RBI suggests cooling-off period for UPI, bank transfers — what it means for you — How to Identify & Stay Safe

INDIA — By BharatSecure Threat Intelligence Team · Updated Apr 30, 2026

Severity: MEDIUM | View Full Scam Details

RBI Cooling-Off Period Scam: Protect Your UPI Funds in India 2026

Fraudsters are using fake news about an RBI-mandated cooling-off period for UPI and bank transfers to steal money from unsuspecting Indians.

What Is the RBI suggests cooling-off period for UPI, bank transfers — what it means for you?

Imagine receiving a WhatsApp message claiming the RBI (Reserve Bank of India) has introduced a new mandatory "cooling-off" period for all UPI transactions and bank transfers. The message might say that any new beneficiary added to your account will have a 24-hour or 48-hour waiting period before you can send them money. It may even state that this is for your protection against fraud. Sounds legitimate, right? Wrong.

This is a classic scam. While RBI is constantly working to improve the security of digital transactions, there has been NO official announcement of a blanket cooling-off period for all UPI transactions. Scammers are exploiting the general public's awareness of RBI's role in financial security to spread false information and create a sense of urgency. Vulnerable individuals receive unsolicited messages or calls claiming urgent issues related to their Aadhaar or UPI transactions. These messages often include fake links that appear to lead to official banking websites where victims are coaxed into sharing sensitive information like their UPI PIN, OTPs, or banking credentials. CERT-In (the Indian Computer Emergency Response Team) periodically issues advisories about such scams, but these evolve quickly, making it difficult to keep up.

This scam targets anyone who uses UPI or online banking, but particularly those less familiar with digital finance or who are easily panicked by official-sounding pronouncements. The widespread use of UPI in India makes it an attractive target for fraudsters, and this particular scam preys on people's trust in institutions like the RBI.

How This Scam Works — Step by Step

Here's how this scam unfolds:

1. Initial Contact: The scammer initiates contact, usually via WhatsApp, SMS, or even a phone call. They may pose as a bank employee, an RBI representative, or even someone you know (through a compromised account). The message will refer to this "cooling-off" period for new beneficiaries in UPI.
2. Creating Urgency: The message claims that because of this cooling-off period, your recent transaction is "stuck" or "pending" or requires urgent verification to avoid cancellation.
3. Phishing Link or Request for Information: The message contains a link that supposedly leads to a bank or UPI app login page. This is a fake website designed to steal your credentials. Alternatively, the scammer may directly ask for your UPI PIN, OTP, Aadhaar number, or other sensitive details. They might state that they 'need' to get these details to move ahead with the transaction, or to enable you to send money sooner than the supposed 24-48 hour cooling off period.
4. Gaining Access to Your Account: Once you enter your credentials on the fake website or share them with the scammer, they gain access to your UPI account or banking portal.
5. Stealing Funds: The scammer then uses your stolen credentials to transfer money out of your account, often in multiple smaller transactions to avoid raising suspicion or triggering transaction limits.
6. SIM Swap/Aadhaar mis-use: In some cases the details you provided can be used to perform a SIM swap attack, gaining control of your registered mobile number. With control over your phone number and related OTPs, the scammer can drain your accounts and even access other services linked to your Aadhaar.

Real Warning Signs to Watch For

• Unsolicited Communication: Be wary of unexpected messages or calls about your UPI transactions, especially if they create a sense of urgency or panic. No legitimate bank will ever ask for your PIN or OTP.
• Fake or Suspicious Links: Never click on links sent via SMS or WhatsApp from unknown numbers. Always verify the URL of any website before entering your credentials. Look for the padlock icon in the address bar, indicating a secure connection (HTTPS).
• Requests for Sensitive Information: Never share your UPI PIN, OTP, Aadhaar number, bank account details, or any other sensitive information with anyone over the phone, SMS, or WhatsApp.
• Poor Grammar and Spelling: Scam messages often contain spelling and grammatical errors, which are telltale signs of fraud.
• Threats or Pressure Tactics: Scammers often use threats or pressure tactics to rush you into taking action without thinking.
• Mismatched Information: Cross-verify any information you receive with official sources, such as your bank's website or customer service hotline.
• Inconsistencies: Pay close attention to inconsistencies such as the sender's name not matching the phone number or email address.

What Happens to Victims

The immediate impact is financial loss. Victims can lose anywhere from a few hundred to several lakhs of INR, depending on the account balance and transaction limits. The emotional impact can be devastating, leading to feelings of shame, anger, and helplessness. Victims may also face the hassle of reversing UPI transactions (if possible), dealing with banks, and reporting the crime to authorities. Additionally, if Aadhaar details were compromised, the potential for identity theft and misuse of personal information is a serious concern. A SIM swap related to the scam can lead to long-term repercussions with fraudsters accessing all your stored personal data.

What RBI and CERT-In Say

RBI frequently issues public awareness campaigns to educate users about digital payment security. They emphasize that customers should never share their PINs, OTPs, or banking credentials with anyone. They also warn against clicking on suspicious links and downloading unauthorized apps. CERT-In also publishes advisories about various cyber threats, including UPI fraud. While specific advisories regarding this exact "cooling-off" scam may vary, the general message is consistent: be vigilant and skeptical of unsolicited communications.

RBI has also introduced measures like UPI Lite to reduce the burden on core banking systems and enhance transaction speed, but these are separate from any supposed cooling-off periods. Remember, the 1930 cybercrime helpline is active to help with fraud related to digital transactions.

How to Protect Yourself

1. Enable Two-Factor Authentication: Always enable two-factor authentication (2FA) on your UPI apps and banking accounts. This adds an extra layer of security, making it harder for scammers to access your account even if they have your password.
2. Use Strong, Unique Passwords: Use strong, unique passwords for all your online accounts, and avoid reusing the same password across multiple platforms. A password manager can help you generate and store secure passwords.
3. Verify Beneficiary Details: Before making a UPI transfer to a new beneficiary, double-check their details carefully. Consider making a small test transaction first to ensure you have the correct information.
4. Be Wary of QR Codes: Be cautious when scanning QR codes from unknown sources, as they could lead to malicious websites or initiate unauthorized transactions.
5. Keep Your Software Updated: Keep your operating system, antivirus software, and UPI apps updated to the latest versions. These updates often include security patches that protect against known vulnerabilities.
6. Install Anti-Malware Software: Install a reputable anti-malware app on your smartphone. Many of these apps can detect and block malicious links and apps.
7. Report Suspicious Activity to Your Bank: If you receive a suspicious message or notice unauthorized activity on your account, report it to your bank immediately.

What to Do If You've Been Targeted

1. Immediately call the cybercrime helpline 1930. This is a national helpline that can assist you in reporting cyber fraud and potentially recovering your funds.
2. Block Your UPI Account: Immediately block your UPI account through your bank or UPI app provider.
3. Change Your Passwords: Change all your passwords, including your UPI PIN, banking passwords, and email passwords.
4. Report the Incident to Your Bank: Contact your bank immediately to report the incident and request assistance in freezing your account or reversing fraudulent transactions.
5. File a Complaint on cybercrime.gov.in: File a formal complaint on the National Cyber Crime Reporting Portal (cybercrime.gov.in). This will help law enforcement agencies investigate the crime and potentially recover your stolen funds.
6. Report to Local Police: You can also file a First Information Report (FIR) at your local police station.
7. Contact Aadhaar Authority (UIDAI) if applicable: If you suspect your Aadhaar information was compromised, contact UIDAI to explore options for securing your identity.

Frequently Asked Questions

Q: Is there really a cooling-off period for new UPI beneficiaries?

A: No, there is no universally mandated cooling-off period for UPI transactions announced by the RBI. Some banks may implement such measures internally for high-value transactions or to manage risk, but this is not a blanket RBI regulation.

Q: I received a message claiming to be from RBI about this cooling-off period. Is it real?

A: No. The RBI does not directly contact individual users about their transactions. Any message claiming to be from RBI asking for your personal information or UPI PIN is definitely a scam.

Q: What if I accidentally clicked on the link in the message?

A: If you clicked