UPI Fraud and the Authorized-Transaction Trap: A Legal Playbook for Recovery

A recurring pattern in UPI fraud recovery cases: a victim transfers money after being deceived — a fake payment-gateway support call, a fraudulent merchant link — using a legitimate OTP they entered themselves. The bank's default position, almost reflexively, is that this was an "authorized transaction" because the correct OTP was used, which closes the door on the bank's own liability and shifts the entire recovery burden onto a criminal complaint alone.

That classification is frequently wrong, not just unfavorable. "Authorized" and "obtained through fraud" are legally distinct categories, and RBI's customer liability framework for third-party fraud does not treat an OTP entered under active deception the same as a transaction the customer genuinely intended. The bank's initial classification is a starting negotiating position, not a final legal determination — and most victims accept it as final because they don't know it's contestable.

An OTP proves the customer entered a code. It does not prove the customer understood what they were authorizing. Those are different facts, and the second one is what actually governs liability.

The practical recovery sequence has two tracks that need to run in parallel, not sequentially. First, immediate filing on the National Cyber Crime Reporting Portal to trigger the account-freeze mechanism, since speed determines whether the funds can still be intercepted before moving through further accounts — this is a matter of hours, not days. Second, a formal representation to the bank's grievance redressal officer that explicitly reframes the transaction under the correct RBI liability framework, rather than accepting the bank's initial characterization.

A parallel criminal complaint serves a purpose beyond the obvious one: a documented FIR materially strengthens the civil and banking-channel recovery claim if that route stalls, since it creates an official investigative record the bank's grievance process cannot simply dismiss as unsubstantiated.