RBI suggests cooling-off period for UPI and bank transfers — How to Identify & Stay Safe

INDIA — By BharatSecure Threat Intelligence Team · Updated May 26, 2026

Severity: MEDIUM | View Full Scam Details

RBI Suggests Cooling-Off Period for UPI and Bank Transfers: Protect Yourself from 2026's Rising Digital Payment Scams in India

UPI fraud and unauthorized bank transfers are on the rise in India, prompting the RBI to recommend a "cooling-off period" to curb digital payment scams.

What Is the RBI Suggests Cooling-Off Period for UPI and Bank Transfers Scam?

In 2026, the Reserve Bank of India (RBI) highlighted growing concerns over UPI and bank transfer scams, where fraudsters exploit the speed and convenience of digital payments to steal money from unsuspecting victims. The RBI has suggested implementing a “cooling-off period” — a brief hold on transactions — before the money moves from the payer’s account to the payee. This pause aims to give users a chance to verify transaction details, helping to prevent immediate losses from fraudulent payments.

The scam primarily targets everyday Indians using UPI apps such as Google Pay, PhonePe, Paytm, and others, along with bank transfers through online banking platforms. Scammers often impersonate bank officials, government authorities, or verified service providers using WhatsApp or SMS to trick victims into clicking malicious links or verifying sensitive information via fake websites. According to CERT-In (Indian Computer Emergency Response Team), incidents involving digital payment frauds have surged, affecting millions across urban and rural India.

Authorities such as RBI and the Indian government’s I4C (Indian Cyber Crime Coordination Centre) have issued advisories warning users about the risks and urging for safer transaction practices. The RBI’s cooling-off period suggestion reflects a new, targeted effort to reduce instantaneous fraud losses while bolstering transaction security frameworks.

How This Scam Works — Step by Step

1. Initial Contact: The scam usually begins with a WhatsApp message or call from someone pretending to be a bank representative or government official. They may claim there is an urgent issue with the victim’s bank account or Aadhaar linked to UPI.

2. Fake Verification Request: The fraudster asks the victim to verify or update their KYC details or UPI PIN by following a link or providing OTPs (One-Time Passwords) sent via SMS.

3. Phishing Website: The provided link leads to a convincing but fake bank website designed to capture sensitive details such as UPI PIN, Aadhaar number, bank account details, or OTPs.

4. Instant Transfer: Using the stolen information, the scammer initiates unauthorized UPI or bank transfers from the victim’s account. Because UPI transactions are real-time, the money is immediately credited to the scammer’s account.

5. Victim Realizes Loss: The victim only notices the fraud when they review their bank statement or receive alerts for transactions they never authorized. By then, recovery is often difficult.

6. Request for Cooling-Off: RBI’s suggested cooling-off period would introduce a delay in these transfers, allowing victims to spot and report unauthorized transactions before the money disappears.

Real Warning Signs to Watch For

• Unexpected Messages or Calls claiming to be from your bank or RBI asking for KYC or OTP verification.
• Urgent Language and Pressure Tactics urging immediate action on your bank account or UPI app.
• Links to Unknown or Non-Official Websites asking for credentials or payment information.
• OTP Requests directly from unsolicited calls or messages—especially if they ask you to share or enter OTPs on unknown sites.
• Too-Good-To-Be-True Offers promising cashback or other rewards upon completing “verification.”
• Misspelled URLs or Messages Containing Typing Errors in the bank or service provider’s name.
• Multiple Small Transactions or sudden transaction alerts without your knowledge.

What Happens to Victims

Victims of these scams face immediate financial loss—often thousands or even lakhs of INR disappearing from their accounts within minutes. The real-time nature of UPI means victims cannot reverse payments once completed. Many complain about complicated recovery processes, especially if the fraudulent transfer goes to accounts that quickly move money through multiple channels, making tracking difficult.

Emotionally, victims suffer stress and anxiety. They may feel violated after their Aadhaar-linked accounts are compromised. In some cases, SIM swap fraud exacerbates the problem, as scammers gain access to SMS OTPs by duplicating mobile numbers, making it easier to break into accounts.

The financial loss can disrupt monthly budgets and force victims into debt or loss of savings. Despite RBI’s increasing efforts, many victims remain unaware of safeguards like blocking accounts immediately or reporting to cybercrime cells.

What RBI and CERT-In Say

The RBI has recently circulated advisories recommending customers to be vigilant for phishing attempts and unauthorized request for OTPs or PINs. They strongly discourage sharing sensitive details over phone or WhatsApp. The 2026 recommendation for a cooling-off period aims to reduce instant fraud by pausing suspicious UPI and bank transfer transactions, allowing additional verification steps or time for victims to flag unauthorized payments.

CERT-In emphasizes awareness and reporting as crucial in fighting digital payment frauds. They provide a national 24x7 cybercrime helpline (1930) for victims to report incidents promptly.

The RBI Customer Education Helpline (1800-112-665) also supports consumers facing payment frauds. The Indian Cyber Crime Coordination Centre (I4C) coordinates with banks and law enforcement for swift investigations.

How to Protect Yourself

1. Never Share OTPs or UPI PINs: No bank or official will ask for these details over phone, WhatsApp, or SMS.
2. Verify Messages Carefully: Cross-check sender numbers or WhatsApp business accounts; official messages come from verified accounts.
3. Avoid Clicking Unknown Links: Instead, visit bank websites or apps directly to verify requests.
4. Enable UPI Transaction Limits: Set daily transaction caps within your UPI app to limit potential losses.
5. Register for Mobile Banking Alerts: Always keep notifications ON to track transactions immediately.
6. Use App Lock and Biometric Security: Protect apps and devices with passwords or fingerprints.
7. Report Suspicious Activity Immediately: Contact your bank, RBI helpline, or the 1930 cybercrime helpline.

What to Do If You've Been Targeted

• Freeze Transactions: Immediately block your UPI app or net banking access.
• Contact Your Bank: Report unauthorized transactions and request help with recovery steps.
• Call the RBI Customer Helpline: 1800-112-665 for guidance on payment fraud.
• File a Complaint with I4C: Use cybercrime.gov.in to lodge an official complaint.
• Call the CERT-In Cybercrime Helpline: Dial 1930 to report the fraud and seek assistance.
• Change All Related Passwords and PINs: Secure your accounts promptly.
• Inform Your Mobile Service Provider: In case of suspected SIM swap fraud, request a SIM block or replacement.

Frequently Asked Questions

Q1: Will the RBI’s cooling-off period delay all UPI transactions?
No, the cooling-off period is proposed to apply selectively, especially on high-value or suspicious transactions. Routine payments should not face unnecessary delays.

Q2: Can I get my money back if I fall victim to this scam?
Recovery depends on quick reporting and investigation by your bank. RBI guidelines encourage banks to assist customers, but prompt action improves chances of recovery.

Q3: How can I verify if a message claiming to be from my bank is genuine?
Check the sender’s number or WhatsApp account for verification ticks. Do not trust unsolicited requests for OTPs or PINs, and independently contact your bank’s official helpline.

Stay alert against digital payment scams — always verify suspicious messages with BharatSecure.app before acting. Protect your money and personal data!