Legal information notice: this article provides general information and isn't a substitute for advice from a qualified lawyer.
An app-lock that suddenly won’t accept your PIN, a “new device login” alert you didn’t trigger, or a debit you never made — any of these on PhonePe means you may be dealing with a compromised account, and the window to limit damage is short. Here’s the exact sequence to follow.
Like other UPI apps, PhonePe itself is a rails-layer interface to your bank account — genuine compromise almost always traces back to your PIN or OTP being obtained through phishing, a fake “PhonePe customer care” number, a screen-sharing app installed during a fraudulent support call, or SIM swap fraud that redirects your OTPs to an attacker’s SIM. It’s rarely a direct breach of PhonePe’s own systems.
Use your bank’s official helpline (never a number found via search) to block UPI transactions on the linked account — this is the single fastest way to stop further debits, regardless of which app was used.
Use the in-app “Help” section or PhonePe’s official support channels to report the compromised account and unauthorized transactions — this creates a record on their end and can help freeze further app-level access.
Report at cybercrime.gov.in or call 1930 — quick reporting improves the chances of a fund freeze at the receiving end before the money moves further.
If your phone suddenly loses network signal unexpectedly around the same time, contact your telecom provider immediately — this is a classic sign of SIM swap fraud being used to intercept your OTPs.
Once your bank confirms the account is safe, set a new UPI PIN you haven’t used before — don’t rush this step before the earlier ones are complete.
PhonePe’s own app-level security (biometric lock, app PIN) protects the app itself, but it doesn’t control whether a transaction can be reversed once completed — that authority sits with the banking system (NPCI and your bank), which is why calling your bank comes before anything else on this list, not after.
| Situation | What to Do |
|---|---|
| Someone got into your PhonePe app itself (device access, app PIN) | Report to PhonePe support, but still call your bank to block UPI immediately |
| You were tricked into sharing your PIN, OTP, or approving a screen-sharing session | Report as an unauthorized/fraudulently induced transaction to your bank |
| A debit occurred you had no part in whatsoever | Report immediately as fully unauthorized — strongest liability protection under RBI rules |
No. Reporting to your bank, PhonePe support, and cybercrime.gov.in are all free of charge.
Yes — the blocking and reporting steps are designed for direct self-service. A lawyer is worth involving if your bank refuses to acknowledge a clearly unauthorized transaction or resolution drags well past RBI’s timelines.
Need professional legal help with this?
Find a Lawyer on VidyodayThe exact same immediate steps apply on other UPI apps too — see our equivalent guide for Google Pay account hacked, and our general guide on bank account hacked for the underlying banking process.
No — PhonePe is a UPI interface, not the holder of your funds. Reversal or freezing authority sits with your bank and NPCI, not the app itself.
Calling your bank’s official helpline to block UPI on your account acts faster than any step inside the PhonePe app.
An unexplained, sudden loss of network signal (not just poor coverage) around the time of unauthorized transactions is the key warning sign — contact your telecom provider to check immediately.
No — the app usually isn’t the actual point of failure. Secure your bank access and device first, then you can safely continue using the same app with a new PIN.
It depends on how the fraud occurred and how quickly you reported it — a genuinely unauthorized transaction reported within 3 working days gets the strongest liability protection under RBI’s current rules. Note that RBI has already notified a revised framework (effective January 1, 2027) that changes this reporting window to 5 calendar days, so check the current rule in force at the time you’re reading this.
Yes — check the “Help” section within the app for PhonePe’s current official support contact; always verify it matches what’s listed on PhonePe’s own official website rather than a number found through a general search.
Include the fake number and how contact was made in your cybercrime.gov.in complaint — this is one of the most common tactics used in these scams.
This article is for general information only and does not constitute legal or financial advice. Bank policies, RBI rules, and app security features can change — verify current guidance with your bank or on rbi.org.in before relying on this for a real dispute.
