Two UPI PIN entries, ₹23,000 gone, and a branch that says "authorised"
Manoj runs a kirana store in Rohtak and accepts UPI payments. On 12 June a man telephones claiming to be from a wholesale supplier, says he wants to place a bulk order, and sends a UPI collect request of ₹15,000 with the message "approve to receive order payment". Manoj enters his UPI PIN and ₹15,000 leaves his account. Two days later a caller says a refund of ₹8,000 is due to him and sends a QR code on WhatsApp; Manoj scans it and enters his PIN again, and ₹8,000 is debited. His total loss is ₹23,000. He tells his brother, who says the bank will return it because he never received any money. Manoj goes to the branch on the fifth day. The branch officer says that since Manoj entered his PIN both times, the transactions were authorised and the bank cannot reverse them. Manoj now wants to know whether he should stop accepting UPI at the shop altogether.
1. For each of the two incidents, decide whether the payment was "unauthorised". Why is "I never received anything" not the correct legal test?
Read the worked answer
Test to apply: a transaction is unauthorised when it is carried out without the account holder's authorisation. The question is not whether a benefit reached him, but whether he authorised the debit.
Incident 1 - the collect request: a collect request is created by the person who wants to receive money. When Manoj entered his PIN, he authorised a debit of ₹15,000 to that VPA. The money did reach a beneficiary - just not the person he thought he was dealing with. So this is an induced or wrong-beneficiary payment, not an unauthorised one.
Incident 2 - the WhatsApp QR: a QR code is only a machine-readable VPA. Scanning it and entering the PIN created a fresh debit of ₹8,000. A person receiving money never needs a QR scan or a PIN from the payer; a QR or collect-request approval is always a payment out. Again the PIN made it an authorised debit.
Bang for the reasoning: RBI's customer-protection framework gives zero liability only for unauthorised electronic transactions where the customer is not negligent and reports within the prescribed short window. Sharing the PIN after being socially engineered is treated as customer negligence. That is why the branch's statement is procedurally correct, even though Manoj is a genuine victim of cheating - his remedy is a fraud complaint, not an automatic reversal.
2. What should Manoj have done in the first hours, and what should he still do now?
Read the worked answer
In the first hours (the "golden hour"): report fast, because after money moves the only realistic route to recovery is the beneficiary bank placing a hold on the still-available balance.
- Use the UPI app's complaint/raise-issue option against the exact UTR/transaction ID, or the bank's 24x7 helpline; ask in writing for the transaction to be flagged as fraudulent and for the beneficiary account to be put on hold/lien.
- Dial 1930 or file a complaint at cybercrime.gov.in immediately, giving UTRs, the phone numbers, the WhatsApp QR screenshot and the timeline. This creates the police trail that a bank needs before acting on another bank's customer's account.
- Send a written complaint to the branch (email plus a stamped acknowledgement) with the UTRs and demand the action-taken status.
What he should still do on day five:
- Stop all contact with the callers; they will ask for "release charges".
- Lodge the same complaints now, in writing, and get a complaint number. Speed has been lost, so recovery is unlikely, but the written trail is what makes the bank answerable and supports any ombudsman complaint.
- Ask the bank for the status of each UTR (whether the beneficiary account is frozen, whether a lien was placed, whether the money is already withdrawn).
- If the bank does not respond within 30 days, he can approach the RBI Integrated Ombudsman - but only after the bank complaint.
- Treat the loss as a lesson and change shop practice (next answer), not as a reason to quit UPI.
3. Should Manoj stop accepting UPI? Give him a concrete shop-level rule set instead.
Read the worked answer
No. UPI is now a large share of kirana sales; rejecting it loses customers. The correct step is to separate the payment function from the savings function.
Rules for the shop:
- PIN means pay. Never enter a PIN to receive money. A refund, prize, order advance or "verification" never needs the PIN.
- Read the collect request before approving. Confirm the payee name and the direction: "You are paying ₹15,000 to X". If someone on the phone is talking while the screen appears, stop and read.
- Never scan a QR sent on WhatsApp or SMS. Scan only the printed QR on the counter or one shown by a customer standing in front of him.
- Use a soundbox or the bank's app notification to confirm credit for every sale, and reconcile the day's UPI collections every night against the statement.
- Keep a separate UPI-linked account with limited float for the shop; sweep the day's collection to another account or FD. Large balances on the UPI number enlarge the damage from any mistake.
- Refuse screen sharing, remote-access apps and "download this app to get payment". No bank, NPCI or supplier ever needs remote access.
- Train whoever handles the counter, including family members, on rules 1 to 3, and display a written note at the counter.
Reasoning: every one of his two losses came from treating a debit instruction as a receipt. Fixing that behaviour is cheaper and more effective than giving up digital payments.