By S&S Co. Advocates & Solicitors · Published 22 September 2026 · Informational content, not legal advice: see our disclaimer
The Zero and Limited Liability Framework
The Reserve Bank of India's July 2017 circular on customer protection in unauthorised electronic banking transactions sets out a graded liability framework: a customer bears zero liability where the unauthorised transaction results from the bank's own system deficiency or a third-party breach for which neither the bank nor the customer is at fault, provided the customer reports it promptly; limited liability, capped at a modest fixed amount, applies where there is a delay in reporting after the customer becomes aware of the transaction; and the customer bears full liability only where the loss is due to the customer's own negligence, such as knowingly sharing payment credentials for personal gain.
How This Applies to UPI Fraud
This framework applies to UPI transactions just as it does to card and net-banking transactions. A recurring point of dispute is that many UPI frauds involve the victim personally entering their own UPI PIN to 'approve' a transaction, but often because they were deceived, through phishing calls, fake customer-support numbers, or fraudulent QR codes, into believing they were doing something else entirely, such as receiving money or completing a KYC update, rather than knowingly authorising a payment to a fraudster.
Negligence vs Social-Engineering Fraud
Courts and the RBI Ombudsman framework have increasingly recognised that entering a PIN or OTP under active deception is not the same as the kind of negligence, such as voluntarily sharing one's PIN with another person for their use, that the RBI framework treats as disqualifying a customer from zero or limited liability protection. Banks' internal grievance processes are expected to examine how the fraud actually occurred, not simply whether the transaction was technically authenticated by the customer's own credentials.
How to Report and Escalate a UPI Fraud Complaint
A victim should report the unauthorised transaction to the bank and the UPI app provider immediately, and file a complaint on the National Cybercrime Reporting Portal, since prompt reporting is central to the applicable liability tier under RBI's framework. If the bank's response denies or unreasonably delays relief, the customer can escalate the complaint to the RBI Integrated Ombudsman Scheme, which has jurisdiction over such service deficiencies by regulated entities.
Frequently Asked Questions
Am I automatically liable for a UPI fraud loss if I entered my own PIN?
Not automatically: if you entered the PIN because you were deceived about the true nature of the transaction (social-engineering fraud), that is treated differently from knowingly sharing your PIN or credentials with someone else for their use, which is the kind of negligence that can shift liability onto the customer.
How quickly must I report an unauthorised UPI transaction to get the best protection?
As promptly as possible: the RBI framework's zero-liability protection generally requires prompt reporting, and liability shifts toward the customer, up to a capped limited-liability amount, the longer the delay in reporting after becoming aware of the transaction.
Where can I escalate a UPI fraud complaint if the bank rejects it?
You can escalate to the RBI Integrated Ombudsman Scheme, in addition to filing a complaint on the National Cybercrime Reporting Portal for investigative action against the fraudster.
References & Further Reading
This article references the following statutory provisions and regulatory materials. Readers should always verify current rules, circulars and timelines against the applicable statute, regulation or RBI direction as amended, since these are revised from time to time.
- Reserve Bank of India, Circular on Customer Protection: Limiting Liability of Customers in Unauthorised Electronic Banking Transactions, July 6, 2017.
- Reserve Bank – Integrated Ombudsman Scheme, 2021.