It takes one distracted second: a thumb slips, a lookalike sticker gets scanned, and your money is sitting in somebody else's UPI account. Social media posts promise refunds 'within 24 hours by RBI rule' - the reality is more nuanced but workable, provided you act in the right order and know which levers exist. This is the complete sequence, from the first sixty seconds to the Ombudsman stage, written for both victims and merchants whose customers paid the wrong code.
Minute One to Ten: Freeze the Story
Speed is the single biggest recovery factor because funds that sit unwithdrawn can be frozen; funds moved to a mule account within hours often vanish. Call your bank's official fraud helpline immediately - the number printed on your card or their website, never one supplied by a caller - and simultaneously register the complaint on the national cybercrime portal cybercrime.gov.in or by dialling 1930.
Inside your UPI app, use the built-in 'report a problem' path on the specific transaction. This timestamps your dispute inside NPCI's ecosystem, which matters later when banks trade responsibility.
How the Money Actually Comes Back
Contrary to viral posts, there is no automatic 24-hour refund mandate for transfers you authorised to the wrong destination. What exists: your bank raises a wrong-credit dispute with the beneficiary bank, which contacts the recipient. If they agree - or cannot justify holding the funds - the amount reverses, typically within days to a couple of weeks depending on both banks' responsiveness.
Refusal is where escalation begins. Keep evidence: transaction UTR number, screenshots, complaint reference numbers, and a written trail with your bank. If resolution stalls beyond a month of documented follow-ups, the RBI Integrated Ombudsman scheme takes complaints against the involved banks at no cost - filing happens online through that portal.
When It Was Fraud, Not Mistake
The playbook above assumes an accident. If a scammer engineered the transfer - fake seller, QR swap, collect-request trick - the same 1930 helpline and cybercrime portal become primary rather than backup, and early reporting can trigger the beneficiary account freeze that makes recovery possible. Mention every detail: handles, phone numbers, chat screenshots.
One caution the fraudsters exploit: 'recovery agents' who contact victims promising guaranteed refunds for an advance fee are running the second half of the same con. Banks, NPCI and police never charge to investigate.
Merchants: Stop It Happening at Your Counter
Wrong-QR payments hurt merchants too - customers dispute charges, and swapped stickers poison trust for the whole street. Three habits cut the risk to near zero: print your own code from your verified VPA so you control exactly what is displayed, laminate it in a frame that shows tampering, and place the payee name visibly beside the code so every payer confirms the name before tapping send.
Coach staff on the ten-second verification script: customer scans, sees your shop name on the confirmation screen, says it aloud or shows you, pays. That tiny pause is precisely what scammers engineer around - make it standard practice and lookalike stickers stop working on your premises entirely.