UPI Fraud: Will Cyber Insurance Pay If You Were Tricked Into Authorising A Transfer?

A fraudster posing as a buyer asks you to scan a QR code to receive money for a sofa. You scan it, enter your UPI PIN, and discover that money has left your account. Although you were deceived, you approved the payment on your phone.

“If you get tricked into typing your UPI PIN, standard cyber insurance won't help you. They call this an "authorized transaction." Why? Because you actively pushed the buttons,” says Santosh Sahoo, vice president, Probus.

But whether a policy pays cannot be decided from the label “cyber insurance” alone. Cover varies by insurer, plan and add-on. Some policies cover losses from phishing or social engineering; others restrict cover to unauthorised access or impose conditions and sub-limits. A QR-code scam or impersonation call may be excluded under one policy and considered under another. The policy wording, including definitions of “unauthorised transaction,” exclusions and claim limits, matters more than the product name.

How The Policy Classifies The Fraud

Insurers generally examine how the money was taken. In a direct account takeover, malware or a hacker may initiate a transfer without the customer’s knowledge. In phishing, a victim may follow a fake link or disclose credentials; in social engineering, a fraudster persuades the victim to make a payment, often by impersonating a bank official, buyer or relative. The line between a customer-authorised payment and a transfer caused by fraud can be disputed, so a policy’s specific wording is crucial.

Sahoo says standard plans may not cover phishing or social engineering unless the policyholder has bought an appropriate add-on. Even then, the payout may be capped. “Even with the right rider, insurers use sub-limits—capping UPI fraud payouts to say 15 per cent or 20 per cent of the total sum insured - to keep the product viable.” Check the cap, deductible, event definition, and whether the cover applies to UPI before buying or renewing.

Keep the transaction ID, bank alerts, messages, call details, and screenshots. Notify the bank immediately, block access if needed, and report the incident on the National Cyber Crime Reporting Portal or by calling 1930. Insurers may ask for the bank complaint acknowledgement, cybercrime complaint number, police complaint or FIR, and proof of loss. The exact documents and deadline depend on the policy; do not assume every insurer gives 24 to 48 hours. The portal lists 1930 for reporting online financial fraud.

Bank Liability Is A Separate Question

A bank’s responsibility is assessed under RBI rules for unauthorised electronic transactions, which distinguish among bank negligence, third-party breaches and customer negligence. For certain third-party breaches, reporting within three working days can qualify a customer for zero liability. If the customer shared payment credentials, RBI says the customer bears the loss until the unauthorised transaction is reported.

These protections do not mean a bank must automatically refund a payment the customer was tricked into authorising. The bank will examine the facts and applicable rules.

A cyber policy is a separate contract and can potentially help where the bank does not reimburse a loss—but only if that kind of fraud is covered and the policyholder follows the claim conditions. Report promptly to both the bank and insurer, even if you are unsure whether the transaction counts as authorised. A quick complaint may help limit further losses; it does not guarantee reimbursement from either.

FAQs

Will cyber insurance cover a UPI payment I was tricked into making?
It depends on the policy. Some cover phishing or social engineering, while others exclude these losses or set a payout limit.

What should I do after a UPI fraud?
Notify your bank and insurer immediately, call 1930 or report the fraud on the National Cyber Crime Reporting Portal, and keep transaction details and messages.

Will the bank automatically refund an authorised UPI payment made under deception?
No. RBI’s zero-liability rules apply to certain unauthorised transactions and do not guarantee a refund for a payment the customer approved.