Compensation for cyber fraud: RBI’s new initiative works for many customers but know when it doesn’t work for others — How to Identify & Stay Safe

Severity: MEDIUM | View Full Scam Details

Compensation for Cyber Fraud in India 2026: RBI’s New UPI Scam Initiative — When It Works and When It Doesn’t

Cyber fraud targeting UPI users is rising in India, but the RBI’s new compensation scheme offers relief — yet it’s important to know when you’re eligible.

What Is the Compensation for Cyber Fraud: RBI’s New Initiative Works for Many Customers but Know When It Doesn’t Work for Others?

With over 8 billion UPI transactions monthly in India, digital payments have become central to daily life. Unfortunately, this has attracted cybercriminals who exploit users through scams often initiated on trusted platforms like WhatsApp and Instagram. Recognising this growing threat, the Reserve Bank of India (RBI) introduced a compensation framework in 2023 to safeguard bank customers against losses due to unauthorised digital transactions, including those via UPI.

This scheme requires banks to reimburse customers for fraud losses, provided the customer has not been negligent. The objective is to build public confidence in digital payments while reducing the fear of losing money to fraudsters. Supported by advisories from CERT-In and the Indian Cyber Crime Coordination Centre (I4C), the initiative empowers consumers but also sets criteria to identify genuine claims.

However, this protection doesn’t cover all cases — especially when a customer shares sensitive information like OTPs, PINs, or UPI PINs voluntarily or falls prey to social engineering. Understanding when the RBI’s compensation applies, and when it doesn’t, helps users protect their investments in the digital economy while avoiding loss due to scams.

How This Scam Works — Step by Step

1. Initial Contact via Trusted Platforms: A victim receives a WhatsApp or social media message from a profile posing as a bank employee, government official, or tech support. The message promises a prize, cashback, or warns of a security issue with their bank or UPI account.

2. Creating Urgency and Fear: The fraudster pressures the victim to act fast—often threatening account suspension or loss of funds if no action is taken immediately.

3. Request for Personal Details: The scammer asks the victim to share confidential information such as Aadhaar details, OTPs from registered mobiles, UPI PINs, or QR codes to “verify” or “secure” the account.

4. Manipulating Victim to Authorize Transactions: Sometimes, the fraudster guides the victim to approve UPI transactions on their phone, or misuse “collect request” features allowing money to be drained stealthily.

5. Loss Realized: The victim notices the unauthorised transaction only after the money has left their bank account. The amount can range from a few thousand to lakhs of rupees.

6. Victim Contacts Bank: The customer approaches their bank expecting reimbursement under RBI’s compensation scheme.

Real Warning Signs to Watch For

• You receive a message claiming to be from your bank but from unofficial WhatsApp numbers or social media accounts.
• The caller or sender asks for UPI PIN, OTP, or Aadhaar details — officials never ask for these.
• Pressure to act immediately, often threatening your account will be blocked or frozen.
• Requests to approve transactions or collect money on your behalf.
• Unsolicited messages claiming you have won prizes or refunds needing instant verification.
• Poor language or spelling errors in supposed “official” messages.
• Asking you to install apps or share QR codes for “verification.”

What Happens to Victims

When a victim falls prey to these scams, the financial impact can be severe. Many lose sums ranging from a few thousand rupees to lakhs, wiping out savings or delaying monthly expenses. Emotionally, victims feel violated and stressed, sometimes hesitant to use digital payments again despite their convenience.

In some cases, fraudsters combine UPI scam with SIM swapping, gaining control of a victim’s mobile number to intercept OTPs and bypass security. Misuse of Aadhaar details also heightens risks, potentially exposing victims to broader identity frauds beyond immediate financial loss.

Recovery is complex — banks may reverse fraudulent transactions if reported quickly, but delays or victim negligence can result in permanent loss. The RBI compensation scheme helps but only if victims can prove they followed safety measures.

What RBI and CERT-In Say

The RBI has mandated banks to compensate customers for fraudulent digital transactions where customers have not been negligent or failed to follow banking guidelines. It urges users to report suspicious transactions immediately and provides a 30-day window to notify the bank.

CERT-In recommends users avoid sharing sensitive data, use strong PINs, and verify official communications carefully. The Indian Cyber Crime Coordination Centre (I4C) encourages victims to file FIRs online and utilize the 1930 cybercrime helpline for support.

Banks also maintain dedicated helplines under the RBI framework—customers can contact their bank’s grievance cell along with the centralized RBI helpline on 155260 for faster dispute resolution.

How to Protect Yourself

1. Never share your UPI PIN, OTP, or Aadhaar details with anyone — not even bank officials.
2. Verify caller or message authenticity by directly calling your bank’s official number, not the number given in the suspicious message.
3. Avoid clicking on unknown links or downloading apps suggested via social media or WhatsApp.
4. Enable UPI app notifications for every transaction to monitor suspicious activity instantly.
5. Set transaction limits on your UPI app for added protection.
6. Do not entertain messages or calls promising prizes, refunds, or urgent account updates without verification.
7. Regularly update your mobile phone’s operating system and banking apps to patch vulnerabilities.

What to Do If You’ve Been Targeted

1. Immediately block your UPI payment facility via your banking app or customer care.
2. Report the fraud to your bank and request a formal complaint/refund under RBI’s compensation scheme.
3. File a complaint on the government’s cybercrime portal at cybercrime.gov.in.
4. Call the 1930 cybercrime helpline for guidance and assistance.
5. Inform your mobile network operator if you suspect SIM swap fraud to block the number.
6. Keep all transaction records, SMS alerts, and chat logs as evidence.
7. File an FIR at your local police station if the loss is significant or if advised by authorities.

Frequently Asked Questions

Q: Will RBI compensate me if I share my UPI PIN with the fraudster?
No. The RBI’s compensation applies only if you have not shared sensitive information like your UPI PIN or OTP. Sharing these details is considered negligence by the customer.

Q: How quickly should I report the fraud to get compensation?
You must notify your bank within 30 days from the date of the fraudulent transaction. Delayed reporting can reduce your chances of reimbursement.

Q: Can I recover loss if the scam involved SIM swapping?
SIM swapping complicates recovery as it allows fraudsters to intercept OTPs. However, banks may compensate if you reported the fraud timely and complied with RBI guidelines.

Digital payment scams are evolving fast in India’s growing UPI ecosystem. Always stay alert and cautious before sharing any data. If you receive suspicious messages or calls, don’t act impulsively—verify them at BharatSecure.app before responding to protect your money and data.