Updated: 3 November 2026

The short answer to does cyber insurance cover UPI fraud is: it may, but a payment you made after being deceived is not automatically covered. If a scammer persuaded you to enter your UPI PIN, accept a collect request or transfer money, an insurer will assess the facts against the policy’s covered events, exclusions, limits and claim conditions. The same facts may also need a separate assessment by your bank or payment provider. The RBI’s directions dated 6 July 2017 set liability rules for unauthorised electronic banking transactions, but they do not define authorisation or determine whether a particular scam-induced UPI payment is unauthorised. Read the RBI directions

Insurance is subject to the policy terms, conditions, exclusions, deductible and sum insured. The insurer decides whether to pay a claim.

Does cyber insurance cover UPI fraud? It may, but an authorised payment can be a crucial policy-condition question

Personal cyber policies can contain separate benefits for direct financial loss, identity theft, phishing or unauthorised online transactions. These benefits are not interchangeable. In HDFC ERGO’s published e@Secure wording, the identity-theft section reimburses specified record-correction expenses, certain related costs and limited lost wages. It is not framed as reimbursement of the money lost from an account. Read the published policy wording

The same policy wording provides a phishing and email-spoofing benefit for financial loss directly caused by phishing. Its definition of phishing is limited to fraudulent websites or emails intended to induce the disclosure of personal information. The section also excludes phishing resulting in revelation of personal information, including passwords. See the published policy wording

This does not make the wording a general answer for every UPI scam. A fake call, QR-code trick, collect request or PIN-approved transfer may not fit that definition, or may trigger an exclusion. Before buying or claiming under cyber insurance for UPI fraud, ask the insurer a specific question: Does this policy cover the exact way the payment was induced and made? Ask for the response against the policy wording and schedule, not only a sales summary.

Why being tricked into approving a UPI transfer can be treated differently from an unauthorised transaction

In everyday language, an unauthorised transaction may mean a payment you did not agree to. For a bank complaint or insurance claim, however, the classification is fact-specific and provider-specific. It can turn on the payment flow, the credentials used, what you did or did not do, the evidence available, and the applicable policy or service terms.

The RBI directions effective 6 July 2017 set zero- and limited-liability rules in specified cases of unauthorised electronic banking transactions. They include rules where a bank is at fault, where a third-party breach occurs elsewhere in the system, and where a customer’s negligence, such as sharing payment credentials, caused the loss. The directions do not define what amounts to authorisation and do not decide whether a scam-induced UPI transfer should be classified as unauthorised. Read the RBI directions

That is why the question “does cyber insurance cover authorised transactions?” has no universal answer. A payment made after deception can require a different assessment from a payment made through credentials used by someone else without your knowledge. Report the incident without trying to fit it into a label, and give the bank, UPI app and insurer a clear timeline of what happened.

Cyber-policy clauses to check: social engineering, voluntary transfer, exclusions and deductibles

When comparing online fraud insurance coverage in India, read the full wording and policy schedule for these points:

  • Covered-event definitions: Check the exact definitions of phishing, email spoofing, unauthorised online transactions and identity theft. Do not assume that a policy covers every online scam because it uses the phrase cyber fraud. HDFC ERGO’s published wording treats these as separate benefits. See the published policy wording
  • Payments made after deception: Look for wording that expressly includes, limits or excludes a payment you made after being misled. If the policy does not address your situation, seek written clarification from the insurer before purchase.
  • Direct financial loss versus expense cover: Identify whether a benefit pays a defined money loss or only specified response costs. HDFC ERGO’s identity-theft benefit concerns listed expenses and lost wages, while its unauthorised-online-transaction benefit concerns fraudulent third-party use of a bank account, card or e-wallet for purchases over the internet, subject to stated conditions. The wording does not mention UPI transfers, so it does not establish whether a UPI transfer falls within that benefit. See the published policy wording
  • Other recoveries: Check whether the policy pays only an unrecovered loss. HDFC ERGO’s unauthorised-online-transaction benefit requires evidence that the bank is not reimbursing the fraudulent transaction and excludes reimbursement already made by the bank. See the published policy wording
  • Sub-limits and sum insured: A sub-limit is the maximum payable for one benefit, even when the total sum insured is higher. Bajaj Allianz’s published individual cyber policy page states that each sub-limit is part of the overall limit of liability. See its limit-of-liability explanation
  • Deductible: This is the part of a covered loss you bear yourself. HDFC ERGO’s published wording states that liability begins only above the deductible shown in the policy schedule. See the published policy wording
  • Reporting and document conditions: Read each benefit’s deadlines. In HDFC ERGO’s published wording, the phishing benefit requires an FIR within 72 hours of discovering the loss. The unauthorised-online-transaction benefit requires an FIR and notification to the issuing bank, card issuer or e-wallet provider within 72 hours of discovering the breach. See the published policy wording
  • Benefit-specific exclusions: Read exclusions alongside the cover clause. HDFC ERGO’s phishing section excludes phishing involving disclosure of personal information, including passwords, and its general conditions require reasonable precautions to protect account details and personal information. See the published policy wording

What evidence should you preserve before making a cyber-insurance claim

Preserve evidence before chats, call logs or payment requests disappear. The National Cyber Crime Reporting Portal asks people reporting financial fraud to have the bank, wallet or merchant name, 12-digit transaction ID or UTR number, transaction date, fraud amount and relevant evidence ready. See the portal’s complaint checklist

  1. UPI payment details: Save the transaction ID or UTR number, amount, date and time, recipient UPI ID or merchant name, and the account debited. These are among the details requested in the portal’s financial-fraud checklist. See the portal’s complaint checklist
  2. Evidence of the scam: Save screenshots of messages, emails, social-media profiles, payment requests, links, QR codes and call logs. If possible, retain call recordings and note the sequence of events in your own words. The portal lists bank statements, online money-transfer receipts, chat transcripts, URLs and suspect mobile-number screenshots among the types of evidence that can be useful. See the portal FAQ
  3. Bank and app records: Download the bank statement or UPI payment receipt. Raise a complaint through your bank and UPI app’s official channels, then keep the service-request number. RBI directions require covered banks to provide a way to report unauthorised electronic transactions, acknowledge the complaint with a registered complaint number, and take immediate steps to prevent further unauthorised transactions after a report. Read the RBI directions
  4. Cybercrime and police records: Keep the 1930 complaint details, cybercrime acknowledgement and any FIR or police complaint. The National Cyber Crime Reporting Portal says online financial fraud can be reported through its reporting options and that a complaint reference is sent by SMS and email after a complaint is filed. See the portal FAQ
  5. Policy and claim records: Save the policy schedule, complete wording, premium receipt and correspondence with the insurer. HDFC ERGO’s published wording requires written notice with a completed claim form and relevant supporting documents for a claim under that policy. See the published policy wording

What to do immediately after a UPI scam: report, secure accounts and notify the insurer

Report the incident immediately. Do not wait for the recipient to return the money. For financial cyber fraud, call 1930 and file a complaint on the National Cyber Crime Reporting Portal. The Ministry of Home Affairs’ Money Restoration Portal directs financial-fraud victims to 1930 and to the cybercrime reporting portal. See the Ministry of Home Affairs reporting guidance

Contact your bank and UPI app through their official app, website or customer-support channel. State that you suspect fraud, ask them to register a complaint and retain the reference number. For banks covered by the RBI directions, a report of an unauthorised transaction must trigger immediate steps to prevent further unauthorised transactions. Prompt reporting remains sensible even when the classification of a scam-induced payment is still being assessed. Read the RBI directions

Secure the accounts involved. Change banking, email and UPI-app passwords, remove unknown device sessions, review linked accounts and beneficiaries, and do not share a fresh OTP or UPI PIN with anyone claiming they can reverse the payment.

Notify your insurer through the claim channel in the policy as soon as possible. Provide an accurate timeline and the documents you have. A UPI scam insurance claim can be accepted, partly payable or declined depending on the policy wording and the insurer’s assessment. If you need support organising the paperwork, explore help with your insurance claim.

How to compare personal cyber insurance for UPI and phishing risks

The useful comparison is not “which policy says it covers online fraud?” Ask instead: “what exact UPI-scam situation does it cover, up to what amount, and subject to which conditions?”

Use this checklist when comparing personal cyber insurance phishing fraud protection:

  • Does the policy define phishing and email spoofing, and does that definition match the risks you want covered? Bajaj Allianz lists phishing and email spoofing among its cyber-risk categories, but the policy wording and schedule determine the actual scope of cover. See the insurer’s published policy page
  • Does it expressly address a payment made after deception? If not, treat cover for that scenario as uncertain rather than assumed.
  • Does an identity-theft benefit reimburse money lost, or only listed costs such as restoring records, legal expenses or lost wages?
  • What direct-loss sub-limit applies, and what deductible do you bear?
  • What deadlines apply for telling the bank, police, cybercrime portal and insurer?
  • Are family members covered, and do their accounts and devices meet the policy’s definitions?
  • Which expenses besides money lost are covered, and do they reduce the same overall limit?

Personal cyber insurance can provide useful protection for defined events, but it does not replace careful payment checks or rapid reporting. Read the wording before purchase, keep the schedule after purchase, and review both when your family’s digital-payment use changes.

FAQs: authorised UPI fraud, claim timelines and cyber cover

Can I claim if I entered my UPI PIN after a scammer asked me to?

You can notify the insurer and submit a claim, but payment is not assured. The insurer will assess whether the facts meet a covered event and whether exclusions or conditions apply. HDFC ERGO’s published e@Secure wording does not establish cover for generic PIN-approved UPI scams: its phishing definition concerns fraudulent websites or emails, it excludes phishing involving disclosure of personal information including passwords, and its unauthorised-online-transaction benefit does not mention UPI transfers. See the published policy wording

Is an FIR always needed for a UPI fraud insurance claim?

Not always. The requirement depends on the policy and the benefit under which you are claiming. HDFC ERGO’s published wording requires an FIR within 72 hours for its phishing benefit and requires both an FIR and notification to the issuing bank, card issuer or e-wallet provider within 72 hours for its unauthorised-online-transaction benefit. See the published policy wording

How long do I have to make a claim?

Follow the deadline in your policy schedule and wording, and notify the insurer immediately after discovering the loss. HDFC ERGO’s published wording requires written notice and a claim form within seven days after a claim is first made, while particular benefits can have shorter FIR or bank-notification conditions. Separately, report financial cyber fraud promptly through 1930 and the National Cyber Crime Reporting Portal. See the published policy wording See the Ministry of Home Affairs reporting guidance

Can I rely on my bank’s refund instead of cyber insurance?

Raise the bank complaint and insurance claim where appropriate. A bank recovery may reduce or remove the remaining loss payable under a policy. For example, HDFC ERGO’s published unauthorised-online-transaction benefit requires evidence that the bank is not reimbursing the transaction and excludes reimbursement already made by the bank. See the published policy wording

Talk to a Mitra to compare personal cyber cover wording for the fraud risks you actually face, including exclusions that may apply when a payment was authorised.

Frequently asked questions

Does cyber insurance cover an authorised UPI payment made after a scam?

It may, but it is not automatic. The insurer will assess the facts against the policy’s covered-event definitions, exclusions and conditions. In HDFC ERGO’s published e@Secure wording, phishing means fraudulent websites or emails used to induce disclosure of personal information, and the phishing section excludes cases involving disclosure of personal information, including passwords. That wording should not be treated as cover for every payment made after a fake call, QR-code request or collect request. Read the published policy wording.

How quickly should I report a UPI scam to my insurer?

Report it immediately and follow the deadline in your own policy. HDFC ERGO’s published wording, for example, requires an FIR within 72 hours for its phishing benefit. Its unauthorised-online-transaction benefit requires an FIR and notification to the issuing bank, card issuer or e-wallet provider within 72 hours, along with other conditions. See the published policy wording.

Will my bank refund a UPI payment I made after a scam?

Do not assume that it will. The RBI directions issued on 6 July 2017 set customer-liability rules for unauthorised electronic banking transactions at scheduled commercial banks, regional rural banks, small finance banks and payments banks. They do not define authorisation or decide whether a particular scam-induced UPI payment is unauthorised. Report the facts promptly to your bank and UPI app, and ask for a complaint reference. Read the RBI directions.

What documents are useful for a cyber-insurance claim after UPI fraud?

Keep the UPI transaction details, screenshots, messages or call records, bank and UPI-app complaint references, cybercrime acknowledgement, FIR or police complaint where applicable, and the insurer claim reference. The National Cyber Crime Reporting Portal asks complainants in financial-fraud cases to have the bank, wallet or merchant name, 12-digit transaction ID or UTR number, transaction date, fraud amount and relevant evidence ready. See the portal’s complaint checklist.

Sources