Bank account freeze over UPI cyber fraud: What are your rights?

Payments have an interesting facet that law enforcers and other stakeholders often point out. A payment can be legitimate at one end and illegal at the other. A consultant may receive a professional fee, a merchant may be paid for goods, and a crypto investor may sell an asset through a platform. Yet the money could have travelled through an account linked to a cybercrime complaint. The recipient may discover the problem only when a UPI payment fails or the bank account stops working.

Purpose of restriction

Such restrictions serve an important purpose. The Citizen Financial Cyber Fraud Reporting and Management System had helped save more than Rs 11,158 crore across 32.80 lakh complaints by June 30, 2026, as per NCRB data. Speed is critical because stolen money can pass through several accounts within minutes. Speed, however, cannot replace due process. An account freeze is an investigative measure, and it is not a declaration that the account holder committed fraud.

Key actions: Lien and freeze

The first task is to establish what the bank has actually restricted. A hold or lien usually blocks a specified amount. A suspension may disable UPI or internet banking. A debit freeze can prevent all withdrawals. These actions have very different consequences. Customers should not settle for a message saying merely that the account is ‘blocked.’

Section 106 of the Bharatiya Nagarik Suraksha Sanhita allows the police to seize property suspected of being connected with an offence. The Supreme Court has held that money in a bank account ‘constitutes property for this purpose.’ The judgment in State of Maharashtra v. Tapas D. Neogy (judgment of September 16, 1999) also linked this power to assets that bear a direct connection to the suspected offence. The seizure must be reported to the magistrate.

Questions a customer should ask

A customer should ask the bank for the disputed amount and the date of the restriction. The request should also seek the complaint reference and the nature of the restriction. The details of the law-enforcement agency should be requested as well. The 2026 procedure for cyber-financial frauds allows banks to provide the agency’s address and contact information when this will not compromise the investigation. The identity of the victim will remain protected.

How to reconstruct the transaction

The next step is to reconstruct the transaction. A bank statement can establish the amount and the UTR. It can also establish the time of receipt. An invoice or contract can explain why the payment was made. Delivery records may show what was supplied in return.

Trading platforms and digital wallets add another layer of evidence. A platform can provide the customer’s KYC record and order ID. It can also provide the trade history and the INR ledger. In a VDA (crypto) transaction, the wallet address and transaction hash can track and trace the movement of the asset. A blockchain record alone does not prove the identity of the parties or the purpose of the payment. It becomes useful when it matches the platform record and the corresponding bank transfer.

Written grievance is key

The account holder should present these documents to the bank through a written grievance. Under the 2026 NCRP-CFCFRMS procedure, the bank is expected to conduct enhanced due diligence. An ‘eligible grievance’ should be placed before the investigating officer within seven calendar days. The officer ordinarily has 15 days to respond. A failure to act triggers escalation to a District Grievance Officer.

The procedure also prefers video verification where possible. An account holder should not be made to travel across India merely because the complaint originated in another state. Local police may assist with verification.

The often-cited 90-day period needs careful explanation. It runs from the date on which the bank submits the grievance. It is not an automatic deadline calculated from the original freeze. Removal also depends on there being no other case or court proceeding. The investigating agency may seek an extension of up to another 90 days.

Courts have increasingly examined whether the restriction matches the disputed sum. In a 2026 case, the Karnataka High Court found that a bank could not freeze an entire account when the police directions covered only Rs 25,000. Such decisions support proportionality. They do not prevent a wider seizure when an investigating agency can legally justify one.

A magistrate can be approached for the release of seized property. A High Court may also intervene when a freeze lacks authority or continues without justification. The RBI Ombudsman can examine a bank’s own service failure. It cannot ordinarily cancel a lawful police or court direction.

The system must move quickly enough to protect a fraud victim. It must also distinguish a criminal account from an innocent account that received one tainted payment. Reliable records make that distinction possible. In financial disputes, a clear transaction trail is often the strongest form of defence.