Contents
Recovering money after UPI fraud: fraudulent transfer and bank reversal
- Cyber fraud complaint drafting Kerala – NCRP + bank + police set
- RBI zero-liability / unauthorised electronic transaction claim
- UPI wrong-credit / mistaken transfer recovery Kerala
- Defences where UPI PIN was shared – what still helps the victim record
- Electronic evidence preservation – screenshots, headers, hash, BSA 63
- Compensation before Adjudicating Officer (IT Act) for UPI data negligence
When the police or the bank do not act
- BNSS 175(3) application after police inaction in UPI fraud – Magistrate route
- Writ for police/bank inaction in cyber fraud – High Court of Kerala
- UPI fraud where victim is outside Kerala – jurisdiction + High Court-primary briefing
Types of UPI, QR, OTP and phishing fraud
- UPI collect-request fraud – unauthorised approve-to-pay request
- QR code swap fraud at shop / parcel counter Kerala – scan-to-receive scam
- UPI Autopay / e-mandate misuse – recurring debit without informed consent
- OTP sharing fraud Kerala – "bank/RBI/KYC" caller took OTP
- Bank vishing call fraud – KYC-block threat call
- Smishing + APK fraud Kerala – parcel/KYC/e-challan link installed malware
- Phishing email / header-spoof fraud – fake bank / IT refund / boss mail
- SIM-swap fraud – duplicate SIM, then OTPs + UPI reset
- WhatsApp takeover fraud – OTP / six-digit code shared, contacts asked for money
- Fake customer-care number fraud – Google-search number / toll-free trap
- AnyDesk / TeamViewer / RustDesk screen-share fraud Kerala
- KYC-update / AePS biometric-lock fraud – fingerprint-misuse withdrawal
- Fake IPO / stock-advisory UPI fraud – Telegram + small-profit top-up trap
- Repeat-target / recovery-scam follow-up – "pay fee to unfreeze profit
Other matters in this group
- Anticipatory bail / regular bail in UPI-mule allegation – accused side
Recovering money after UPI fraud: fraudulent transfer and bank reversal
Cyber fraud complaint drafting Kerala – NCRP + bank + police set
Victim does not know what order to file in.
What it involvesParallel drafting – 1930 call note, NCRP detail, bank dispute, BNSS 173 written complaint.
Relevant lawBNSS 173; IT 79 (due-diligence/grievance) + NCRP procedure; RBI complaint framework.
Forum1930 → NCRP → bank nodal → SHO/Cyber PS.
Procedure & stageSequence with consistent UTR/amount/time; single chronology annexed everywhere.
RemedyCreates record for lien, zero-liability, and investigation.
High Court connectionWell-drafted base record is what HC looks for in writ for inaction.
Documents normally requiredChecklist – ID, statement, UTRs, screenshots, 1930/NCRP numbers, bank ack.
Limitation1930/NCRP immediately – RBI zero liability (third-party breach) needs notice to the bank within 3 working days of its alert (RBI Commercial Banks – Responsible Business Conduct Directions 2025, paras 67–70).
Related: Preservation; RBI zero-liability.
One complaint enough?
No – NCRP, bank, and police serve different purposes.
RBI zero-liability / unauthorised electronic transaction claim
Bank denies reversal for UPI fraud.
What it involvesRBI unauthorised-transaction directions; reporting speed + customer fault assessment.
Relevant lawRBI Commercial Banks – Responsible Business Conduct Directions 2025, paras 67–73 (customer liability in unauthorised electronic transactions); BNS/IT as applicable to fraud.
ForumBank nodal → RBI Ombudsman (RB-IOS 2026); Consumer Commission as alternate.
Procedure & stageWritten dispute with UTR/time; escalation; Ombudsman with prior bank reply.
RemedyShadow credit within 10 working days of notice where zero/limited liability applies (para 72); bank to decide within 90 days (para 73).
High Court connectionWrit against PSU bank for non-speaking rejection – usually after Ombudsman/alternate remedy.
Documents normally requiredDispute copy, bank reply, statement, NCRP/FIR.
LimitationRBI Ombudsman (RB-IOS 2026, w.e.f. 01.07.2026) – after bank's reply, or no reply in 30 days (or longer NPCI/card-network timeline); file within 90 days of that timeline expiring or bank's last communication, whichever later; consumer complaint 2 years (CPA 2019 s.69).
Related: Freeze-lien; salary-unfreeze.
Bank says PIN used – zero refund?
PIN use does not end enquiry – deception/fault still examined.
UPI wrong-credit / mistaken transfer recovery Kerala
Sent to wrong UPI ID/number; recipient refuses return.
What it involvesMistake + unjust retention; possible criminal breach/misappropriation per facts.
Relevant lawBNS 314 (dishonest misappropriation) / 316 (criminal breach of trust – where entrustment proved) / civil recovery; IT 43 where applicable.
ForumBank + NCRP (if dishonest retention); civil court for recovery.
Procedure & stageImmediate bank hold request; legal notice; suit for recovery.
RemedyReturn/reversal; decree with interest.
High Court connectionHC writ not for private retention – civil suit; HC only on jurisdictional error in appeal/revision.
Documents normally requiredUTR, recipient VPA, bank letters, notice.
LimitationSuit – 3 years under the Limitation Act (Art 24 or residuary Art 113, per pleading); for a mistake, time runs from its discovery (s.17(1)(c)).
Related: Innocent-recipient; settlement.
Bank reverses alone?
Needs recipient consent except fraud-freeze process.
Defences where UPI PIN was shared – what still helps the victim record
Victim fears case fails because PIN/OTP was entered.
What it involvesDeception, impersonation, and chain evidence still sustain complaint.
Relevant lawBNS 318/319 ingredients (dishonest inducement); IT 66D.
ForumIO/Magistrate appreciation; trial court.
Procedure & stageRecord exact inducement words, caller ID, sequence; avoid correcting statement later.
RemedyCredible FIR + charge; compensation still arguable.
High Court connectionHC quash/bail courts test prima-facie inducement – clean statement matters.
Documents normally requiredFirst statement, call/SMS, UTR timing (OTP-then-debit proximity).
LimitationNo fixed statutory period – record the first statement and call/SMS evidence immediately; file promptly.
Related: Drafting; preservation.
PIN means consent?
Consent obtained by deception is the prosecution case.
Compensation before Adjudicating Officer (IT Act) for UPI data negligence
Criminal case filed but loss unrecovered.
What it involvesCivil compensation track for failure to maintain reasonable security / unauthorised access.
Relevant lawIT 43 (damage to computer system), 43A (negligent data security – to be omitted by DPDP Act 2023 s.44(2)(a) on commencement), 46 adjudication.
ForumAdjudicating Officer (IT 46 – officer not below Director, GoI, or State equivalent); appeal to Appellate Tribunal → HC (IT 62).
Procedure & stagePetition with loss + negligence pleading; BSA 63 proof; parallel criminal record.
RemedyCompensation; AO jurisdiction up to Rs 5 crore claim, above that the competent court (IT 46(1A)).
High Court connectionAppeal to HC from Tribunal (IT 62) – HC-primary drafting.
Documents normally requiredLoss proof, security-failure material, BSA 63 certs, FIR/NCRP.
LimitationAppeal to Appellate Tribunal – 45 days from receipt of AO order, later on sufficient cause (IT 57(3)); Limitation Act applies to such appeals (IT 60); appeal to HC – 60 days (IT 62).
Related: Zero-liability; consumer.
Criminal + compensation together?
Yes – different tracks, same facts.
When the police or the bank do not act
BNSS 175(3) application after police inaction in UPI fraud – Magistrate route
NCRP + SHO complaint filed, no FIR/action.
What it involvesApplication to Magistrate for direction/order on police complaint.
Relevant lawBNSS 175(3) (Magistrate may order investigation on affidavit-backed application after the BNSS 173(4) step); BNSS 173.
ForumJurisdictional Judicial Magistrate.
Procedure & stageAffidavit + NCRP/1930/bank proofs + prior SHO complaint and written complaint to SP by post (BNSS 173(4)); seek direction.
RemedyDirection for inquiry/FIR per law; creates judicial record.
High Court connectionRevision/writ to HC only after Magistrate record; HC-primary briefing where jurisdictional issue.
Documents normally requiredComplaint copies, postal/ack proofs, bank/NCRP set.
LimitationNo fixed statutory period – file promptly after police inaction.
Related: Writ for inaction; quash (accused side).
Direct HC?
Magistrate route first – HC asks why not.
Writ for police/bank inaction in cyber fraud – High Court of Kerala
FIR/NCRP/lien stalled for months; money idle in lien.
What it involvesArt 226 prayer for time-bound consideration, Sec 106 report to Magistrate, status report.
Relevant lawConstitution Art 226; BNSS 106 (seizure report to Magistrate); BNS/IT as applicable.
ForumHigh Court of Kerala.
Procedure & stageRepresentations → reply/wait → writ with full paper-book; no disputed-fact trial.
RemedyDirection to consider/decide, report seizure, preserve; not a money-decree.
High Court connectionCore HC-primary work – drafting, paper-book, instructions.
Documents normally requiredEntire chain – NCRP, FIR, bank letters, Magistrate application if any.
LimitationNo fixed statutory period – file promptly after representations; unexplained delay invites laches objection.
Related: Magistrate de-freeze; revision.
Will HC order refund?
Generally direction to decide per law, not a refund decree on disputed facts.
UPI fraud where victim is outside Kerala – jurisdiction + High Court-primary briefing
Loss in Kerala, victim elsewhere (or vice versa).
What it involvesZero-FIR / transfer + NCRP jurisdiction; evidence by video.
Relevant lawBNSS 173 (Zero-FIR concept); BSA 63 proof; IT jurisdiction 75.
ForumLocal Cyber PS + NCRP; Kerala Magistrate/HC where cause/locus.
Procedure & stageFile where informed + NCRP; transfer linkage; Kerala counsel for HC stage.
RemedyCoordinated freeze + single chronology.
High Court connectionKerala HC where seizure/bank branch/IO within Kerala.
Documents normally requiredTravel/cause note, UTRs, NCRP, transfer memos.
LimitationNo fixed statutory period – file where informed at once; NCRP/zero-FIR linkage is time-sensitive.
Related: Writ; revision.
Must travel?
FIR can start locally; HC needs Kerala engagement.
Types of UPI, QR, OTP and phishing fraud
UPI collect-request fraud – unauthorised approve-to-pay request
Victim tapped "Approve" on a collect request thinking money was incoming; amount debited.
What it involvesCheating by personation using computer resource; PIN authorised under deception; bank + NCRP trail.
Relevant lawBNS 318(4) cheating + 319(2) personation; IT Act 66D.
ForumStation House Officer / Cyber Crime PS + NCRP; Adjudicating Officer IT Act for compensation (up to Rs 5 cr).
Procedure & stageGolden-hour NCRP + 1930; written complaint under BNSS 173; bank dispute + PPI/UPI switch data preservation.
RemedyLien-mark / reversal request; compensation claim; criminal investigation.
High Court connectionHC writ (Art 226) only if bank/police inaction after representations; Sec 528 BNSS quash not for victim.
Documents normally requiredPassbook/statement, UPI ref/UTR, screenshots, 1930 ack, NCRP ack, bank complaint copy, device details.
LimitationReport within hours – RBI zero-liability windows turn on prompt reporting; otherwise facts vary.
Related: QR-swap; OTP fraud; vishing.
I entered PIN – can I still complain?
Yes – deception vitiates consent; report and preserve.
QR code swap fraud at shop / parcel counter Kerala – scan-to-receive scam
QR given for "receiving payment" debited victim on scanning + PIN.
What it involvesCounterfeit QR overlay / swapped sticker; funds to mule UPI VPA.
Relevant lawBNS 318(4), 319(2); IT 66D; IT 43 compensation for unauthorised access.
ForumCyber PS + NCRP; bank nodal.
Procedure & stagePreserve QR photo, VPA, CCTV request; BNSS 173 complaint; Sec 106 seizure of device/CCTV request through IO.
RemedyTrail-freeze via bank; investigation; compensation.
High Court connectionHC direction for time-bound consideration of freeze/unfreeze representation if statutory authority stalls.
Documents normally requiredQR photo, VPA/UTR, CCTV location/time note, statement, NCRP/1930 refs.
LimitationImmediate – CCTV overwrites in days.
Related: Collect-request; fake-customer-care.
Shopkeeper liable?
Depends on knowledge/participation – matter for investigation.
UPI Autopay / e-mandate misuse – recurring debit without informed consent
Small trial turned into recurring autopay debits.
What it involvesMandate created via deception or dark pattern; NPCI/members compliance.
Relevant lawBNS 318; IT 43/43A (43A – compensation for negligent data security; to be omitted by DPDP Act 2023 s.44(2)(a) on commencement; DPDP Rules 2025 notified 13.11.2025).
ForumBank + NPCI grievance; Consumer Commission if deficiency; Cyber PS if fraud.
Procedure & stageAutopay revoke in UPI app + bank; written revocation; chargeback/dispute.
RemedyMandate cancellation + reversal claim; compensation per facts.
High Court connectionHC writ maintainable against public-sector bank/RBI-regulated entity for arbitrary inaction – alternate remedy usually first.
Documents normally requiredMandate ID, debit dates, app screens, revocation proof, bank replies.
LimitationConsumer complaint – 2 years from cause of action (Consumer Protection Act 2019).
Related: OTP fraud; RBI zero-liability.
How to stop future debits?
Revoke mandate in UPI app and in writing to bank.
OTP sharing fraud Kerala – "bank/RBI/KYC" caller took OTP
Caller posing as bank executive took OTP; account emptied.
What it involvesVishing + computer-resource personation; SIM/bank trail.
Relevant lawBNS 318(4), 319(2); IT 66D; IT 66C if identity data misused.
ForumCyber PS + NCRP; bank fraud cell.
Procedure & stage1930 within minutes; NCRP; BNSS 173 FIR; CDR/IP preservation request via IO.
RemedyLien on recipient chain; investigation; zero-liability assessment.
High Court connectionHC can direct consideration of representation where freeze amount lies idle without Sec 106 report to Magistrate.
Documents normally requiredCall number/time, OTP SMS, statement, NCRP/1930 ack.
LimitationRBI zero-liability tiers depend on reporting speed – report immediately.
Related: SIM-swap; smishing-APK.
Shared OTP – bank says no refund?
Liability depends on reporting, fault, policy – record needed.
Bank vishing call fraud – KYC-block threat call
Threat of account block unless KYC/OTP shared or app installed.
What it involvesFear-based cheating; often AnyDesk/screen-share follow-on.
Relevant lawBNS 318(4), 351(2) intimidation where threat proved; IT 66D.
ForumCyber PS; NCRP.
Procedure & stageDo not install app; preserve number; 1930/NCRP; BNSS 173.
RemedyFreeze trail; investigation.
High Court connectionAnticipatory-bail / quash jurisdiction (HC) relevant only if wrongly arrayed; victim side – writ for inaction.
Documents normally requiredCall recordings (where legally recorded), number, SMS, statement.
Limitation1930 golden hour – report immediately; RBI zero liability (third-party breach) needs notice to the bank within 3 working days of its alert (RBI Commercial Banks – Responsible Business Conduct Directions 2025, paras 67–70).
Related: AnyDesk; fake-customer-care.
Bank asks KYC on call?
Banks do not take OTP/PIN on call – disconnect and verify.
Smishing + APK fraud Kerala – parcel/KYC/e-challan link installed malware
Clicked SMS/WhatsApp link, installed APK, SMS-forwarding started, debits followed.
What it involvesMalware with SMS/notification access; credential + OTP interception.
Relevant lawBNS 318; IT 66 (computer-related offence), 43 damage to computer system.
ForumCyber PS; NCRP; bank.
Procedure & stagePhone on flight mode; preserve APK link/sender; FSL imaging through IO; BNSS 106 seizure procedure.
RemedyFreeze; malware forensics; compensation.
High Court connectionHC Sec 528 BNSS inherent powers for abuse-of-process; victim writ for forensic delay.
Documents normally requiredSender ID, link, APK file name, permissions screenshot, statement, bank dispute.
LimitationPreserve device as-is – factory reset destroys evidence.
Related: SIM-swap; WhatsApp takeover.
Reset phone?
No – first get IO to image/preserve.
SIM-swap fraud – duplicate SIM, then OTPs + UPI reset
Signal lost, then debits; duplicate SIM issued on forged KYC.
What it involvesIdentity theft + telecom KYC failure; bank takeover.
Relevant lawBNS 318, 319; IT 66C, 66D; telecom KYC norms.
ForumCyber PS; TSP nodal + TERM; bank.
Procedure & stageComplaint to TSP + bank; CAF/KYC disclosure request via IO; BNSS 173 FIR; preserve alternate contact logs.
RemedyFreeze; TSP liability per facts; compensation.
High Court connectionHC writ against TSP/bank for non-disclosure to IO can be considered after exhausting grievance.
Documents normally requiredSIM issue time, TSP complaints, KYC copy request, statement.
LimitationTSP records retained per licence – request early.
Related: OTP; UPI takeover.
No signal – what first?
Call bank to freeze channels + TSP to block duplicate.
WhatsApp takeover fraud – OTP / six-digit code shared, contacts asked for money
Victim shared 6-digit code; account taken; contacts defrauded in victim's name.
What it involvesAccount takeover + personation of victim to third parties.
Relevant lawBNS 319(2); IT 66C, 66D.
ForumCyber PS; WhatsApp grievance (in-app + Rule 3(2) officer).
Procedure & stageRe-register + 2-step; broadcast warning; each sender files NCRP; preserve chat/numbers.
RemedyAccount recovery + trail-freeze for each payer.
High Court connectionHC direction for expeditious IO action where multiple victims across districts.
Documents normally requiredTakeover time, messages, payer UTRs, grievance tickets.
LimitationIT Rules grievance clocks (as amended by G.S.R. 120(E) dated 10.02.2026, w.e.f. 20.02.2026): ack 24 hrs; disposal 7 days (r.3(2)(a)(i)); 36-hr removal (proviso r.3(2)(a)(i)); 3-hr removal on court/government order (r.3(1)(d)); 2-hr intimate-image/impersonation (r.3(2)(b)); 72-hr assistance on written order (r.3(1)(j)).
Related: Fake-profile; ID-theft.
Friends paid – who complains?
Each payer files own NCRP + bank dispute.
Fake customer-care number fraud – Google-search number / toll-free trap
Called top-search "customer care"; asked to install app / pay verification fee.
What it involvesSEO/ads abuse + impersonation; remote-access + UPI collect.
Relevant lawBNS 318, 319; IT 66D.
ForumCyber PS; NCRP; search/ad platform grievance.
Procedure & stagePreserve search result, number, call log; platform abuse report; BNSS 173.
RemedyFreeze + takedown request + investigation.
High Court connectionIntermediary safe-harbour (IT 79) turns on due diligence – relevant in writ/takedown follow-up.
Documents normally requiredScreenshot of listing, number, UTR, call log.
Limitation1930 golden hour – report immediately; platform grievance – ack 24 hrs, resolve 7 days (IT Rules 2021 r.3(2)(a)(i), as amended w.e.f. 20.02.2026).
Related: AnyDesk; phishing-header.
Number looked genuine?
Listings can be sponsored – verify from official site/app.
AnyDesk / TeamViewer / RustDesk screen-share fraud Kerala
"Support" guided install of remote-access app; screen watched; UPI PIN captured.
What it involvesRemote-access + social engineering; device compromise.
Relevant lawBNS 318; IT 66, 43; IT 66D.
ForumCyber PS; NCRP; bank.
Procedure & stageUninstall + preserve app ID/session logs; device imaging via IO; BNSS 106 seizure memo compliance.
RemedyFreeze; forensic attribution; compensation claim.
High Court connectionChallenge to illegal seizure/search (no memo, no hash) lies to Magistrate, then revision/HC.
Documents normally requiredApp ID, session time, UTR, statement, device.
LimitationSession logs with vendor retained briefly – request early via IO.
Related: Smishing-APK; vishing.
Money went after screen share – refund?
File 1930/NCRP/bank dispute together; outcome fact-specific.
KYC-update / AePS biometric-lock fraud – fingerprint-misuse withdrawal
Biometric/Aadhaar-enabled withdrawal without card/OTP.
What it involvesFingerprint-copy / AePS route; UIDAI/bank logs.
Relevant lawBNS 318, 319; IT 66C, 66D; Aadhaar Act safeguards.
ForumCyber PS; bank; UIDAI grievance.
Procedure & stageBiometric lock + masked-Aadhaar going forward; preserve auth logs via IO.
RemedyFreeze; compensation per enquiry.
High Court connectionWrit for log disclosure where bank/TSP stalls IO.
Documents normally requiredAePS transaction IDs, bank statement, UIDAI complaint, NCRP.
LimitationReport immediately; RBI zero liability (third-party breach) needs notice to the bank within 3 working days of its alert (RBI Commercial Banks – Responsible Business Conduct Directions 2025, paras 67–70).
Related: SIM-swap; ID-theft.
Prevent?
Lock biometrics, use masked Aadhaar, separate DBT account.
Fake IPO / stock-advisory UPI fraud – Telegram + small-profit top-up trap
Small profits shown, larger top-ups by UPI, then freeze on "tax" demand.
What it involvesFake dashboard + mule UPI chain; cross-border handlers.
Relevant lawBNS 318(4), 61 criminal conspiracy where invoked; IT 66D; SEBI advisory norms (unregistered advice).
ForumCyber PS (often CID wing); NCRP; bank.
Procedure & stagePreserve group links, admin IDs, dashboard URL, UTR chain; early lien across hops.
RemedyMulti-hop freeze; investigation; compensation.
High Court connectionConsolidation/bail/quash where multi-FIR; victim writ for status.
Documents normally requiredChat export, URLs, UTRs, bank credits, NCRP set.
Limitation1930/NCRP immediately; RBI zero liability (third-party breach) needs notice to the bank within 3 working days of its alert (RBI Commercial Banks – Responsible Business Conduct Directions 2025, paras 67–70).
Related: Investment-task; pig-butchering.
Paid 'tax' to release?
Do not – classic second-trap.
Repeat-target / recovery-scam follow-up – "pay fee to unfreeze profit
After first loss, new "officer/agent" promises recovery for fee.
What it involvesSecond fraud on same victim data; no state fee for unfreeze.
Relevant lawBNS 318, 351 where threats; IT 66D.
ForumSame IO + fresh NCRP linkage; do not pay.
Procedure & stageLink new numbers/UTRs to old crime number; preserve.
RemedyFresh freeze; stronger conspiracy record.
High Court connectionStatus-report writ can cover linked attempts.
Documents normally requiredNew chats/numbers, UTRs, old crime number.
LimitationNo fixed statutory period – report each new attempt immediately and link to the original crime number.
Related: Settlement; CIBIL-next.
Agent shows ID card?
Verify only through IO/bank in writing.
Other matters in this group
Anticipatory bail / regular bail in UPI-mule allegation – accused side
Account holder arrayed as accused after receiving fraud pass-through.
What it involvesMule vs knowing-party question; cooperation + money-trail.
Relevant lawBNSS 482/483 (anticipatory bail / special powers); BNS 318/61 where invoked; BNSS 106 seizure.
ForumSessions Court / High Court of Kerala.
Procedure & stagePreserve KYC, purpose proof, statement; cooperate with IO; bail with conditions.
RemedyBail; de-freeze of non-tainted portion per Magistrate.
High Court connectionHC bail/AB where Sessions declines or multi-district FIRs.
Documents normally requiredAccount purpose, KYC, communication, source proof, lien notice.
LimitationNo fixed statutory period – file per custody stage; default bail if charge-sheet not filed within 60 days (90 days where offence punishable with death, life or 10+ years) – BNSS 187(3).
Related: Innocent-recipient; quash.
Lent account for commission – defence?
That admission indicates knowledge – needs separate strategy.
