I85PREP
⌘ K
HARCO Bank Clerk study materials
HARCO Bank Clerk study resources

₹18,500 Debited After a Customer Entered His UPI PIN

HARCO Bank Clerk · Put your knowledge to work in context.

All case studies

₹18,500 Debited After a Customer Entered His UPI PIN

A customer walks in at 11:05 a.m. on a Thursday with his phone. His UPI-linked savings account shows a debit of ₹18,500 at 09:42 the previous day. He says he received a request on his UPI app from a person claiming to be the shopkeeper from whom he had bought a ₹1,850 chair the week before, saying the shop was returning an excess payment. He entered his UPI PIN to "receive" the money, and the money left his account instead. He has the UPI reference number, the caller's mobile number and a screenshot of the request. He has not reported it anywhere else. He insists the branch should simply reverse the entry because "the payment failed". The branch's UPI nodal desk is available and the bank participates in the RBI framework for customer protection on unauthorised electronic transactions (2017).

1. How should this transaction be classified, and does the T+1 auto-reversal rule apply? Explain the reasoning.

Read the worked answer

Classification: not a failed transaction. It is an authorised transaction procured by fraud.

The customer entered his own UPI PIN and approved a collect request. A collect request is a pull: approving it debits the payer and credits the requester. The money did not fail to move - it moved to the beneficiary, which is why his balance fell and the shopkeeper's did not rise.

Does T+1 auto-reversal apply? No. The auto-reversal obligation (and the ₹100-per-day compensation for delay beyond T+1) applies to failed transactions where the customer's account was debited but the beneficiary was not credited. Here credit reached the beneficiary. Applying the reversal rule would mean making the bank fund a loss that the bank did not cause - and the customer would then have both the goods and the refund.

Test the clerk should apply every time:

  1. Was the PIN/credential entered by the customer? If yes, it is not a failed transaction.
  2. Did the beneficiary receive credit? If yes, it is a dispute or fraud, not a reversal.
  3. Was it a pay request (debit) rather than a refund (credit)? The word "request" in UPI always means money moving out unless it is explicitly a credit/refund flow.

So the branch must open a fraud/dispute case, not a failed-transaction reversal case.

2. What is the customer's liability position under the RBI customer-protection framework, and why does the timing of his report matter so much?

Read the worked answer

Liability position. The framework distinguishes fraud caused by a third-party breach from loss caused by the customer's own negligence. Here the customer disclosed his PIN to a pull request, which is customer negligence. In negligence cases the customer bears the entire loss until he reports the transaction to the bank; the bank's obligation is to act promptly once it is reported, not to indemnify the pre-reporting loss.

Why timing is decisive:

  • Every hour between 09:42 on Wednesday and the report is time in which the fraudster can withdraw or layer the funds. Recovery, not compensation, is the realistic remedy.
  • The report should be made the same day to the branch/UPI nodal desk and to the cybercrime helpline 1930 or cybercrime.gov.in, so that the beneficiary account can be frozen in the golden hour.
  • The bank must acknowledge the complaint, give the customer a complaint reference, and resolve or reply within 30 days; if it does not, the customer can escalate to the RBI Ombudsman under the integrated scheme.

What the branch must not do: tell the customer the money "will be reversed", because it will not be reversed automatically; or ask him for his PIN or OTP under any pretext; or advise him to wait for the shopkeeper to return the money.

3. List the concrete actions and evidence the branch should record in the first hour, in priority order.

Read the worked answer

Priority order - recovery first, paperwork second, but all within the hour.

  1. Stop further loss. Ask the customer to change his UPI PIN immediately in the app and check for any other pending collect requests. Do not close the account at this stage; closure destroys the trail.
  2. Register the dispute. Capture UPI reference number, amount ₹18,500, timestamp 09:42, payer VPA, beneficiary VPA/name, and the remitter bank shown in the passbook or app history. Raise the dispute on the UPI dispute/chargeback module through the nodal desk the same day.
  3. Ask for a lien on the beneficiary account if it is within the same bank, or route the freeze request through NPCI to the beneficiary bank. This is the only step with a realistic chance of recovering the ₹18,500.
  4. Cybercrime report. Guide the customer to file at cybercrime.gov.in or on 1930 and bring the acknowledgement number; attach it to the bank's case file.
  5. Evidence checklist. Screenshot of the collect request, SMS/e-mail alerts, the customer's written complaint signed and dated, call detail of the fraudster's number, and a copy of the account statement highlighting the debit.
  6. Advisory note to the customer in writing: never approve a collect request to receive money, never share the PIN, and the bank will never call asking for the PIN or OTP.

Close with an honest expectation: the branch is raising a recovery and fraud case, not promising a refund, and the customer's own PIN entry is the central fact of the case file.