UPI Fraud: Who Pays — You or Your Bank?

Q: My bank says the fraud was 'customer negligence' and closed the case. What can I do?

Ask for the closure in writing, with the specific ground. 'Negligence' has a narrow meaning in this framework — it is about sharing payment credentials — and banks sometimes use it loosely for cases that actually sit in the table. If credentials were not shared, the written reply forces the bank to either apply the circular properly or commit its reasoning to paper, and that paper is what the nodal officer and then the RBI Ombudsman review. Complaints to the Ombudsman through cms.rbi.org.in are free and can be filed once the bank has rejected the complaint or left it unresolved for 30 days. Customers reach the Ombudsman far less often than they are entitled to; a written rejection is a door, not a wall.

The short answer: in India, who bears a UPI fraud loss is fixed by the Reserve Bank of India — not by your branch's mood. Report an unauthorised transaction within 3 working days of the bank's message and your liability is zero. Report on days 4–7 and your share is capped between ₹5,000 and ₹25,000 depending on the account. Report later and your bank's own policy decides. The exception is shared credentials: if a PIN or OTP was given away, the loss generally rests with you until you report it — which makes reporting immediately the most valuable move in every version of this story. The UPI Fraud Liability Checker counts your exact dates against this table.

Why this matters now

UPI is the world's busiest retail payment rail, and its fraud numbers have grown with it: 10.64 lakh UPI fraud cases, with ₹805 crore in losses, were reported in just the first eight months of FY26 (industry-reported figures). Behind that volume sits an unusual fact most victims never learn: India is one of the few countries where the answer to "who pays?" was written down in advance, in a public table, by the central bank. The bank deciding your case is not improvising — it is applying (or failing to apply) the Reserve Bank's circular of 6 July 2017, "Customer Protection — Limiting Liability of Customers in Unauthorised Electronic Banking Transactions". Knowing the table changes the conversation from pleading to checking.

The RBI table

Where a loss comes from a third-party breach — neither the bank's deficiency nor the customer's credential-sharing — liability follows the speed of your report, counted in working days from the date the bank communicated the transaction (its SMS, email or statement entry):

Within 3 working days — zero liability. The bank bears the entire amount. There is no percentage, no "goodwill", no negotiation: the table says zero.
Within 4–7 working days — capped liability. Your maximum share is ₹5,000 for Basic Savings Bank Deposit (BSBD) and other basic accounts; ₹10,000 for regular savings accounts and most other accounts, prepaid instruments and gift cards; ₹25,000 for current accounts and cards with high or pre-approved limits. Some current accounts and cards with limits up to ₹5 lakh fall in the ₹10,000 band — the bank applies the table to your exact account, so make it say, in writing, which band it used and why.
Beyond 7 working days — bank policy. The circular hands the decision to the bank's board-approved policy. Weaker ground — but the bank must still follow its own published policy, and asking it to cite the clause it relied on is a legitimate, often revealing, request.

One more cell of the table matters: where the loss is the bank's own deficiency, liability is zero regardless of when you report. If the bank's alert reached you days late, that fact belongs in your complaint in the first paragraph.

Working days, counted honestly

The circular counts in the bank's working days, and no two banks' holiday calendars are identical — they vary by state, by festival calendar, by bank. Any online checker, including ours, is therefore estimating. The checker on this site counts Monday to Saturday as working days and skips Sundays only, and prints that approximation on every result rather than dressing an estimate up as a legal deadline. The practical lesson cuts through the arithmetic anyway: windows measured in single-digit days are not survived by people who wait to see what happens. If you take one behaviour from this page, take reporting on the day you see the transaction — the band boundaries then stop mattering to you.

If a PIN or OTP was shared

The hardest cases are the commonest ones: a caller posing as the bank, a "KYC update", a refund that supposedly needed an OTP to arrive. Under the RBI framework, where the customer has shared payment credentials, the customer bears the loss until the sharing is reported to the bank — after that report, further losses are the bank's. Being tricked feels nothing like being careless, and the framework's wording can feel harsh; but notice what it does not say. It does not say "nothing can be done". The report still stops the bleeding, still starts the written record, and still anchors an Ombudsman complaint in which exactly how the trick worked can be laid out. It also leaves room for the bank's own failures — a transaction pattern its systems should have caught, alerts it sent late — which belong in the complaint alongside the confession. Share the facts plainly; the confession is not the end of the case.

After you report: two dates the bank owes you

Whichever band you are in, the circular gives your bank homework with deadlines. First, a shadow reversal: the bank must credit the disputed amount to your account within 10 working days of your report, while it investigates. Second, a resolution within 90 days of the complaint. Diarise both dates the day you report (the checker computes them from your dates). A bank that misses the shadow-reversal date has handed you the strongest sentence in your escalation letter — its own regulator's deadline, missed, in writing.

The escalation ladder

The bank, in writing, with a complaint number. Report through the app, the official website or a branch — and never leave without the reference number. Verbal reports without numbers evaporate.
The bank's nodal officer. Named on the bank's grievance page; quote the complaint number, the dates, the band you believe applies, and any deadline already missed.
The RBI Ombudsman. If 30 days pass without resolution — or the bank rejects the complaint at any point — file free of charge through the Reserve Bank's Complaint Management System at cms.rbi.org.in. Our guide to the RBI escalation path after a rejected chargeback walks this ladder rung by rung, including what to attach.

The 2027 change

This framework is not permanent, and honest pages should say so. The Reserve Bank issued amendment directions on 24 June 2026 that widen customer protection with effect from 1 January 2027. The checker and this guide apply the 2017 table because it is the framework in force on the day they were written — the table your bank is deciding under right now. If your case falls after the change takes effect, the current position is the bank's and the RBI's to state, and the widened protection should improve, not worsen, your band. Do not let anyone apply a superseded table to you in either direction.

FAQ

My bank says the fraud was "customer negligence" and closed the case. What can I do?

Ask for the closure in writing, with the specific ground. "Negligence" has a narrow meaning in this framework — it is about sharing payment credentials — and banks sometimes use it loosely for cases that actually sit in the table. If credentials were not shared, the written reply forces the bank to either apply the circular properly or commit its reasoning to paper, and that paper is what the nodal officer and then the RBI Ombudsman review. Complaints to the Ombudsman through cms.rbi.org.in are free and can be filed once the bank has rejected the complaint or left it unresolved for 30 days. Customers reach the Ombudsman far less often than they are entitled to; a written rejection is a door, not a wall.

Does the same table apply to debit cards and net banking, or only UPI?

The circular covers unauthorised electronic banking transactions generally — UPI, cards, net banking, mobile banking, prepaid instruments — with the same reporting-speed structure. This guide and the checker are written for UPI because that is where the volume is, but the zero/capped/policy bands and the account-type caps come from the shared table, and the escalation ladder is identical. Where a card network's own chargeback rules also apply (a card transaction disputed through Visa or Mastercard), the two routes can run in parallel; the RBI table decides what your bank may leave with you in the meantime.

The fraud amount is small. Is the Ombudsman still worth it?

That is a judgement about your time, and this guide won't pretend otherwise. The mechanics are free and online: if the bank missed its own deadlines or misapplied the table, the Ombudsman route costs you a form, not a fee. Small cases also have a second value — banks track Ombudsman complaints, and patterns of small misapplied cases are how branch-level habits get corrected. But if the amount is small and the bank applied the table correctly, the honest answer is that the remaining routes will likely confirm the same split, and your energy may be better spent on the account's security: new PIN, fresh credentials, transaction limits set the way you actually live.