RBI Guidelines for UPI Frauds in Banks: Stay Protected from UPI Scams

With the rise of digital payments in India, the Unified Payments Interface (UPI) has made transactions quicker and easier for everyone. However, this increase in use has also led to a rise in fraud cases. In FY 2022-23, the Ministry of Finance reported around 95,000 UPI fraud cases, up from 84,000 the year before. This jump highlights the urgent need for protective measures to keep users safe and secure.

To address these concerns, the Reserve Bank of India (RBI) has introduced guidelines aimed at reducing UPI-related fraud. These guidelines are designed to help create a safer environment for everyone using digital payments.

Different Ways in Which UPI Scams Take Place

Here are some common ways in which UPI fraud takes place:

1. Fake UPI Payment Requests: Scammers send fake payment requests disguised as refunds, rewards, or winnings. Instead of receiving money, the user unknowingly authorizes a debit transaction, leading to the loss of funds.
2. Phishing Scams: Fraudsters trick users into sharing confidential information, such as UPI PINs or OTPs, through fake emails, messages, or websites resembling legitimate bank or UPI platforms. These details are then used to initiate unauthorized UPI transactions.
3. Malicious UPI Apps: Fraudsters create fake UPI apps that mimic genuine ones. Users download these apps and unknowingly provide their UPI credentials, allowing scammers to carry out fraudulent transactions.
4. QR Code Scams: In this method, scammers send users a QR code under the pretense of transferring money. When users scan the code, it instead triggers a payment from their account. Always remember that scanning a QR code should only be done when making payments, not when receiving money.
5. Impersonation: Fraudsters impersonate bank officials or customer care agents, asking users to share sensitive details under the guise of “fixing” a UPI fraud issue. Sharing such information can lead to unauthorized access to your UPI account.
6. Remote Access Scams: Fraudsters convince users to download remote access apps, which allow them to control the victim’s phone and carry out fraudulent UPI transactions without their knowledge.

RBI Guidelines for Reporting UPI Frauds in Banks

In light of increasing incidents of fraud, the Reserve Bank of India (RBI) has established clear guidelines for private and public sector banks on how to report various types of fraud. These measures aim to ensure that fraudsters are held accountable while protecting the interests of customers and the banking system as a whole.

Reporting Fraud to the Police and CBI

Private Sector Banks:

• Private banks, including foreign banks operating in India, should report specific types of UPI frauds to local police authorities. These include:
  • Unauthorized credit facilities given for illegal activities.
  • Cases involving negligence, cash shortages, cheating, and forgery.
• The motivation behind reporting these cases should not only be about recovering lost amounts but also about protecting public interest and ensuring that guilty parties face consequences.

Fraud Reporting Guidelines:

• Cases involving fraud of ₹1 lakh or more that are committed by outsiders (with or without collusion from bank staff) must be reported to the state police.
• If fraud is committed by bank employees and involves ₹10,000 or more, this too must be reported to the police.
• For fraud cases amounting to ₹1 crore or more, banks should notify the Serious Fraud Investigation Office (SFIO) using the FMR-1 format.

Public Sector Banks:

• Public sector banks should report fraud cases to the appropriate authorities as follows:
  • CBI (Central Bureau of Investigation):
    • Cases involving amounts between ₹1 crore and ₹5 crore, especially when staff involvement is evident, should be reported to the CBI’s Anti-Corruption Branch. If no staff involvement is evident, they should report to the Economic Offences Wing (EOW).
    • For cases exceeding ₹5 crore, these should be directed to the Banking Security and Fraud Cell of the CBI.
  • Local Police:
    • For cases below ₹1 crore, these should be reported to the local police.
    • Any UPI fraud complaints involving ₹1 lakh and above that involve private parties and bank staff must be reported by the bank’s regional head to the state CID or EOW.
    • For fraud cases below ₹1 lakh but above ₹10,000, the local police station should be notified.
    • Fraud cases below ₹10,000 involving bank staff should be reported to the regional head, who will determine if it needs to be escalated to local police.

Filing Police Complaints:

• In cases of fraudulent transactions involving forged instruments (like Demand Drafts, Telegraphic Transfers, or Cheques), the paying banker is responsible for filing a police complaint.
• If a genuine instrument is fraudulently collected by someone other than the rightful owner, the collecting bank must file a complaint.
• If an instrument is credited before realization and later turns out to be forged, the collecting bank should file a complaint.
• For altered or fake cheques involving multiple branches of the same bank, the branch that processed the fraudulent withdrawal must file a police complaint.

Apart from that, following are the criteria to review and review the frauds:

Reporting and Review of Frauds

Fraud Reporting to the Board

• Frauds of ₹1 Lakh and Above: Banks must ensure that all frauds involving ₹1 lakh or more are reported to their Board of Directors immediately after detection.
• Action Against Responsible Officials: The report should highlight any failures by branch officials or controlling authorities that contributed to the fraud. Appropriate action should be considered against those responsible.

Quarterly Fraud Review

• Review Process: Banks should submit quarterly fraud reports for the periods ending March, June, and September to the Audit Committee of the Board (ACB) in the month following each quarter. This is required regardless of the RBI’s Calendar of Reviews.
• Supporting Material: These reports should include statistical data and detailed analysis of each fraud, giving the ACB enough information to suggest preventive or corrective actions.
• December Review: A separate review for December is not necessary, as the annual review (detailed below) covers this period.
• Special Committee for Large Frauds: Banks must form a Special Committee to monitor frauds involving ₹1 crore or more. The Audit Committee will oversee all fraud cases, but the Special Committee—comprising key officials like the CMD in public banks and the MD in SBI—will focus on larger frauds. The Special Committee’s key duties include:
  • Identifying gaps in the system that allowed the fraud to occur and implementing solutions.
  • Reviewing delays in fraud detection and reporting to senior management and the RBI.
  • Monitoring the progress of investigations by the CBI/Police and tracking recoveries.
  • Ensuring accountability at all staff levels and taking swift disciplinary action if necessary.
  • Evaluating the effectiveness of measures taken to prevent future frauds and strengthening internal controls.
• Meeting Frequency: The Special Committee should meet as soon as a fraud of ₹1 crore or more is detected. The meeting schedule will depend on the number of cases under review.

What to Do if You Fall Victim to UPI Fraud?

If you’ve been scammed, it’s important to act fast and file a UPI fraud complaint. The first step is to report the incident to your bank and you can also lodge a UPI fraud complaint with RBI through their online complaint portal or app.

By staying vigilant and following RBI guidelines, you can minimize the risks of UPI fraud. Always double-check transaction details and never share sensitive information with anyone.

UPI frauds are becoming more sophisticated, but by staying aware and following RBI guidelines, you can protect yourself. Always be cautious with your UPI transactions, never share sensitive details, and report any suspicious activity immediately. The RBI has set clear rules to help banks and users manage UPI fraud complaints effectively, ensuring a safer digital payment environment.