Phone Hacked UPI Fraud: What to Do After Money Loss

One of my clients recently had a case which I am explaining below and if you are stuck in such similar situation, here is what to do.

Note: Due to attorney-client privilege, I cannot disclose complete case details or identify the actual parties involved. However, I am sharing the essential facts and legal approach so that if you find yourself in a similar situation, you can understand the available solutions and legal remedies.

TL;DR: A phone hacked UPI fraud is a criminal offence, not a customer service problem. Report it to the bank and the cyber cell immediately, register the FIR without delay, and preserve the handset as it is. The money can often be traced and frozen if the complaint moves in the first few days.

The call came on a Sunday afternoon in March 2025. One transaction of about ₹12,000 had left the account, and it was everything that was sitting there. Mrs. Kavita Iyer, a retired schoolteacher in Pune, handed her phone to her nephew, who opened the settings and found a sideloaded streaming app with accessibility permissions switched on. That was the whole trick. That one permission let the app read the screen and tap on her behalf. When it opened, its splash screen flashed a rude gesture at whoever was looking. She laughed about it that evening. Nobody laughed for long.

The bank accounts were frozen soon after she reported the matter, which is routine once a fraud is flagged on an account. An FIR was registered at the cyber cell in Pune. Then nothing moved. Weeks passed and no one examined the handset. Her first approach, through a lawyer who did not handle cyber matters, produced a written complaint and little else.

She came to the Chamber of Advocate Sudhir Rao in April 2025. The phone was preserved rather than wiped, the accessibility logs and app permissions were documented, the freeze was taken up with the bank's nodal officer, and the investigating officer was pursued until the handset was sent for forensic examination. Advocate Sudhir Rao's work in cyber crime and economic offence matters shaped how the complaint was framed, which is what moved the file forward. The accounts were released and the investigation acquired a direction it had not had before.

Key Facts of the Case

• The client's relative, a retired schoolteacher in Pune, lost roughly ₹12,000 from her account through a UPI transaction she never authorised.
• The loss was caused by a sideloaded streaming app that had been granted accessibility permissions, letting it read the screen and operate the phone.
• An FIR was registered at the local cyber cell and the bank accounts were frozen as a precaution.
• The handset was not examined at the time of registration, and the investigation stalled for weeks.
• A general practitioner's complaint produced paperwork but no movement on the technical side.
• The matter was then brought to the Chamber of Advocate Sudhir Rao, where the device was preserved and a forensic examination was pursued.
• The account freeze was lifted, and the complaint was reframed around the accessibility abuse and the unauthorised transaction.

Was This Really a Phone Hacked UPI Fraud?

Yes, and the label decides who acts. A phone hacked UPI fraud of this kind is not a dispute about a wrong PIN or a failed transaction. It is unauthorised access to a computer resource, followed by the transfer of money out of an account. That pulls in the police, the Information Technology Act and the bank's own fraud machinery at the same time. Treat it as a branch-level service complaint and you will spend months in a queue while the money hops through three or four mule accounts.

What the criminal law treats it as

The technical route here was an accessibility permission, but the legal character of the act does not depend on which permission was abused. Once an app operates the phone without the owner's real consent and money leaves the account, the following provisions are ordinarily in play:

• Section 66C, Information Technology Act, 2000 — identity theft. Dishonest or fraudulent use of another person's password, electronic signature or any other unique identification feature. Punishment extends to three years and a fine up to ₹1 lakh.
• Section 66D, IT Act — cheating by personation using a computer resource or a communication device. Same scale of punishment.
• Section 66 read with Section 43, IT Act — where the access or interference is done dishonestly or fraudulently. Up to three years, or a fine up to ₹5 lakh, or both.
• Section 318(4), Bharatiya Nyaya Sanhita, 2023 — cheating and thereby dishonestly inducing delivery of property. This carries up to seven years and a fine, and it is the charge you will most often see on an FIR of this kind.
• Section 319, BNS — cheating by personation.
• Section 61, BNS — criminal conspiracy, where more than one person is involved. In mule-account cases that is the norm rather than the exception.
• Section 316, BNS — criminal breach of trust, where the person who took the money was entrusted with the device or the account.

Which of these is actually invoked is for the investigating officer and, later, the prosecutor. It is not something a complainant gets to choose. What the complainant controls is how clearly the technical facts are placed before them, and that is where most files either move or stall.

Where the FIR gets registered

Under Section 173 of the Bharatiya Nagarik Suraksha Sanhita, 2023, information about a cognizable offence may be given orally or by electronic communication to the officer in charge of a police station. Electronic filing is now expressly contemplated, which helps in cyber cases where the victim and the offence sit in different states.

Two practical points matter here:

• A zero FIR can be registered at any police station, regardless of where the offence took place, and is then transferred to the station with jurisdiction. For a UPI fraud, jurisdiction is usually where the account is held or where the victim was sitting when the transaction happened.
• In most districts the cyber cell handles the technical side. Registering at the local station and at the cyber cell in parallel is common and does no harm, provided you keep the numbers straight and do not let two parallel files confuse the record.

Separately, reporting on cybercrime.gov.in or the 1930 helpline is not a substitute for an FIR, but it is the fastest route to a freeze request going out to the recipient banks. The difference between a freeze that works and one that does not is usually measured in hours, not weeks.

What the bank owes you, and by when

The Reserve Bank of India's 2017 framework on limiting customer liability in unauthorised electronic banking transactions is the operative document for the money side. Broadly, and subject to the facts of each case:

• If the unauthorised transaction is reported within three working days, the customer's liability is zero.
• If the deficiency is on the bank's part — a compromised system, a failure of controls — the customer's liability is zero regardless of when it was reported.
• If reporting happens after three working days but within seven, liability is limited and is determined by the bank's policy approved by its board.
• Beyond seven working days, liability follows the bank's policy.

The same framework contemplates the bank crediting the amount provisionally within a defined period of the complaint, and a per-day compensation where it does not. In practice, the speed of the credit depends entirely on whether the complaint was put in writing and acknowledged.

If the bank does not deal with a written complaint within about thirty days, the route is the Reserve Bank – Integrated Ombudsman Scheme, 2021. That is a free remedy and it does not need a lawyer to file, though a well-drafted complaint does tend to get read more carefully.

The handset is the scene of the offence

This is the part that gets lost. In the file described above, the phone sat unexamined for weeks while the investigation went nowhere. A handset that has been factory reset, or from which the offending app has been uninstalled to "clean it up", has been destroyed as evidence in a way that no one can undo.

Two things follow. First, do not reset the phone, do not uninstall anything, and do not let a phone shop "fix" it. Second, the forensic report on the device is the piece of evidence that ties the app, the permission, the session and the transaction together. Without it, the case often comes down to the bank's log against the customer's word.

On admissibility, the Bharatiya Sakshya Adhiniyam, 2023 governs electronic records. Section 63 provides for their admissibility, with a certificate under sub-section (4) accompanying the record. This certificate is exactly the sort of procedural detail that decides appeals years later, and it is worth asking the investigating officer, in writing, whether the forensic report and certificate are on the file.

What actually moved this file

Three things, none of them dramatic.

The complaint was reframed. Instead of "money was taken from my account", it described an app with accessibility permissions operating the screen, and identified the transactions as unauthorised operations rather than disputed ones. That reframing changed the offence the file was being read under.

The bank's nodal officer was pursued in writing until the freeze was addressed, rather than being left to the branch.

And the investigating officer was asked, in writing and repeatedly, to send the handset for examination. In cyber matters, the difference between a live file and a dead one is often whether the victim keeps a paper trail of requests.

What to Do First — the Sequence

1. In the first hour: call the 1930 helpline and file a report on cybercrime.gov.in. This is what triggers the freeze request to the recipient banks.
2. The same day: inform the bank in writing, by email to the branch and to the nodal officer, and ask for the acknowledgement and the complaint reference number.
3. Within a day or two: register the FIR at the cyber cell or the nearest police station, and get a copy with the FIR number and date.
4. Immediately after: email the FIR copy to the bank and ask them to note it against the freeze request.
5. Throughout: keep the handset exactly as it is. Note down the app name, the date it was installed if visible, and the permissions it holds — with screenshots, before anything changes.
6. Follow up: keep a written record of every request to the investigating officer, particularly the request for forensic examination.
7. If the bank does not resolve it in about thirty days: file before the RBI Ombudsman.

Where There May Be Nothing to Argue

It is worth saying this plainly rather than after a fee has been paid.

If the OTP was shared by the account holder, or a collect request was approved knowingly, the transaction is authorised and the criminal law route largely closes. The bank's liability framework treats that differently, and so does a court.

If the fraud was reported after seven working days and there is no sign of a deficiency on the bank's part, the customer's liability is governed by the bank's own board-approved policy, and the room to argue is narrow.

If the money has already been withdrawn in cash from the terminal account, recovery is difficult regardless of how well the investigation is run. Tracing produces a chain; it does not always produce funds.

And where the handset has been reset, or the app removed, or the phone replaced, the single most useful piece of evidence is gone. That does not end the matter, but it does change what is achievable.

Frequently Asked Questions

What to Send, and Where

If you want the file examined, send the following to the chamber — the FIR copy with its number and date, the bank statement showing the unauthorised entries, the complaint reference from the bank and from cybercrime.gov.in if you have one, a screenshot of the app permissions if the phone is still with you, and a two-line note on what happened and when. That is enough to work out whether there is anything to pursue and what the realistic outcome looks like.

You can send it through the contact form or book a time to speak. Bring the handset question up first — whether the phone has been reset decides more about this case than anything else in the file.

This article is general information about Indian law and is not legal advice on your own situation. Every case turns on its own facts.

Advocate Sudhir Rao, Supreme Court of India

Facing a similar matter? Speak to a criminal lawyer in Delhi — Advocate Sudhir Rao appears in bail, trial and appellate matters before the Delhi District Courts, the Delhi High Court and the Supreme Court of India.