Unsolicited UPI Credit of ₹6,000 – Your Legal Rights and Steps Under Indian Law

One of my clients recently had a case which I am explaining below and if you are stuck in such similar situation, here is what to do.

Note: Due to attorney-client privilege, I cannot disclose complete case details or identify the actual parties involved. However, I am sharing the essential facts and legal approach so that if you find yourself in a similar situation, you can understand the available solutions and legal remedies.

TL;DR: Receiving an unsolicited UPI credit does not make the money yours. Do not spend it. Do not refund it yourself if someone asks. Inform your bank by email immediately, and if the amount is significant or suspicious, file a complaint with the cyber crime portal and your local police. The safest step is to ask the bank to reverse the transaction so you are not held liable later.

One of my clients, Priya Mehta from Indore, woke up to a ₹6,000 credit in her HDFC Bank account via UPI. The sender was shown as "Rajesh Kumar S O Mohan Lal" — a complete stranger. She checked all her recent transactions, but nothing matched. No one called. No message came. For two whole days, she sat on the money, unsure what to do. Her father suggested she approach the local police. But they told her to "wait and see." That's when she reached the Chamber of Advocate Sudhir Rao. The situation was tricky — if the money was from a scam or a stolen account, her account could be frozen without warning. And if she spent it, she could face criminal allegations of cheating or theft. Advocate Sudhir Rao and his office guided her to immediately email her bank to flag the transaction, then file a formal complaint at the cyber crime portal. The email served as documented proof that she had no fraudulent intent. The bank reversed the credit after verifying the sender's complaint. No lien was placed. No police case against her. The key was acting fast and formally — not waiting and hoping.

Key Facts of the Case

• The client received ₹6,000 via UPI from an unknown sender she had no prior dealings with.
• She did not spend, transfer, or touch the amount at any point.
• She contacted her bank via official email within 48 hours, documenting the unsolicited credit.
• The cyber crime portal complaint was filed under the specific category of "Financial Fraud – Unsolicited Credit".
• The sender had apparently used a compromised account; the client's account was not linked to any crime.
• The bank reversed the transaction at the sender's request, and the client's account was cleared of all suspicion.
• No police complaint was filed against the client; her proactive steps prevented any adverse action.

The Direct Legal Answer

First things first: receiving money you did not expect does not give you ownership. Under the Indian Contract Act, 1872, there is no valid contract for this transfer. You cannot keep it. But here's the thing — you also cannot just send it back manually. That's the trap. Scammers rely on victims refunding directly, then later claiming they never received it or that you stole it.

Should I contact my bank?

Yes — immediately. Send an email to your bank's customer care or grievance officer stating the exact transaction details, date, amount, and sender's name. Say you do not know the sender and request a reversal. Keep the email as proof. Do not rely on phone calls alone.

What if someone calls and asks for a refund?

Do not send it back via UPI yourself. Tell them to approach their own bank for a chargeback or reversal. Your job is to flag it. Refunding manually puts you at risk of being accused of unauthorised use or fraud if the transaction is later disputed.

Is this a fake loan app scam?

Possibly. Some apps send a small "forced loan" via UPI to your account, then demand repayment with interest. Even if no one contacts you yet, that doesn't mean it's safe. The contact may come later. So document everything now.

Advice in Such Cases

Consult with Lawyer: The very basic and important step to start is talk to Lawyer / advocate. You should not hesitate in paying his consultation fee i.e. might be in range of Rs. 10,000 to 50,000 depends case to case. He is helping you in this situation to come out. He is expert in the domain and can help you explain the procedure which you might have never explored. A good lawyer can get the issues resolved much faster than you think.

Second, never touch the money. Withdraw your own funds to a separate account to protect them from possible bank lien. Leave the disputed amount untouched. Third, file a complaint on the National Cyber Crime Reporting Portal (cybercrime.gov.in) under "Report Other Financial Fraud." This creates a formal record and prevents you from being treated as the accused if the sender's account was hacked.

This type of matter — financial cyber fraud linked to UPI — requires an advocate familiar with banking regulations, cyber law, and BNSS procedures. A general practitioner may not know how to handle lien prevention or coordinate with the bank's cyber cell quickly. Domain-specific experience makes a real difference in getting the bank to act fast and in protecting your account from freezing.

Applicable Sections of Law

• Section 318(4) of the Bharatiya Nyaya Sanhita (BNS), 2023 – Dishonest misappropriation of property: applicable if the recipient spends or retains the money knowing it belongs to another person. Maximum punishment of up to 2 years, fine, or both.
• Section 319 BNS, 2023 – Criminal breach of trust: can be invoked if the recipient is seen as a "trustee" of the mistakenly credited funds and fails to return them.
• Section 48 of the Information Technology Act, 2000 – Read with the IT (Reasonable Security Practices) Rules, the bank is obligated to address unauthorised transactions, and you must report promptly to limit liability.
• Reserve Bank of India's Master Direction on Digital Payment Security Controls, 2021 – These circulars make it clear that customers must report unauthorised transactions within 3 working days to avoid being held liable.

Punishment and Penalties

• Under Section 318(4) BNS: Imprisonment up to 2 years, or fine, or both. Non-cognizable and bailable.
• Under Section 319 BNS: Imprisonment up to 3 years, or fine, or both. Non-cognizable and bailable.
• Nature of offence: Both are non-cognizable, meaning police cannot arrest without a warrant. Both are bailable. Neither is compoundable — but in practice, returning the money often leads to closure.

Jurisdiction — Where to File the Case

For criminal complaints regarding UPI fraud, jurisdiction lies with the police station having territorial jurisdiction over the place where the recipient's account is located, or where the transaction occurred. The cyber crime cell is often the appropriate first stop. For civil recovery of wrongfully retained funds, the civil court of the area where the recipient resides or where the bank branch is located will have jurisdiction. Getting jurisdiction right matters — filing in the wrong forum wastes time and can result in dismissal.

If You Are the Victim

• Do not spend or transfer the unsolicited money under any circumstances.
• Email your bank immediately, requesting reversal and keeping a copy of the communication.
• File a complaint on the National Cyber Crime Reporting Portal (cybercrime.gov.in).
• If the amount is large or you suspect a fake loan app, approach your local police station and file a written complaint.
• Document every call or message you receive about this money — note the number, time, and what was said.

Documents You Must Keep Ready

• Bank account statement showing the unsolicited credit entry
• Screenshot of the UPI transaction with sender's UPI ID and transaction reference
• Copy of the email you sent to your bank regarding the transaction
• Your Aadhaar card or other government-issued photo ID
• Any communication (SMS, call logs, messages) from the sender or third parties
• Your PAN card for KYC purposes if needed

What Evidence Is Required?

• Bank statement clearly showing the date, time, amount, and sender details of the unsolicited credit.
• Screenshots of your UPI app showing the transaction entry and sender's name.
• Copy of the email or written communication to the bank about the unsolicited credit.
• If contacted by the sender, preserve call recordings (if legally obtained), SMS, or chat screenshots.
• Any response from the bank or cyber crime cell acknowledging your complaint.
• Secondary evidence: your own affidavit stating the facts, attested by a notary, can be used to support your version.

How Courts Typically Approach Such Cases

Civil courts and criminal courts view unsolicited UPI credits with suspicion — not against the recipient, but against the possibility of fraud or mistaken transaction. Courts generally expect the recipient to act in good faith: report it, not spend it, and cooperate with the bank. If the recipient has done nothing wrong and has documented their actions, courts are unlikely to penalise them. However, if you keep the money or refund it manually without documentation, the court may see that as negligence or even dishonest misappropriation.

Timeline of Legal Process

• Step 1: Report to bank — 1-2 days. The bank may reverse the transaction within 3-7 working days if the sender also complains.
• Step 2: Cyber crime complaint — filed online immediately. Acknowledgment within 24-48 hours.
• Step 3: If police complaint is filed, investigation usually takes 30-60 days for a simple unsolicited credit case.
• Step 4: If chargesheet is filed and you are made an accused (rare if you acted properly), trial may take 6-12 months depending on court workload.
• Step 5: Appeal, if any, can take another 6-18 months.
• Duration: Most such cases resolve within 1-2 months if you act fast and the sender cooperates. Full litigation can stretch to 2-3 years.

How Long Will the Investigation Take?

For a simple unsolicited UPI credit with no linked criminal activity, the cyber crime cell investigation is usually completed within 30 to 45 days. The police will verify the transaction trail through NPCI and the UPI app provider. If the sender's account was hacked, the investigation may take longer — up to 90 days — to trace the actual fraudster.

Understanding the Costs

The total cost of a matter like this varies significantly from one case to the next — it depends on the complexity of the dispute, the forum involved, the number of hearings, and the specific facts of your situation. There is no single fixed figure that applies to everyone.

A professional advocate can give you an accurate estimate only after reviewing all your facts and documents in a consultation.

Can the Matter Be Settled Out of Court?

Absolutely. Most unsolicited UPI credit disputes are resolved through the bank's reversal process without any court involvement. If the sender contacts you and agrees to a chargeback through their own bank, you can simply cooperate and the money will be reversed. No complaint is needed. However, if the sender has filed a police case against you, a formal settlement may require the sender to withdraw the complaint. In criminal matters, compoundable offences like dishonest misappropriation (Section 318(4) BNS) can be settled between the parties, but non-compoundable offences require court approval. Settlement through Lok Adalat is also an option for pending civil disputes.

Common Mistakes People Make

• Spending the unsolicited money — this can lead to criminal charges of dishonest misappropriation under Section 318 BNS.
• Refunding the money manually via UPI without any documentation — this leaves you without proof if the sender later denies receiving it.
• Not informing the bank in writing — verbal calls are not enough; you need an email trail as evidence.
• Waiting too long — the RBI's 3-working-day window for zero liability reporting can expire, making you liable for the loss.
• Engaging a lawyer who does not regularly handle UPI fraud or cyber law matters — this type of case requires familiarity with the IT Act, RBI circulars, and bank reversal procedures. A general practitioner may not know the quickest way to get a lien removed or how to coordinate with the cyber cell efficiently.

FAQs People Normally Have

Can I keep the money if no one claims it?

No. Legally, the money belongs to the sender. Keeping it amounts to dishonest misappropriation. Even if no one claims it for years, the rightful owner can still recover it. Do not spend it.

Will my account be frozen?

It can be. If the sender reports the transaction as fraudulent, the bank may place a lien on your account. To prevent this, withdraw your own funds to a separate account and leave the disputed amount untouched.

What if I already spent the money?

You must inform the bank immediately and arrange to repay the amount. Deliberate spending after knowing it's not yours can lead to criminal prosecution. Act fast.

Do I need a lawyer for just ₹6,000?

You may not need a lawyer for the bank reversal itself. But if the police or bank treats you as a suspect, having a lawyer who understands cyber fraud and banking law can prevent unnecessary legal headaches. It's better to consult early than to scramble later.

What is the 1930 helpline?

1930 is the National Cyber Crime Helpline. You can call it to report financial fraud, including suspected cases of unsolicited credits linked to fraud. They can guide you on next steps and connect you with the cyber crime cell.

This article is general legal information, not legal advice. Consult a qualified advocate about your specific situation.

Advocate Sudhir Rao, Supreme Court of India

Facing a similar matter? Speak to a criminal advocate in Delhi — Advocate Sudhir Rao appears in bail, trial and appellate matters before the Delhi District Courts, the Delhi High Court and the Supreme Court of India.