Paid a Personal UPI ID or Bank Account for an Online Order and Got Nothing: What to Do

Short answer: call 1930 and file a report at cybercrime.gov.in within the first hour, write to your bank the same day, and do not expect an automatic refund. RBI’s limited-liability rules cover unauthorised transactions, and a payment you made yourself to an online seller who then did not deliver is generally not one, so whether you get money back depends mainly on whether the receiving account can be frozen before the money is withdrawn. RBI’s amended directions, effective for transactions on or after 1 January 2027, widen the framework to some fraud cases and add a small-value compensation scheme, but their wording does not clearly cover a customer who knowingly pays a seller who then vanishes. Never pay anyone who offers to “recover” the money.

General consumer information, not legal advice. The RBI circular of 6 July 2017, the RBI amendment directions of 24 June 2026, the RBI Integrated Ombudsman Scheme 2026 and the other sources cited were checked on 20 October 2026. Several official sites did not load from our servers, so figures taken from PIB, MHA or NPCI material come through news and law-firm reproductions, and the text says so.

What should you do in the first hour?

Move in this order, because speed is the main variable you control.

1. Call 1930. This is the national helpline for cyber financial fraud. Police taking the call log your transaction into the Citizen Financial Cyber Fraud Reporting and Management System run by the Indian Cybercrime Coordination Centre (I4C), which sends requests to banks and intermediaries so the money can be held where possible. Reports describe an SMS acknowledgement number that you must then use to complete your complaint on the portal; that is not an FIR number.
2. File at cybercrime.gov.in using the financial-fraud option, with the acknowledgement number from the call. Have ready: the transaction ID or UTR, date and time, amount, the payee’s UPI ID or account number, the name your UPI app displayed, the seller’s profile link or website, and screenshots.
3. Write to your bank by email and in the app, quoting the transaction reference and describing it as fraud. Ask it to contact the receiving bank. Keep the complaint number.
4. Raise a complaint in your UPI app. It creates a record, even though, as explained below, it rarely reverses a payment to an individual.
5. Save everything before you block anyone: chat export, profile link, listing, payment screenshots. The guide to preserving evidence explains how.
6. Stop paying. A “customs fee”, “release fee” or “refund activation” demanded after you have paid is the second stage of the same scam.

Which rules and routes apply, with the numbers?

The table sets out each route, what it can do and its limits. The key distinction is between a transaction you did not authorise and one you made yourself.

Can the bank refund you if you paid the seller yourself?

Not as of right. The 2017 circular is about unauthorised transactions. A payment you approved with your own UPI PIN, even though you were deceived about what you were buying, is generally not an unauthorised transaction under it, and the failed-transaction rules do not apply either, because the payment succeeded. The existing guide to UPI payments to the wrong person or a scammer sets out the three cases in detail.

The 2027 framework changes the picture only partly. The final directions define a fraudulent transaction as one executed by a third party using credentials obtained from the customer through fraudulent means, or by the customer granting approval under coercion or duress from the third party, or an unauthorised transaction. They set a five-calendar-day window for reporting, require the customer to report on the cyber portal or 1930 as well as to the bank, and put the burden of proof on the bank. They also define customer negligence to include ignoring specific, clear bank warnings that a transaction is likely a scam, and where a loss is due to negligence the customer bears it until reporting, subject to the compensation scheme. A customer who sends money to an online seller and never receives the goods did not have credentials stolen and was not, on its face, under coercion. I would not assume that case is covered. Ask your bank in writing whether it treats the transaction as a fraudulent electronic banking transaction under the 2026 directions, and report within five calendar days in any case so that you keep whatever protection applies.

Does a UPI chargeback or app dispute help when you paid an individual?

Usually not for non-delivery, though you should still file it. Payment-industry accounts of NPCI’s chargeback circular of 20 June 2025 (OC 184B/2025-26) describe separate timelines for merchant payments (15 calendar days for the beneficiary side to respond) and person-to-person payments (3 calendar days), with a ground for rejecting a person-to-person chargeback when the amount was credited to the beneficiary account. I found no NPCI rule that lets a person-to-person payment be charged back because goods did not arrive. Filing still creates a dated record that helps the bank and the police.

Record the name your app showed before you paid. Under NPCI’s circular of 24 April 2025 it is the banking name fetched from address validation, not a name typed in by the user or read from a QR code, so it identifies the account holder and is the first thing an investigating officer will ask for. If the name differs from the business the seller claimed, note that in your complaint.

How does 1930 actually get money back?

It does not reverse the payment; it tries to freeze the money, and release to you comes later through a separate process. Calling does not reverse a UPI transfer, as reports on the helpline explain. A freeze works only while the money is still in an account, which is why the first hours matter. The Money Restoration Module and a Grievance Redressal Module for disputes over frozen accounts have been functional since April 2026, according to the MHA reply reported by PIB. Reports of the standard operating procedure describe a route for small held amounts and a longer one involving a court or an FIR for larger ones, but I could not verify those details from an official copy, so ask the officer handling your complaint which route applies and what documents they need.

Courts have also differed on how far police can debit-freeze an account under section 106 of the Bharatiya Nagarik Suraksha Sanhita, 2023, as against attach it by a Magistrate’s order under section 107, with the Bombay High Court in November 2025 and the Karnataka High Court in August 2026 taking different views, according to reports. For you this means that a freeze can take time to convert into a refund, and that you should keep your complaint number and chase it.

Can you pursue the seller directly?

Only if you can identify them. If the store gave a business name, address or GSTIN, you can send a legal notice and file a consumer complaint on e-Jagriti; a District Commission hears claims up to ₹50 lakh, there is no fee up to ₹5 lakh, and you can file where you live or work (section 34(2)(d)). Where the only identity is a UPI name and a number, a consumer complaint has no one to serve, and the route is the police complaint, which can lead to the account holder being identified through the bank. Section 2(47)(vii) and (viii) of the Consumer Protection Act (not issuing a bill; refusing to refund) remain useful if the seller turns out to be a real business that simply stopped answering.

What should you not do?

• Do not pay a “recovery agent” or anyone who calls after you complain, claiming to be from a cyber cell, a bank or a lawyer, and asking for a fee, an OTP or remote access. This is a documented follow-on scam. The guide to losing money to an online scam explains why.
• Do not enter your UPI PIN or approve a collect request to “receive” a refund. RBI’s press release of 28 January 2022 says receiving money does not require scanning a QR code or entering an MPIN.
• Do not delete the chat or the payment record, and do not edit screenshots. Export the chat; see what a WhatsApp chat proves.
• Do not wait for the seller’s next excuse. The three working days and the five calendar days in the rules above both run from the moment of the transaction or the bank’s alert.
• Do not rely on the Sanchar Saathi “Chakshu” facility to recover money. It is for reporting suspected fraud calls, SMS or WhatsApp messages; losses go to 1930 and the cybercrime portal.

How do you avoid this next time?

Do not make a first payment to an individual’s UPI ID for an online order. Use cash on delivery or a gateway checkout, and read the payee name before you confirm. The guides to checking an Instagram or WhatsApp seller, cash on delivery versus prepaid and the first 24 hours of an online shopping scam go through the checks. For a bank that does not act, see complaining about a bank.

Frequently asked questions

I paid a personal UPI ID for an online order and got nothing. Will I get my money back?

Not automatically. Call 1930 and file at cybercrime.gov.in at once so the receiving account can be held, and write to your bank. RBI’s current limited-liability rules cover unauthorised transactions, not payments you made yourself to a seller, so recovery depends mainly on the money still being in the receiving account.

How soon must I report a fraudulent UPI payment?

Immediately. Under the 2017 circular, an unauthorised transaction reported within three working days of the bank’s communication means zero liability for a third-party breach. For transactions on or after 1 January 2027, RBI’s amended directions use five calendar days, and require reports to both the bank and the cyber portal or 1930.

Does the RBI’s 2027 framework cover payments to fake sellers?

Not clearly. It covers fraudulent transactions where credentials were obtained by fraud or approval was given under coercion or duress, and adds compensation of 85% of net loss up to ₹25,000 for qualifying small-value cases. A payment you knowingly sent to a seller who never delivered does not obviously fit, so ask your bank in writing and report within five calendar days.

What does calling 1930 actually do?

It logs your complaint into the national cyber financial fraud system, which sends requests to banks to hold the money where it can be traced. It does not reverse the transfer, and it works best in the first hours, before the money is withdrawn.

Can I complain to the RBI Ombudsman about a payment to a scammer?

Only about a deficiency in your own bank’s service, not about the scammer. Wait 30 days for the bank’s reply, then file at cms.rbi.org.in within 90 days under the 2026 scheme. It is free of charge, and the Ombudsman cannot order the seller to refund you.

Should I pay someone who says they can recover my money?

No. Callers who ask for an advance fee, an OTP or remote access to your phone are running a follow-on scam aimed at people who have already complained. Genuine processes never require you to send money to get money back.