UPI Fraud Refund in India: What the RBI Says About Your Liability

You received a call from someone claiming to be your bank. They said your account was at risk and you needed to share an OTP to "verify" your identity. Minutes later, ₹45,000 was gone. When you called the bank back, they told you the transaction was "OTP authenticated" — meaning you authorised it — and refused a refund.

This is one of the most common UPI fraud patterns in India. Banks routinely hide behind OTP authentication as proof of consent. But RBI guidelines draw a clear line between authentication and informed consent — especially when the OTP was obtained through deception.

The RBI Liability Framework

The RBI's Master Direction on Limiting Liability of Customers in Unauthorised Electronic Banking Transactions sets out when you bear zero, limited, or full liability for fraudulent debits. The key factors are:

• How quickly you reported — reporting within 3 working days typically limits your liability to zero for third-party fraud
• Whether you were negligent — the bank must prove actual negligence, not assume it from OTP use alone
• The nature of the fraud — social engineering and phishing are treated differently from wilful sharing of credentials for a known transaction

RBI Master Direction — Customer Liability

OTP Authentication Is Not Consent Under Deception

Banks love the argument: "An OTP was used, therefore you authorised the payment." This conflates two separate legal concepts.

Authentication confirms that someone with access to your device entered a code. Consent means you knowingly agreed to a specific transaction with full understanding of what you were approving. When a fraudster impersonates your bank and tricks you into entering an OTP under false pretences, you did not give informed consent — you were deceived.

The RBI framework requires banks to investigate the circumstances before assigning liability. A blanket "OTP = authorised" response without examining how the OTP was obtained is not compliant.

What to Do Immediately

1. Call your bank's fraud helpline — most banks have a 24/7 number. Report the transaction and ask for a written reference number. Do this within hours, not days.
2. File a written complaint — email or submit through the bank's portal citing the "RBI Master Direction on Limiting Liability of Customers in Unauthorised Electronic Banking Transactions." State explicitly that the OTP was obtained through social engineering, not wilful negligence.
3. Block your UPI ID and card — request immediate suspension of further debits while the dispute is open.
4. File a cybercrime complaint — at cybercrime.gov.in or your local cyber cell. This creates an official record of the fraud.
5. Escalate to the RBI Ombudsman — if the bank does not resolve within 30 days, file for free at cms.rbi.org.in.

What to Write in Your Complaint

Use language the bank cannot easily dismiss:

"The OTP was obtained through social engineering by a third party impersonating [Bank Name]. This does not constitute customer negligence under the RBI's liability framework. I reported the fraud within [X hours]. I request immediate reversal of transaction [ID] and confirmation in writing."

Include the timeline: when the call happened, when the debit occurred, when you reported it, and any screenshots or call logs you have.

Frequently Asked Questions

Related Guides

• Practice this case in Fix AI →
• Loan App Harassment: What the RBI Says and What You Can Do
• How to Dispute a Denied Refund — EU, UK, US, India
• 🇮🇳 India Consumer Rights — Full Guide