RBI Suggests Cooling-Off Period for UPI and Bank Transfers — How to Identify & Stay Safe

INDIA — By BharatSecure Threat Intelligence Team · Updated May 11, 2026

Severity: MEDIUM | View Full Scam Details

RBI Suggests Cooling-Off Period for UPI and Bank Transfers Scam in India 2026: What You Must Know

A growing scam revolves around fake RBI advisories urging users to activate a "cooling-off period" for UPI and bank transfers, putting millions of Indians at risk of losing money through digital fraud.

What Is the RBI Suggests Cooling-Off Period for UPI and Bank Transfers?

In 2026, scammers have been exploiting public trust in the Reserve Bank of India (RBI) by circulating false messages and calls claiming that RBI now mandates a "cooling-off period" before UPI and bank transfers can be processed. This supposed delay is framed as a security feature to protect users, but in reality, it’s a ruse scammers use to trick victims into revealing sensitive banking details or making unauthorized payments.

This scam targets everyday Indian internet users who frequently use UPI apps like Google Pay, PhonePe, or Paytm. It is especially prevalent among senior citizens and less tech-savvy people who tend to trust official-sounding messages. According to CERT-In and the Indian government's Inter-Departmental Cyber Coordination Centre (I4C), similar scams have surged in urban and semi-urban areas where digital transactions are increasing.

While RBI has not mandated any such "cooling-off period," fraudsters manipulate this fake advisory to create panic, pushing users to share OTPs, PINs, or click malicious links. Many victims report losing amounts ranging from a few hundred to thousands of rupees, sometimes wiping out their entire bank account linked to UPI.

How This Scam Works — Step by Step

1. Fake Message or Call: The victim receives a WhatsApp message, SMS, or call claiming to be from RBI or their bank. The message warns about a new RBI rule enforcing a mandatory "cooling-off period" (usually 1-2 hours) on all UPI and bank transfers for enhanced security.

2. Urgent Instructions: The message instructs the victim to “activate” this feature by clicking a link, downloading a specific app, or replying with certain details like their UPI PIN, Aadhaar number, or OTPs.

3. Phishing Link or Social Engineering: If a link is clicked, it leads to a fake RBI or bank website designed to steal login credentials or install malware. Alternatively, fraudsters may ask the victim to share OTPs received on their phone “to verify activation.”

4. Unauthorized Transfer: Using the stolen credentials, fraudsters initiate immediate UPI or bank transfers, draining funds from the victim’s account.

5. Cooling-Off Delay Used as Excuse: When victims try to dispute transactions, scammers claim money is “on hold” due to the cooling-off period and to wait before raising complaints — buying fraudsters more time to empty accounts.

Real Warning Signs to Watch For

• No official RBI or Bank notification: RBI and banks never send such urgent activation messages requiring PIN or OTP sharing.
• Requests to share OTP, UPI PIN, or Aadhaar details: Legitimate entities never ask for sensitive information over calls or messages.
• Urgent language pressuring immediate action: Fraudsters use fear or panic to rush victims.
• Links that don’t start with official RBI or bank URLs: Check for misspellings or suspicious domains.
• Unsolicited calls claiming to be RBI officials: RBI does not call users to enforce transfer delays.
• Spelling and grammatical mistakes in messages: Official communications maintain professional language.
• Unusual app download prompts: Be wary of unknown apps claiming to "secure" your UPI account.

What Happens to Victims

Victims usually lose money directly from their bank accounts or UPI wallets, often before they realize their account was compromised. Due to the instant nature of UPI, fraudulent transactions complete in seconds, limiting chances for reversal. While banks sometimes help recover funds if reported quickly, many victims face long waits and complicated dispute processes.

Emotionally, victims experience stress, anxiety, and loss of trust in digital payments. The misuse of Aadhaar-linked accounts adds to frustration, as identity theft can lead to further fraudulent activities. Victims reliant on their savings or monthly incomes suffer significant financial hardship.

SIM swap fraud is often linked with these scams — fraudsters transfer victims' mobile numbers to new SIM cards controlling OTPs, bypassing two-factor authentication. This amplifies the risk and financial damage.

What RBI and CERT-In Say

The RBI and CERT-In have repeatedly warned Indian citizens not to share their personal banking details, UPI PIN, OTPs, or Aadhaar number over calls, SMS, or WhatsApp. Neither the RBI nor any authorised bank officials ever ask for these details to “activate” services or impose transfer delays.

RBI’s customer helpline (1800 112 212) and CERT-In (cert-in@cert-in.org.in) maintain information bulletins on the latest fraud trends. Indian authorities urge victims to report cybercrimes immediately and caution users to verify messages through official RBI or bank websites before acting.

The government’s 1930 cybercrime helpline is available 24x7 to help victims report incidents and get guidance on freezing their accounts and preventing further loss.

How to Protect Yourself

1. Never share your UPI PIN, OTP, Aadhaar number, or banking passwords with anyone — not even people claiming to be from RBI or your bank.
2. Ignore any messages or calls asking you to activate a “cooling-off period” or any similar service by clicking links or sending information.
3. Verify any suspicious messages by visiting your bank’s official website or calling customer care directly.
4. Enable app-based locks and biometric authentication in your UPI app for extra security.
5. Register for “Do Not Disturb” (DND) services on your phone to reduce spam calls or messages.
6. Regularly review your bank and UPI transaction history for unauthorized payments.
7. Keep your mobile number SIM-secure by using PINs with your telecom provider and be cautious about sharing mobile number details publicly.

What to Do If You’ve Been Targeted

1. Immediately block your UPI ID or linked bank account by contacting your bank’s customer service.
2. Report the fraud to your bank and request a temporary freeze on transactions.
3. File a complaint on the Indian government’s National Cybercrime Reporting Portal at cybercrime.gov.in.
4. Call the 1930 cybercrime helpline for victim support and guidance.
5. Inform your mobile operator to check for any SIM swap and request to block suspicious SIM requests.
6. Report the incident to CERT-In via their email or portal.
7. Change all your banking and UPI app passwords and immediately review related financial accounts for irregularities.

Frequently Asked Questions

Q: Is the RBI really implementing a cooling-off period for UPI or bank transfers?
A: No. The RBI has not introduced any such rule. These messages are part of a scam designed to steal your banking details.

Q: What should I do if I receive a call claiming to be from RBI about activating transfer delays?
A: Do not share any personal information. Hang up and verify the claim by contacting your bank or RBI helpline directly.

Q: Can a cooling-off period protect me from UPI fraud?
A: Legitimate cooling-off periods are not currently part of RBI regulations. Your best protection is to keep your banking credentials private and stay alert to scam tactics.

Stay alert, don’t rush into clicking suspicious links or sharing private info, and verify every message you receive about banking changes. If something feels off, check BharatSecure.app to ensure you’re safe before taking action. Protect your hard-earned money from digital fraud today!