RBI Issues Special Guidelines to Recover Money Lost in UPI Frauds

Money can be wiped out from bank accounts in minutes through UPI frauds. Fraudsters posing as bank officials, fake customer-care numbers, deceptive payment requests, or screen-sharing applications are used to trick people and steal funds. However, according to a report by The Economic Times, falling victim to a UPI fraud does not mean the customer must bear all the losses. The Reserve Bank of India (RBI) has a framework that protects customers against unauthorised electronic banking transactions.

Under this RBI framework, customer liability may be zero in certain cases. This protection primarily depends on three factors: how the fraud occurred, whether the customer shared confidential details or authorised the transaction, and how quickly the bank was notified.

If the unauthorised transaction occurred due to the bank's negligence, fraud, or deficiency, the customer's liability remains zero regardless of when they report it. Similarly, if the security breach was caused by a third party and neither the bank nor the customer was at fault, the customer must report it within 3 working days of receiving notification from the bank. If reported within this timeframe, the customer's liability can be zero.

Rohit Mahajan, Founder and CEO of Plutos ONE, explains that it is the bank's responsibility to determine the customer's liability. According to RBI rules, in eligible cases, the bank should provide provisional credit within 10 working days and resolve the complaint within 90 days.

However, there is an important condition. If a fraudster poses as a bank representative to verify the account and the customer themselves enters the UPI PIN or approves a payment request, the bank may treat it as a 'customer-authorised' transaction. According to Mandar Patil, EVP of Cyble, when a customer knowingly enters the UPI PIN, shares an OTP, or approves a deceptive collection request, the bank may classify it as customer negligence.

According to the RBI framework, if the loss is due to customer negligence (such as sharing payment credentials), the customer must bear the loss until the bank is notified. However, any additional loss occurring after the report is made becomes the bank's responsibility. Mandar Patil further adds that this does not mean the bank can reject every claim. If the transaction occurred due to system failure, security flaws, or any other deficiency of the bank, the liability may change. Therefore, it is necessary to investigate the circumstances and evidence of every complaint.

Customers should remember a basic security rule: entering a UPI PIN is not required to receive money. The PIN is used only to debit money from your account. One should never enter a PIN to receive a refund, receive a payment, or verify if money has been deposited.

Under RBI's customer liability standards, reporting within 3 working days is extremely important. Prompt reporting of unauthorised transactions caused by third-party breaches generally reduces your liability to zero.