If you think a UPI payment or account has been compromised, contact your bank or payment provider immediately through its official app or a phone number you independently verify. Save the transaction reference and messages, stop engaging with the person who contacted you, and use the official government cybercrime reporting portal for current reporting instructions. Acting quickly is sensible, but nobody can promise that a payment will be reversed or recovered.
This guide is general information, not legal or financial advice. The right steps depend on whether you approved a payment, shared a code, installed an app, or only received a suspicious request. Follow instructions from your bank and official authorities. Before publishing or acting, check the live reporting channels and procedures below; they can change.
First, make the situation safe
Do not send another payment to “unlock,” “reverse,” or “verify” the first one. End unexpected calls and chats, especially if the other person tells you not to contact your bank. Do not install a screen-sharing or remote-access app at their request.
If you are still on a suspicious call, hang up. Find the bank's contact details from its official website, official app, or a number printed on your card or statement. Do not trust a number or link supplied by the person you suspect.
Identify what happened
Write down which of these applies:
- You received a collect request or payment prompt but did not approve it.
- You approved a UPI payment, but the recipient or purpose was misrepresented.
- You shared a UPI PIN, one-time code, password, or other secret.
- You installed an app or shared your screen.
- You are unsure whether money moved.
This helps you explain the incident to your bank. UPI PINs and authentication steps authorize actions in the payment flow; they are not a way to receive money. Read the prompt on your screen before entering a PIN, and cancel if the purpose does not match what you intend. Confirm the exact wording and behavior of your bank's current UPI interface before publishing screenshots or button-specific claims.
Contact your bank or payment provider
Use an official route you locate independently. Explain the approximate time, amount, recipient details shown in the app, transaction reference, and what you clicked or shared. Ask the provider what immediate account protections or dispute steps are available and how to record the complaint.
If you suspect your UPI PIN or account credentials were exposed, ask the bank how to secure the relevant account and payment access. Change credentials only through the official app or site. If you suspect your phone has a malicious app, do not enter banking credentials on that device until you have sought trusted support.
Keep a record of the time you contacted support, any complaint or ticket number, and instructions received. Do not share full account numbers, PINs, passwords, or one-time codes with anyone who calls you claiming they will help.
Report through verified official channels
The National Cyber Crime Reporting Portal is an official place to check current online cybercrime reporting options in India. Read the portal's current directions and submit accurate details. The Indian Cyber Crime Coordination Centre page and the reporting portal should be checked directly for any current telephone reporting number, required information, and procedure. Do not rely on a number copied from an old article.
Save relevant evidence before deleting messages:
- Transaction ID or reference shown by your payment app.
- Date and approximate time.
- The UPI ID, phone number, or beneficiary details shown to you.
- Screenshots of the request or conversation, with sensitive information handled carefully.
- Bank complaint reference and any official report acknowledgment.
Do not post private financial information publicly to “get attention.” Send it only through the official channels that request it, and only when necessary.
If you shared a code or installed an app
If you disclosed a password or code, contact the bank or service through a trusted device and official support channel. Review account activity, change affected passwords from a clean device, and remove any access you do not recognize. If the suspicious person had screen-sharing or remote-access access, tell the bank explicitly and seek help checking the phone before using it for payments again.
If you reused a password on other sites, update those accounts too. Secure your primary email account, since it may be used to reset other services. Be alert for follow-up calls pretending to be investigators, bank employees, or recovery agents.
Watch out for recovery scams
After a loss, a second scam may promise guaranteed recovery for an advance payment. Be skeptical of anyone who contacts you unexpectedly and requests a fee, password, OTP, PIN, or remote access. Verify every contact through the bank or official agency independently.
Keep expectations realistic. Reporting creates a record and lets the relevant institutions review the matter; it does not guarantee a refund, a particular investigation outcome, or a fixed timeline.
Reduce the chance of another incident
- Read the payee and amount on the screen before confirming.
- Treat unexpected collect requests and QR codes as unverified until you understand what you are approving.
- Do not disclose your UPI PIN, banking password, or one-time code to another person.
- Use only official payment apps and update them through the official store.
- Set a strong phone lock and keep your device software updated.
- Verify urgent requests by calling the person on a number you already know.
Key Takeaways
- Contact your bank or payment provider promptly through an independently verified channel.
- Do not make another payment to recover or reverse the first.
- Preserve transaction references and messages; keep complaint records.
- Report using the current official government portal instructions.
- Never share a UPI PIN, password, or one-time code with a caller or chat contact.
- No guide or agent can guarantee that a payment will be recovered.
Frequently asked questions
Can a UPI payment be reversed after a scam?
The outcome depends on the circumstances and the provider's review. Contact your bank promptly and ask about the applicable complaint process. Do not assume reversal is guaranteed, and beware of anyone promising recovery for an upfront fee.
What if I only scanned a QR code but did not enter my PIN?
Close the payment flow and check your app's transaction history through the official application. Scanning alone does not tell you whether a transaction completed. If you see an unfamiliar debit or remain unsure, contact your bank using a verified route.
Should I call a cybercrime helpline?
Use the reporting contact information currently displayed by the official National Cyber Crime Reporting Portal. Confirm any phone number on the live official portal, not from an old post or message.
Is it safe to give my transaction ID to the bank?
A transaction reference may help the bank investigate, but provide it only through the bank's verified official channel. Never share a PIN, password, OTP, or remote access as a substitute.
A useful next step
Save your bank's official fraud-reporting contact details somewhere you can find them without using a suspicious message. If this is happening now, contact the bank first.
Sources to cite
- National Cyber Crime Reporting Portal — Current reporting flow and contact details.
- Indian Cyber Crime Coordination Centre — Current reporting guidance.
- NPCI UPI — Current consumer guidance and product descriptions.
- Your bank's official UPI safety and complaint page — add the specific bank source when adapting this guide.