The Refund That Was a Collect Request
At 9:42 pm a 24-year-old MBA student receives a call from a person claiming to be from the state electricity board. He says a refund of ₹1,950 is pending and asks her to 'approve the request on your UPI app to receive it'. She approves the collect request; ₹18,000 leaves her account immediately. She calls the bank's 24-hour helpline at 10:05 pm; the IVR records a complaint but the branch is closed. On day three she submits a written complaint at the branch. The bank's fraud team replies that the transaction was 'authenticated with the UPI PIN, hence authorised', and the branch manager proposes to close the complaint as customer negligence. Her statement also shows a second debit of ₹18,000 that failed, and a ₹50 charge labelled 'reverse'. She is on a zero-balance account and receives a monthly scholarship credit; the lost ₹18,000 was her hostel mess money. The bank has not given her any provisional credit.
1. Is the bank's 'authenticated means authorised' position correct? Determine how liability should be decided.
Read the worked answer
No, it is too simplistic. Authentication is strong evidence of customer action, but it does not automatically convert a fraud-induced payment into an authorised transaction. Regulators distinguish between a transaction the customer genuinely intended and one procured by deception. The UPI PIN proves that someone entered the credential; it does not prove that the customer understood she was paying ₹18,000 rather than receiving ₹1,950.
How to decide liability
- Classify the transaction after investigation: was the collect request from a verified merchant, was the beneficiary a known mule, did the app display the payee and amount clearly, and did it warn that a collect request involving a PIN debits the account?
- If treated as unauthorised, the RBI limited-liability framework applies. She reported the same night, within three working days, so zero liability is the default unless the bank proves her negligence.
- If the bank insists it was authorised, it still cannot close the complaint as 'negligence' without evidence and a reasoned written decision. Approving a collect request is not the same as sharing a PIN or OTP with a stranger.
- The failed ₹18,000 debit and the ₹50 charge must be examined separately; a charge on a failed transaction needs a disclosed basis.
The bank should investigate, record its classification and give her a written outcome. A blanket denial invites a regulatory and ombudsman complaint.
2. What timelines and compensation apply? Address the failed debit and the ₹50 charge.
Read the worked answer
Unauthorised transaction Under RBI's harmonisation of turn-around time and customer compensation rules, once a complaint is treated as an unauthorised electronic transaction, the bank should provide a shadow reversal within 10 working days of notification, pending investigation. Delay beyond that attracts compensation of ₹100 per day. The bank should also complete its investigation and communicate the outcome within the prescribed period, and give written reasons if it rejects the claim.
Failed transaction The second ₹18,000 debit failed, so it should have been auto-reversed within the prescribed turn-around time for that payment channel. If it was not, the bank owes compensation under the failed-transaction framework, and the ₹50 'reverse' charge needs justification. A fee cannot be quietly levied for reversing a transaction the customer did not complete.
Application to the facts She notified on day one, so the 10-working-day clock started then, not on day three when she visited the branch. The branch should not wait for the written complaint to begin the shadow reversal. If the bank concludes the payment was authorised, it must still resolve the failed debit and the charge and explain the decision in writing. The student should keep the complaint number, the SMS alerts and the app screenshots.
3. What should the branch advise her to do, and what controls should the bank adopt?
Read the worked answer
Advice to the customer
- Report immediately on the national cybercrime helpline 1930 and the online cybercrime portal, and give the bank the acknowledgement.
- Ask the bank to freeze or flag the beneficiary account through the UPI ecosystem.
- Preserve the caller's number, screenshots, SMS alerts and complaint numbers.
- Understand that a UPI PIN is used to pay, not to receive money; a collect request should never be approved for an unknown caller.
Bank controls
- Add a clear warning on collect requests: 'Approving this request will debit your account'.
- Apply velocity checks and first-time-beneficiary cooling periods for high-risk accounts.
- Run mule-account detection on beneficiary accounts receiving multiple small fraud credits.
- Train helpline and branch staff not to use 'PIN used, hence authorised' as a script.
- Log IVR complaints as formal complaints at the time of the call, not when the customer later visits the branch.
The branch should treat this as a customer-protection failure as well as a fraud case. A written, reasoned decision and a provisional credit where the transaction is classified as unauthorised will be more defensible than closing the complaint as negligence.