The UPI Collect Request: Who Bears the ₹25,000 Loss?
Sanchita, 58, runs a small grocery in Kharagpur and uses a smartphone with UPI linked to her savings account, where she keeps her working capital of about ₹85,000. On 3 June at 11 a.m. she receives a call from a man claiming to be from the electricity board: her connection will be cut that afternoon unless she 'confirms her identity' by approving a UPI request. She approves a request for ₹5,000, which leaves her account. At 9 p.m. the same day she approves another ₹20,000, believing she is 'verifying' her account; that too leaves. She tells no one because she is ashamed. On 12 June her son sees the messages and they go to the branch with a written complaint; the branch gives an acknowledgement, but the manager says 'you gave the PIN and approved it yourself, so the bank cannot do anything'. She says she never read out an OTP or PIN to the caller; she only entered her own UPI PIN twice because she was told it was a 'verification' step.
1. For each transaction, state how the RBI's limited-liability framework treats her claim given the reporting date, and whether the branch manager's statement is correct.
Read the worked answer
Yes, the manager is wrong to close the matter - but full refund is not automatic.
The framework. RBI's 2017 circular on customer protection for unauthorised electronic banking transactions places the burden of proving customer negligence on the bank, and sets three tiers by reporting time:
- Within 3 working days: zero liability where the fraud is due to the bank or a third party and the customer is not negligent.
- Within 4–7 working days: liability capped at ₹5,000 for limited-liability accounts (BSBDA) and ₹10,000 for other accounts.
- Beyond 7 working days: liability is as per the bank's board-approved policy - neither automatically nil nor automatically full.
Applying it. Sanchita reported on 12 June, nine days after 3 June, so she is at or beyond the edge of the 7-working-day tier. Both the ₹5,000 and the ₹20,000 will therefore be decided under the bank's board policy - which is exactly why the dated written complaint and its acknowledgement are so important.
The complication. She entered her own UPI PIN, so the bank will argue the transactions were authorised, not unauthorised. Her counter-argument is that consent obtained by impersonation is not real consent, and that the bank must still investigate the beneficiary accounts, the velocity of transactions and whether fraud monitoring failed. The regulator also requires the bank to credit the amount within 10 working days of the report, failing which ₹100 per day is payable.
Escalation. Nodal officer of the bank, then the RBI Ombudsman (free of cost; complaint lies if the bank does not reply within 30 days). Simultaneously file on cybercrime.gov.in or 1930 - that is where recovery from the mule account is attempted.
2. What should Sanchita have done in the first hour after the ₹5,000 left, and what should her son do now, in order?
Read the worked answer
The first hour decides most of the outcome.
- Call the bank's 24×7 fraud/UPI helpline at once and ask for the UPI ID to be blocked and debit on the account frozen, and for the beneficiary details to be recorded. Obtain the complaint/reference number - this reference number is what fixes the reporting date. Follow the call with a written complaint the same day.
- File on cybercrime.gov.in or dial 1930 immediately. Money usually sits in a mule account for only a few hours; a quick report lets the beneficiary bank freeze it. Keep the acknowledgement number.
- Preserve evidence: the caller's number in the call log, SMS and app notifications, screenshots of both debits with UPI reference numbers, and the passbook.
- Written complaint to the branch quoting the helpline reference and the cybercrime acknowledgement, with a stamped receipt obtained - the branch cannot refuse to accept it.
- Escalate to the bank's nodal officer if there is no decision, then to the RBI Ombudsman.
What she must not do: stay silent out of shame for nine days. Had she reported on 3 June, inside the 3- or 7-working-day window, the liability caps would have applied automatically and the mule account could have been frozen. Delay is the fraudster's best protection - which is why he told her not to tell anyone.
3. Explain, in words Sanchita could use with other shopkeepers, why approving a UPI 'request' sends money out, and name two safeguards she should adopt.
Read the worked answer
Explanation she can repeat in the market:
'When you receive money on UPI you never enter a PIN. Money moves out only when you approve a request or scan and pay. So if someone sends you a "request" and says "approve it to receive money", it is the opposite - approving it sends your money to him. A request is a demand for payment raised by the other side, not a receipt.'
Safeguard 1 - separate the working capital from the UPI balance. Keep the ₹85,000 in a non-UPI savings account, a sweep FD or a separate account, and keep only a day's takings (say ₹5,000–10,000) in the UPI-linked account, or use UPI Lite for small payments. A fraud loss is then bounded instead of fatal. Safeguard 2 - set a per-day UPI limit in the app and read the payee name on the confirmation screen before entering the PIN. A genuine electricity board, delivery agent or customer never needs her PIN, never asks her to approve a collect request, and never asks her to install a screen-sharing app.
Also worth saying: report within hours, not days - call the bank helpline and 1930 the same day, and get the complaint number.
Banking lesson: UPI transfers are instant and irreversible once approved, so a shopkeeper's real protection is the structure of her accounts and a hard daily limit, not vigilance alone.