A UPI Fraud Complaint Where the Liability Bucket Is Contested
On 12 August, a savings account holder at your branch, Mr. Rawat, calls at 9:15 a.m. to say that ₹18,500 left his account through eight UPI payments between 11:40 p.m. and 12:05 a.m. the same night. He says he never shared an OTP or PIN. However, he admits that around 11:30 p.m. he clicked a link in an SMS offering a 'KYC update' and installed an app that a caller told him to download so that 'the bank could verify his account'. He did not switch off his phone or inform the bank until the morning. He wants an immediate credit and threatens to go to the police. Your branch already has one chargeback pending, the fraud team sits in another city, and the branch manager is on leave.
1. Classify the transaction under the RBI framework on limiting customer liability in unauthorised electronic banking transactions. What liability position applies, and what fact decides it?
Read the worked answer
The classification is genuinely contested, and that is the point.
The framework distinguishes three buckets:
- Bank-side deficiency → customer liability is zero.
- Customer shared payment credentials → the customer bears the loss incurred until the bank is informed, and nothing thereafter.
- Neither of the above (customer was deceived but did not part with credentials) → liability is capped on a slab basis by how quickly the customer reported: zero if reported within three working days, a capped amount if reported within four to seven working days, and per board policy beyond that.
Applying it: Mr. Rawat reported within roughly ten hours - comfortably inside three working days - so under bucket 3 his liability would be zero. But the malicious app may have captured his PIN or OTP as he typed them, which would move the case to bucket 2 and leave the full ₹18,500 with him, because the loss occurred before he reported.
The deciding fact is therefore forensic, not narrative: did the customer enter his credentials into the rogue app? Until the device and UPI logs are examined, the branch cannot assert either bucket. Record the complaint as a limited-liability case, do not tell the customer he is liable, and do not tell him he will certainly be refunded.
2. Set out the immediate actions and the timeline you would commit to, given that the manager is absent and the fraud team is in another city.
Read the worked answer
Same day (12 August):
- Register a written complaint and give the customer a dated acknowledgement with a complaint reference - the clock on every timeline runs from notification, so an oral complaint is worth nothing.
- Block the UPI/device linkage and the card on the account; check whether the same device is linked to any other account at the branch.
- Escalate to the fraud team by email, with the eight transaction references, and ask for device and beneficiary-bank logs.
- Advise him in writing to uninstall the app, disable remote-access permissions, and file a police complaint; note the advice in the file.
Within the framework's timelines: provisional credit within ten working days of notification where the case falls in the limited-liability buckets; resolution and accountability within ninety days. If the investigation later fixes liability on the customer, reverse the credit only after informing him in writing.
Do not promise same-day credit, and do not let the absence of the manager delay the acknowledgement - the acknowledgement is the branch's single most important act today.
3. If the investigation concludes that the customer's own act enabled the fraud, how would you communicate the outcome, and what redress options must you tell him about?
Read the worked answer
Communication principles:
- Lead with what was established factually - device logs showing the app was installed and credentials were entered - not with character judgements about carelessness.
- State the liability position and the rule it rests on in one sentence each, then the amount, if any, he must bear.
- Give the reasoning in writing. A verbal 'the bank has decided' invites escalation; a reasoned letter often ends the matter.
- Keep the tone firm but not accusatory. The customer was defrauded by a third party; the finding is about where liability sits, not about his honesty.
Redress options to state explicitly:
- The bank's internal grievance redressal officer, with the escalation level and address/portal.
- If no reply within 30 days, or if he is dissatisfied with the reply, he may approach the RBI Integrated Ombudsman - free of charge.
- His right to pursue the matter with the police independently of the bank's decision.
Finally, log the case as a mis-selling/fraud-awareness opportunity: the branch should run a short counter advisory on remote-access apps, because the same script is being run on other customers in the same catchment.