Charges on UPI Payments: Is a 0.5% Surcharge Legal?

One of my clients recently had a case which

In short: if the police or a cyber crime cell has called you, or a notice has arrived at your address, the one thing that matters most is that you reply in writing inside the time given. Whether you are the person who lost money or the person whose name has come up, the first few days usually decide how the rest of it goes. What follows is the procedure, the deadlines you are actually facing, and what to send us.

A caveat before anything else: we have only your account of what happened. That is normal — in almost every one of these matters the first version of events is one-sided, and it changes once the other side produces its records. Read the rest with that in mind.

The Police Have Called Me About a Cyber Crime Case. What Do I Do First?

Answer it. Not on the phone in a panic, and not by turning up at the police station alone at 9 p.m. to explain yourself. Answer it in writing.

Three steps, in this order:

• Write down who called, from which number, on what date, and what they said. A note in your phone is enough.
• Ask for the complaint or FIR number in writing — by email or WhatsApp if they have given you a contact. If it is a genuine investigation, there is a number and the officer can share it.
• Do not delete anything. Chats, emails, call logs, bank statements, screenshots of the transaction. People often clear their phone the day after a fraud call, and that is exactly the material that later shows what happened.

If money has moved out of your account, call 1930 and file on the National Cyber Crime Reporting Portal the same day. Banks can stop funds that are still sitting in a downstream account. Once they have been withdrawn in cash or pushed through a chain of mule accounts, recovery becomes a long, uncertain exercise — that is the honest position, and no lawyer can change it.

Are You the Complainant or the Person Named?

The law is the same. Your position is not.

If you are the person who lost money, you are pushing the system forward. Your job is paperwork: complaint, reference number, bank chargeback request, follow-up.

If you are the person whose account, number or name has appeared in someone else's complaint — a mule account you rented out, a UPI ID you lent, a company you are a director of — you are being investigated. Your job is different. Everything you say to the police can be used, and a casual "I'll explain, it's nothing" conversation at a counter is not a strategy.

The Key Facts at a Glance

• You do not have to solve this on the phone. Ask for the requisition or notice in writing.
• A notice to appear is not the same as an FIR. Very often it is a preliminary step before a case is registered, or a step within an investigation already registered.
• Ignoring a notice is the worst option. A notice that is served and not complied with can lead to arrest in a case where you would otherwise have walked in and walked out.
• Accounts can be frozen without you being told first. If that has happened, the bank will usually say which police unit sent the instruction.
• Electronic evidence runs both ways. IP logs, device records and bank trails are usually better evidence for you than any statement you make.
• Time limits in the BNSS are short. Where a notice gives you a date, treat that date as fixed.

What a Notice Under Section 35 BNSS Actually Requires

The Bharatiya Nagarik Suraksha Sanhita, 2023 replaced the Code of Criminal Procedure. Section 35 BNSS is the provision under which a police officer issues a written notice asking a person to appear. Its purpose is to avoid unnecessary arrest. It is not an invitation and it is not optional.

What it means in practice:

• You must appear on the date and at the place stated, or ask for a different date in writing with a reason.
• You should take a copy of the notice with you, and keep the original.
• You are entitled to know what you are being asked about before you are questioned at length.
• If the notice is not complied with, the officer can proceed to arrest. Courts have repeatedly treated a served-and-ignored notice as a serious factor.

Where the police want documents — bank statements, server records, invoices, KYC papers — they may issue a summons to produce. Bring certified copies and keep the originals. Do not hand over your only original of anything.

If You Are the One Being Investigated

Most cyber fraud cases that reach a named accused are built on two charges: cheating, now Section 318 of the Bharatiya Nyaya Sanhita, 2023, and the offences under the Information Technology Act dealing with identity theft and cheating by personation using a computer resource — Sections 66C and 66D. Where several people are shown as acting together, Section 61 BNS (conspiracy) or Section 3(5) BNS (common intention) is usually added.

Two things follow from that.

First, the prosecution has to connect you to the fraudulent act, not merely to a bank account or a number. Being a director of a company whose account received funds, or the registered owner of a SIM that was used, is a starting point for the police, not a finding of guilt. The defence almost always lies in the device and transaction records.

Second, the timing of your first statement matters. If there is a real risk of arrest, anticipatory bail under Section 482 BNSS is the route, and it is better applied for before a notice turns into a custody situation than after.

Do I need a lawyer for a first appearance?

For a witness summons, usually not. For anything where your own conduct is in question — yes, and before the visit rather than on the morning of it.

Article 22(1) of the Constitution gives you the right to consult a lawyer of your choice and to be defended by one. That right starts from arrest. During questioning, a lawyer sitting in the room changes the texture of the conversation: the officer knows someone is taking notes, and the questions become narrower.

What the first appearance is actually for is simple. Get the notice on record, read the complaint rather than the rumour, find out what you are said to have done, and settle the terms on which you will cooperate. If the account against you points to custody, an anticipatory bail application under Section 482 BNSS is filed before the appearance, not after. That sequence is not a formality. It is most of the case.

What Happens to a Frozen Bank Account?

Freezes rarely arrive with a letter. You find out at the ATM, or when a salary credit bounces back, or when a supplier says your transfer failed. This is the most common way a person discovers there is a cyber crime case with their name somewhere in it.

The bank is not the decision-maker. It acts on a written instruction from an investigating officer or a cyber cell. So the first request is to the bank, in writing: which police unit sent the instruction, on what date, what is the reference number, and is the freeze a lien for a fixed amount or a full debit freeze. A lien on the disputed sum and a freeze on the entire account are different problems, and people often assume the worse one.

After that, the approach is a representation to the investigating officer with the documents that show how the money reached you — invoices, purchase orders, delivery proofs, prior transactions with the same party. Where that does not move things, an application before the court seized of the matter. The BNSS does allow a court to attach property connected to an offence and to restore it on conclusion of the case, but restoration is the end of the process, not the middle of it.

One practical warning. Do not route business receipts through a relative's account while your own is frozen. It looks like an attempt to move funds, and officers read it that way.

How Long Does a Cyber Crime Case Take?

There is no honest single answer, so here is the shape of it.

• The freeze: weeks if the officer is satisfied and closes the account holder out; several months if the money is still in dispute.
• The investigation: where a person is in custody, there is a fixed outer limit — sixty or ninety days depending on the punishment the offence carries — and bail follows if the charge sheet is not filed within it.
• The trial: years. Cyber crime trials in most districts run slowly, and the evidence is largely documentary, which is both a strength and a reason for delay.
• Recovery of the money: unpredictable. If the funds are sitting in a downstream account, a quick report gives the bank a real chance. If they have been withdrawn in cash or pushed through a chain of accounts, recovery is a long shot.

That last line is the one people do not want to hear. It is still the truth, and a lawyer who tells you otherwise on day one is selling something.

Things That Make It Worse

• Deleting chats, clearing call logs, or formatting a phone the week after a notice arrives.
• Contacting the complainant directly, or through a mutual friend, to "sort it out".
• Signing a statement you have not read, or that is written in a language you do not follow.
• Handing over your only original invoice, purchase order or agreement.
• Ignoring the second notice because you answered the first.
• Paying anyone who promises to recover the money or "close the case" for a fee. Recovery agents are a growing fraud on top of the original fraud.
• Treating a WhatsApp message with a police logo and a seal as an official notice. Calls purporting to be from a cyber cell are themselves a common fraud. Verify through the local station or the number published on the official portal before you send anyone a document.

What to Send Us, and Where

Send the notice, summons or complaint as a photograph or PDF. Note its date and the police station or unit on it. Add two lines on what you think it is about, and whether any account of yours is currently frozen. Do not send passwords, OTPs, PINs or netbanking credentials — to us or to anyone.

Write to me@sudhirrao.com or call +91 97295 06771. The chamber is at Lawyers' Chamber, Chamber No. 86, Supreme Court of India, New Delhi 110001, and that is the only office. You can also use the form at /contact-us or pick a time at /book. If the matter carries a family or matrimonial angle — a complaint filed during a separation, access to a spouse's accounts — say so, since Adv. Jyoti Rao, Bar Council of Delhi D/891/2023, handles that side.

Frequently Asked Questions