One of my clients recently had a case which I am explaining below and if you are stuck in such similar situation, here is what to do.
Note: Due to attorney-client privilege, I cannot disclose complete case details or identify the actual parties involved. However, I am sharing the essential facts and legal approach so that if you find yourself in a similar situation, you can understand the available solutions and legal remedies.
TL;DR: Money lost in a UPI scam is recoverable if you act fast. File a complaint on the National Cyber Crime Reporting Portal, lodge an FIR at the local police station, and alert your bank within the golden hour. With the right legal strategy, funds can be frozen and traced.
Rohan Mehta sat staring at his father’s phone on a humid evening in Indore. The message from HDFC Bank was polite but devastating. ₹12.4 lakhs gone. A UPI handle he didn’t recognise had been linked to the account. The scammer had somehow cloned the app, wiped the savings, and even took the small fixed-deposit balance. By the time his mother called him, the money had already been moved through three different accounts. They filed a complaint on the cybercrime portal that same night, but the response was slow. No FIR. No freezing of accounts. That’s when Rohan approached the Chamber of Advocate Sudhir Rao, desperate for a breakthrough. The office immediately drafted a detailed complaint and a reminder under Section 173(4) of the Bharatiya Nagarik Suraksha Sanhita (BNSS) for non-registration of FIR. A parallel petition under Article 226 of the Constitution was kept ready. And here’s the thing—within 48 hours of the legal notice, the investigating officer registered the FIR and issued a freeze order to the beneficiary bank. Some funds were still sitting in a wallet. Advocate Sudhir Rao’s expertise in cybercrime matters helped secure that order before the money vanished entirely. Because in these cases, every hour counts.Key Facts of the Case
- The victim’s UPI app was duplicated without their knowledge.
- Total amount lost: approximately ₹12.4 lakhs from two savings accounts.
- Complaint raised on the National Cyber Crime Reporting Portal within 3 hours.
- Local police initially delayed registering an FIR.
- Advocate Sudhir Rao’s office filed a representation for FIR registration and imminent fund freeze.
- Beneficiary account partially frozen; recovery of significant portion underway.
The Direct Legal Answer
Yes, money lost in a UPI scam is often recoverable—especially if you report the incident within the first 24 hours. The process involves three parallel tracks: an online complaint to the cyber cell, a formal FIR at the police station, and an urgent request to your bank to flag and freeze the beneficiary account. The police can then invoke Section 318 of the Bharatiya Nyaya Sanhita (BNS)—cheating—and Section 61 of the Information Technology Act, 2000. The National Cyber Crime Reporting Portal (cybercrime.gov.in) is your first stop. Don’t wait for a callback. Follow up relentlessly, and if the police refuse an FIR, you have legal recourse to compel them.
Advice in Such Cases
Consult with Lawyer: The very basic and important step to start is talk to Lawyer / advocate. You should not hesitate in paying his consultation fee i.e. might be in range of Rs. 10,000 to 50,000 depends case to case. He is helping you in this situation to come out. He is expert in the domain and can help you explain the procedure which you might have never explored. A good lawyer can get the issues resolved much faster than you think.
Contact your bank’s fraud desk immediately. Ask them to block your UPI IDs and hotlist the beneficiary’s account. File a complaint on the National Cyber Crime Reporting Portal—this generates an acknowledgment number that is crucial for the police. Preserve all: call recordings, SMS alerts, and transaction screenshots. And make sure the advocate you engage has handled cyber fraud matters before. The procedural nuances—tracing IP links, freezing wallets, coordinating with fintech grievance officers—are entirely different from ordinary theft cases. A practitioner unfamiliar with digital evidence can miss the narrow window for fund recovery.
Applicable Sections of Law
- Section 318(4) BNS: Cheating and dishonestly inducing delivery of property.
- Section 316(2) BNS: Criminal breach of trust.
- Section 61 Information Technology Act, 2000: Punishment for identity theft.
- Section 66C IT Act: Punishment for identity theft; Section 66D for cheating by personation.
Punishment and Penalties
Under Section 318(4) BNS, imprisonment up to seven years and a fine. The IT Act’s Section 66C provides imprisonment up to three years and a fine. Both offences are cognizable and non-bailable. They are not compoundable without court permission, given the involvement of digital fraud and public interest. Upon conviction, courts can also award compensation to the victim under Section 396 of the BNSS, covering the lost amount and ancillary expenses.
Jurisdiction — Where to File the Case
You can file an FIR at the local police station where the victim resides or where any part of the offence occurred—including the place from where the scam call originated or where the money was received. For cybercrimes, the jurisdictional Magisterial Court is typically the court within whose jurisdiction the complainant resides. The National Cyber Crime Reporting Portal automatically routes your complaint to the appropriate cyber police station. In multi-state UPI scams, this is a blessing—no running around between jurisdictions.
What if Police Refuse to File FIR?
- Submit a written complaint to the Superintendent of Police under Section 173(4) BNSS. The SP must direct investigation if a cognizable offence is disclosed.
- File a private criminal complaint before the jurisdictional Magistrate under Section 175(3) BNSS. The court can order the police to investigate.
- As a last resort, approach the High Court under Article 226 for a writ of mandamus directing the police to register an FIR.
- Keep all refusal acknowledgments and written communication—these become evidence of police inaction.
Rights of the Accused
While this is a victim-centric article, understanding the accused’s rights is essential to avoid lapses in investigation and trial.
- Right against self-incrimination under Article 20(3) of the Constitution.
- Right to be informed of the grounds of arrest.
- Right to legal representation—a lawyer must be present during custodial interrogation.
- Right to be produced before a Magistrate within 24 hours of arrest.
- Right to obtain a copy of the FIR.
Bail Provisions
The offences under Section 318 BNS and Section 66C/66D IT Act are non-bailable. Anticipatory bail is available under Section 482 BNSS—the accused can apply to the Sessions Court or High Court. Regular bail is sought after arrest under Section 480 BNSS. Courts typically impose conditions like surrendering the passport, not tampering with evidence, and cooperating with the investigation. For a first-time offender with no criminal antecedents, bail is usually granted on the ground that the accused is unlikely to flee.
Quashing of FIR / Case
An FIR can be quashed by the High Court under its inherent powers in Section 528 BNSS. Grounds include: the complaint doesn’t disclose a prima facie cognizable offence, the dispute is purely civil and the criminal proceeding is an abuse of process, or the parties mutually settle a compoundable offence. In UPI scams, quashing is uncommon because the fraud is usually clear, but it may apply if the accused can show that the transaction was a genuine one and the complaint is motivated.
If You Are the Victim
- Report the fraud on the National Cyber Crime portal within the first hour—use the helpline 1930.
- Visit your bank branch personally. Submit a written complaint to the branch manager and the nodal officer.
- Preserve all evidence: screenshots, call logs, WhatsApp chats, and SMS. Do not delete anything, even if it looks trivial.
- Engage an advocate who regularly handles cybercrime matters. They’ll know how to file a petition for freezing accounts and tracking mule accounts.
- Do not engage with the scammer yourself—no threats, no negotiation. Let your advocate handle it.
Documents You Must Keep Ready
- Aadhaar card and PAN card of the victim.
- Bank account statement showing the disputed transactions.
- Copy of the complaint filed on the National Cyber Crime Portal.
- Any email or SMS communication from the bank regarding the unauthorised access.
- Screenshots of the fraudulent UPI handle and transaction IDs.
- Call detail records if you received any phone call from the scammer.
- Printed copy of the FIR once registered.
What Evidence Is Required?
- Transaction records from your bank with UPI reference numbers—primary evidence.
- IP logs and device logs (obtained by police from the bank/UPI app provider).
- Screenshots and screen recordings of the duplicate UPI app, if available.
- Bank statements of the beneficiary account—frozen and shared under police request.
- Any voice recordings or messages from the scammer.
- A forensic report from a certified cyber expert, if your advocate arranges one, to establish phishing or cloning.
- Copies of the complaints made to the bank and the cyber cell, evidencing prompt reporting.
How the Police Behave in Such Cases
Expect initial reluctance. The station house officer might say it’s a civil matter or ask you to go to the cyber cell first. Don’t accept that. A UPI scam is a clear cognizable offence. With a lawyer’s intervention, the police are more likely to act swiftly. In tier-2 cities, the constabulary may lack digital forensics knowledge, but the state cyber police have the tools. The key is to get the FIR registered and the freeze order issued. After that, investigation pace varies, but a follow-up complaint to the SP can keep things moving.
Timeline of Legal Process
- FIR Registration: Ideally within 24–48 hours of complaint. With legal pressure, can be same day.
- Investigation and Account Freeze: 1–3 days for urgent orders; full investigation may take 60–90 days.
- Chargesheet Filing: Police must file within 60–90 days (extendable for serious cyber fraud).
- Cognizance and Trial: Magistrate takes cognizance; trial can last 12–18 months or longer.
- Recovery of Funds: If frozen in time, the court can order restitution during or after trial.
How Long Will the Investigation Take?
For a straightforward UPI fraud with a traceable beneficiary account, the police can complete the investigation and file a chargesheet within 60 days. Complex cases involving layered transactions and mule accounts across multiple states may take up to 90 days or more. The investigating officer will need records from various fintech companies, which can slow things down unless a lawyer follows up persistently.
Understanding the Costs
The total cost of a matter like this varies significantly from one case to the next — it depends on the complexity of the dispute, the forum involved, the number of hearings, and the specific facts of your situation. There is no single fixed figure that applies to everyone.
A professional advocate can give you an accurate estimate only after reviewing all your facts and documents in a consultation.
Can the Matter Be Settled Out of Court?
In theory, yes—if the accused returns the money and the victim agrees. The offence under Section 318 BNS is compoundable only with the permission of the court. But in practice, the scammer is rarely caught that early. Settlement is more common when the fraud was perpetrated by someone known to the victim. For stranger-orchestrated UPI scams, the focus remains on police investigation and fund recovery through court-ordered freezing. Mediation or Lok Adalat is not the typical route; the urgency is in tracing and securing the money, not negotiating.
Common Mistakes People Make
- Delaying the complaint by even a few hours—money moves fast in the digital shadow.
- Approaching the police without a written complaint or an advocate; the complaint is often treated casually.
- Wiping call logs or chat history in panic, destroying critical evidence.
- Trying to convince their bank to reverse the transaction without filing a police complaint. Banks won’t budge without an FIR.
- Engaging a lawyer who doesn’t regularly handle cyber fraud matters. The procedure for a John Doe order or freezing a fintech wallet is niche. An advocate unfamiliar with it can waste precious time.
- Posting the scam details publicly on social media—that can alert the scammer and complicate tracing.
FAQs People Normally Have
Q: Can I get my money back if I don’t have the UPI ID of the scammer?
Yes. Your bank statement will show the UPI ID or at least the transaction reference. The police can trace it from there.
Q: The police asked me to go to the cyber cell. Is that correct?
You can file either at the local police station or directly with the cyber cell. An FIR must be registered at the station with territorial jurisdiction, but the cyber cell can also take up the investigation. Don’t let this ping-pong delay you—a lawyer can file the complaint at the right forum.
Q: Will the bank reverse the transaction if I complain within 24 hours?
The bank can’t unilaterally reverse a UPI transaction without an order from the police or court. It can, however, place a lien on the beneficiary’s account if you report promptly. That’s why speed matters.
Q: Can I file an online complaint and skip the police station?
The online complaint initiates the process, but a formal FIR is essential for freezing accounts and arrest. Don’t stop at the portal.
This article is general legal information, not legal advice. Consult a qualified advocate about your specific situation.
Advocate Sudhir Rao, Supreme Court of India
Facing a similar matter? Speak to a criminal lawyer in Delhi — Advocate Sudhir Rao appears in bail, trial and appellate matters before the Delhi District Courts, the Delhi High Court and the Supreme Court of India.