RBI suggests cooling-off period for UPI, bank transfers — How to Identify & Stay Safe

INDIA — By BharatSecure Threat Intelligence Team · Updated Jun 13, 2026

Severity: Medium | View Full Scam Details

RBI Suggests Cooling-Off Period for UPI and Bank Transfers in 2026: A New Response to Rising Digital Payment Frauds in India

Scammers targeting India’s UPI and bank transfers exploit urgency, prompting RBI to propose a cooling-off period to curb fraud losses.

What Is the RBI Suggests Cooling-Off Period for UPI, Bank Transfers?

With the explosive growth of digital payments in India, particularly through Unified Payments Interface (UPI), cybercriminals are increasingly exploiting this convenience to trick users into transferring money under false pretenses. In 2026, the Reserve Bank of India (RBI) has publicly suggested implementing a “cooling-off” period on UPI and bank transfers. This measure aims to provide users a short delay window before completing high-value or suspicious transactions, allowing time for verification and cancellation in case of fraud.

This scam primarily targets everyday users who rely heavily on their smartphones and instant payment apps such as Google Pay, PhonePe, or Paytm for everyday expenses and money transfers. Fraudsters often impersonate bank officials or payment app customer support representatives via WhatsApp messages or phone calls, invoking a sense of emergency to push victims into quick transfers. According to public complaints reported to Indian cybercrime authorities such as CERT-In and the I4C (Indian Cyber Crime Coordination Centre), these scams have surged, especially during peak transaction times such as festivals or salary days.

While RBI’s advisory on the cooling-off period is still under consideration for implementation, it reflects the regulator’s commitment to safeguard the digital financial ecosystem by encouraging transaction scrutiny. This advisory aligns with CERT-In’s ongoing alerts urging users to remain vigilant of suspicious UPI requests and fraudulent communication.

How This Scam Works — Step by Step

1. Initial Contact: The victim receives a WhatsApp message or call from a number claiming to be from their bank or UPI app’s customer service. The message often references a recent transaction or a security alert—for example, “We detected unusual activity on your account.”

2. Data Grooming: The fraudster, allegedly armed with partial stolen data (such as UPI ID us**@bank or masked bank account details XXXX1234), references these details to build trust and urgency.

3. Phishing Link / OTP Request: The scammer then directs the victim to click on a fake link or share an OTP (One-Time Password) claiming it is for transaction verification or account security.

4. Inducing UPI Transfer: Many times, the caller warns that to “secure” funds or verify transactions, the victim must immediately transfer a sum of money via UPI or internet banking—often disguised as a refund process or security deposit.

5. Victim Completes Transfer: Without a cooling-off period, victims act quickly fearing account freezes or losses and approve the transfer.

6. Funds Are Drained: After the money is transferred to the scammer’s account (usually a burner UPI ID), the fraudster immediately withdraws or moves funds through multiple accounts, making recovery challenging.

7. Delayed Realization: The victim notices the loss hours or days later, usually when checking their bank balance or receiving official transaction alerts too late to stop the transfer.

Real Warning Signs to Watch For

• Calls or messages urging immediate UPI or bank transfers for “security verification” or “refunds.”
• Unsolicited WhatsApp messages claiming to be from your bank or payment app, especially if they include urgent language.
• Requests for OTPs or UPI PINs via message or call.
• Claims that your Aadhaar-linked bank account has been compromised and needs “instant action.”
• Links to unknown websites that mimic official bank/payment interfaces.
• Use of generic greetings (e.g., “Dear Customer”) rather than your name.
• Pressure to complete payments without allowing time to verify or consult someone.

What Happens to Victims

Victims of these scams often suffer financial losses ranging from a few hundred to lakhs of INR, depending on the amount transferred. Immediate UPI or bank transfer scams leave little room for reversal because funds move instantly, and unlike credit card frauds, there is no post-transaction dispute mechanism for unauthorized debit transfers. Many victims report emotional distress, a sense of betrayal because their personal data was used, and difficulty navigating complaint channels.

In India, Aadhaar misuse or SIM swap fraud can exacerbate these losses, as scammers may combine stolen personal data with mobile number fraud to intercept OTPs and bypass security checks. Victims often have to engage in lengthy bank grievance procedures, with no guaranteed refund, increasing anxiety and loss of trust in digital payments.

What RBI and CERT-In Say

The RBI has issued multiple advisories reminding banks and payment systems to educate customers on safe digital transaction practices. Though there is no specific public notification yet mandating a cooling-off period, RBI’s 2026 suggestion signals imminent regulatory steps to protect users from instant-money-transfer scams by enabling a short delay, particularly for high-value UPI transactions.

CERT-In regularly alerts users about phishing and fraud trends, recommending never to share OTPs or UPI PINs and to always verify caller IDs through official customer care numbers. The government’s cybercrime helpline, 1930, remains the official channel to report cyber frauds, including those involving digital payments.

How to Protect Yourself

1. Never share your OTP or UPI PIN with anyone, even if they claim to be bank officials.
2. Do not click on suspicious links received via WhatsApp or SMS; instead, directly visit your bank or payment app’s official site.
3. Verify any unexpected calls by hanging up and calling your bank’s official helpline number.
4. Enable transaction alerts via SMS and email to track every debit immediately.
5. Set UPI transaction limits for daily and single payments through your bank app for added control.
6. If unsure, wait at least 15-30 minutes before approving any large or unsolicited UPI transfers; use this time to consult family or bank officials.
7. Keep your mobile device’s software updated and install apps only from trusted sources like Google Play Store.

What to Do If You’ve Been Targeted

• Immediately contact your bank’s customer service to report the unauthorized transaction and request a transaction freeze if possible.
• Change your UPI PIN and mobile banking passwords immediately.
• Report the fraud to the National Cyber Crime Reporting Portal at cybercrime.gov.in for official documentation and further assistance.
• Call the 1930 cybercrime helpline to lodge your complaint and get guidance on next steps.
• Inform your mobile service provider if you suspect a SIM swap to block further interception of OTPs.
• Keep copies of all communication and transaction alerts for reference during investigations.

Frequently Asked Questions

Q: Will the RBI cooling-off period delay all UPI transactions?
A: The suggested cooling-off period aims to apply mainly to high-value or suspicious transactions to allow users time to verify and cancel any fraudulent transfers. Routine, small-value transfers would likely remain instant to preserve convenience.

Q: Can I reverse a wrong UPI transfer immediately?
A: UPI transactions are designed to be instant and typically cannot be reversed once completed unless the recipient returns the money. This is why verification before sending money is vital.

Q: How does the cooling-off period protect me from scams?
A: A cooling-off period creates a buffer time during which a user can reconsider or confirm a transaction, reducing hasty transfers driven by scammer pressure and increasing chances to detect fraud.

For any suspicious messages or calls about your digital payments, verify them at BharatSecure.app. If you suspect fraud, report immediately via the 1930 cybercrime helpline.

Disclaimer: This article describes a pattern of fraud reported in public sources for public-safety awareness. It is not legal, financial, or medical advice. To request correction or removal of any content, write to hello@bharatsecure.app.