Crime Reporting Portal at cybercrime.gov.in accepts online complaints for financial cyber fraud. Many states also accept e-FIRs for low-value online cheating. Call 1930 first; the operator opens a complaint number and routes it to your bank and the receiving bank. For higher amounts and proper investigation, follow up with a written FIR at the cyber police station. Online and offline complaints are not alternatives — use both, since the FIR is what triggers a formal investigation under Section 173 BNSS.

What is the difference between Section 66C and Section 66D of the IT Act?

Section 66C punishes "identity theft" — the fraudulent or dishonest use of someone's electronic signature, password or any other unique identification feature. Section 66D punishes "cheating by personation" using a computer resource or communication device — when the fraudster pretends to be someone else (a bank officer, a relative, a courier agent) to cheat you. UPI scams typically attract both: the criminal misuses your UPI credentials (66C) and pretends to be a trusted entity to extract them (66D). Each carries imprisonment up to three years and a fine.

Do I need a lawyer to file a UPI fraud complaint?

You do not strictly need a lawyer to call 1930, file at cybercrime.gov.in, or lodge an FIR. But once the amount is significant or the police are slow, a lawyer helps in three ways: drafting a precise legal notice to the bank quoting the RBI customer-liability circular, moving the magistrate under Section 175(3) BNSS if the FIR is refused, and filing a consumer-forum claim against the bank for deficiency in service. For high-value fraud, early legal advice protects evidence and timelines.

How long does it take to recover money from UPI fraud?

It varies. Where the receiving account is frozen during the golden hour, partial or full recovery may happen within days through bank-to-bank reversal. Where the money has already been withdrawn or layered through mule accounts, recovery depends on the police investigation under Section 173 BNSS, attachment of assets, and eventual restoration through court orders. Realistically, plan for a process of weeks to months, and run the bank-side claim under the RBI framework in parallel with the criminal complaint.

Can the bank refuse to refund saying it was "my" transaction?

It depends on whether the loss happened due to your negligence or due to a third-party breach. The RBI customer-protection framework distinguishes between three situations: bank's contributory fraud (zero customer liability), third-party breach where the customer reports promptly (limited liability), and customer's own negligence (full liability until reported). If the bank refuses, ask for a written reason, escalate to the bank's Internal Ombudsman, then approach the RBI Banking Ombudsman or the District Consumer Commission for deficiency in service.

What if the fraudster has already withdrawn the money in cash?

Recovery becomes harder but is not impossible. The receiving bank account, the ATM CCTV, the mobile-tower data of the SIM used and the device IDs all leave a trail. The investigating officer can seek bank statements, KYC documents and CCTV footage under Section 94 BNSS (production of documents). Trace and arrest of the accused, followed by recovery from their other accounts or assets, becomes the route. This is exactly why the FIR — and a serious one with proper sections — must be filed even when money is gone.

For more articles on Indian law, visit the Pinaka Legal Blog. For queries, call +91 8595704798 or email info@pinakalegal.com.