UPI collect-request fraud reported at a Customer Service Point
You operate a CSP in a town in Bathinda district. At 9:40 a.m., Harpreet Singh, a 58-year-old pensioner with a PMJDY account, arrives agitated: ₹4,800 left his account at 2:13 a.m. His phone shows a UPI entry marked 'PAYMENT TO'. He explains that at about 2 a.m. he received a UPI collect request on his phone and a caller claiming to be from the bank told him to approve it to receive a refund of his electricity bill, so he entered his UPI PIN. He now demands that you 'reverse the entry in the computer immediately' and threatens to call the police on you. He has not contacted the bank's helpline or the UPI app's support, and the transaction SMS is still on his phone. Your CSP is authorised only for deposits, withdrawals, balance enquiry and account opening; dispute reversal is handled by the branch, 11 km away.
1. What do you do in the next thirty minutes, and what must you not do?
Read the worked answer
Do now: help him call the bank's 24x7 helpline or the UPI app's support from your counter and get the dispute registered - note the complaint or reference number, the time and the agent's name on paper for him. Advise him to file a cyber-fraud complaint on the national cybercrime portal, which costs nothing and preserves his position. Have the UPI/ virtual address blocked and the UPI PIN reset through the bank or app. Preserve evidence: the SMS, the app screenshot, the caller's number and the collect-request notification must not be deleted.
Do not: promise a reversal or a refund; accept or pay any cash to 'settle' it; make any entry in the CBS yourself (you have no rights and an unauthorised credit is itself fraud); ask for or write down his PIN or OTP; tell him to delete anything; blame him or dismiss him. Record the visit in the CSP complaint register and hand him a copy, then send him to the branch with the reference number. Anger is not the issue - evidence and timing are.
2. Using RBI's framework for customer protection on unauthorised electronic transactions, assess honestly whether he is likely to recover the ₹4,800, and what the CSP should say.
Read the worked answer
The framework turns on two questions: whose fault was it, and how fast was it reported.
Fault: a collect request approved with a PIN is treated as an authenticated payment, not a system breach. The deception was third-party, but the PIN entry was his own act. Where the loss flows from the customer sharing payment credentials, the customer generally bears the loss until it is reported. So his chances are weak on the fault test even though he reported on the same day - within the three working-day window that would give zero liability where the fault is wholly the bank's or a third party's.
Process: the bank must still register the complaint, investigate, and resolve within the prescribed timeline, giving a shadow reversal in the meantime where its rules require it, with compensation for delay if resolution is not completed in time.
What to say: 'We have registered it today, which protects your timeline. Money returned depends on the investigation. I cannot promise a refund and no one here can reverse it.' Discourage false hope without discouraging the complaint.
3. How would your advice differ if the ₹4,800 had left the account with no PIN entry and no approval by him at all?
Read the worked answer
Then the fault test flips. With no PIN entry, no collect-request approval and no credential shared, the loss is on the bank's or a third party's side, not the customer's. Reported within three working days, as here, that falls into the zero-liability bucket: the customer is not required to bear the loss, and the burden of showing that he was negligent lies with the bank, not with him.
Practically, the reporting clock becomes decisive. The three working-day window must be evidenced - helpline reference number, timestamp, written complaint - because a later report moves the case into the limited-liability slabs and then beyond seven working days into the bank's board-approved policy, which is far less favourable.
At the counter, the difference changes what you tell him: with no PIN entry, you can say the bank is likely to make good the amount if the investigation confirms an unauthorised debit, though the timeline is the bank's. What stays identical is the duty to register immediately, to block the channel, to preserve evidence and never to promise an outcome in the CSP's own words.