Lost Your Phone With Banking Apps On It? The 10-Minute Checklist and Who Pays If You Delay
Personal Finance · Digital Payments · India
Lost Your Phone With Banking Apps On It? The 10-Minute Checklist and Who Pays If You Delay
India recovered more than 7 lakh lost and stolen handsets through Sanchar Saathi, and the RBI still gives you three working days to report an unauthorised debit. Both clocks start the moment the phone leaves your hand.
The bus pulls away and the pocket is empty. Somewhere on that phone sit two UPI apps, a net banking login, a mail account that can reset every password you own, and an SMS inbox that receives every one-time password a bank will ever send you. The panic is about the handset. It should be about the ten minutes that follow.
Those ten minutes are not a metaphor. Each action below takes under two minutes and each closes a different door. Get the order wrong and you can lock yourself out of the accounts you are trying to protect, because the number the OTP goes to is now in someone else’s hand.
Quick Summary
Block the SIM first, then lock the device remotely, then freeze UPI and net banking, then dial 1930, and only then block the IMEI on Sanchar Saathi. If money has already moved, the Reserve Bank’s July 2017 circular gives you zero liability if you report within three working days of the bank’s alert. Report on day four to seven and your liability is capped at ₹5,000, ₹10,000 or ₹25,000 depending on account type. The bank must credit the disputed amount within 10 working days, and prove your negligence if it wants to refuse.
The ten minutes, minute by minute
The order matters more than the speed. A thief with your unlocked phone is racing to move money before the SIM dies; a thief with a locked phone is holding a brick that still receives your OTPs until the SIM is killed. Killing the SIM is therefore first, because it removes the one thing that makes every other credential resettable.
Do not start with the bank helpline. IVR queues run to several minutes, and while you are on hold the SIM is still alive. Call the operator first, then use a second phone or a laptop for the rest.
The step almost everyone gets wrong
People block the debit card first, a habit learned in the plastic era. On a stolen smartphone the card is rarely the exposure. UPI, wallet balances and net banking are, and they run on the SIM and the screen lock. Block the card too, but not first.
What a stranger can actually move before the SIM dies
The ceilings are set by the National Payments Corporation of India, then narrowed by your own bank. They tell you how much is actually at stake in those ten minutes, and it is usually less than the panic suggests.
The dangerous exception is UPI Lite. It is an on-device wallet designed for small payments that do not need a UPI PIN, which is exactly what makes it attractive to someone holding an unlocked phone. Its balance sits outside your regular daily cap.
Read that chart as an exposure budget. If your bank caps you at ₹50,000 a day and your Lite balance is empty, the worst case is bounded. A five-figure Lite balance is money a thief can spend without ever knowing your PIN.
The scale: one handset recovered every minute, and the money that never comes back
Two government systems handle the aftermath. The Department of Telecommunications runs Sanchar Saathi and its Central Equipment Identity Register for the device. The Ministry of Home Affairs runs the 1930 helpline and the cybercrime portal for the money. The first has become fast; the second has become large.
The DoT reported in November 2025 that monthly recoveries had risen 47 per cent between June and October, and that more than one handset was being returned every minute nationally. That is a real achievement. It is also not the same thing as getting your own phone back.
Blocking is still worth the two minutes. A blocked IMEI is worthless on any Indian network, which destroys the resale value behind most snatchings, and it alerts police when the device is switched on. But treat the handset as gone and spend your energy on the accounts.
The three-day rule, and the two words most people miss
The Reserve Bank’s circular of 6 July 2017 applies to every scheduled commercial bank, small finance bank and payments bank in India, with a matching circular for cooperative banks. It sets out when you pay nothing, when you pay a capped amount, and when the bank’s own board policy decides.
The two words that trip people up are working days. The count runs on the working schedule of your home branch, and it excludes the day you received the bank’s communication. A Friday evening alert can leave you until Wednesday. The other detail people miss is that the clock starts from the bank’s alert, not from the moment you notice the debit yourself.
Contain it
Zero liability
Capped
Board policy
Ombudsman
Zero liability also applies with no time limit at all where the loss came from the bank’s own negligence or a system deficiency, whether or not you reported it. The burden of proving that you were negligent sits with the bank, not with you. That single line is the most useful sentence in the circular and the one banks are least eager to quote.
Liability by account type and reporting delay
| Account or card type | Within 3 working days | 4 to 7 working days | Beyond 7 days | Bank credit deadline |
|---|---|---|---|---|
| BSBD (zero balance) account | ₹0 | Up to ₹5,000 | Board policy | 10 working days |
| All other savings accounts | ₹0 | Up to ₹10,000 | Board policy | 10 working days |
| Prepaid instruments and gift cards | ₹0 | Up to ₹10,000 | Board policy | 10 working days |
| Current or OD account up to ₹25 lakh, and MSME accounts | ₹0 | Up to ₹10,000 | Board policy | 10 working days |
| Credit card, limit up to ₹5 lakh | ₹0 | Up to ₹10,000 | Board policy | 10 working days |
| Credit card above ₹5 lakh, other current accounts | ₹0 | Up to ₹25,000 | Board policy | 10 working days |
Worked example: why the cap is not one cap
Meera loses her phone on a Monday. Three UPI transfers of ₹28,800 each leave her savings account that evening, ₹86,400 in total. She is travelling, sees the SMS alerts late, and reports to the bank on the sixth working day.
She is in the four to seven day band, so the circular limits her liability to the transaction value or the Table 1 amount, whichever is lower, per transaction. Each transfer is ₹28,800, which is higher than the ₹10,000 savings account cap, so the cap applies three times: 3 x ₹10,000 = ₹30,000 borne by Meera, and ₹56,400 credited back.
Had she reported on the third working day, her liability would have been ₹0. The three days between her sixth day and her third day cost ₹30,000. Note that some banks read the cap as applying once per incident rather than once per transaction. The circular’s wording is per transaction, and that difference is worth arguing in writing.
What actually happens after you dial 1930
The helpline is run by the Indian Cyber Crime Coordination Centre. Its power is narrow and real: it is the fastest route to a lien on the account that just received your money. It does not investigate and it does not refund.
Mumbai Police reported that the city’s 1930 operations blocked or recovered close to ₹202 crore for victims during 2025, and cited a case in which a businessman who lost ₹11.3 crore to a phishing attack called immediately, allowing officers to freeze ₹11.19 crore. Speed, not the size of the loss, is what decided that outcome.
Alongside the money, the same machinery has been used to cancel more than 12 lakh suspicious SIM cards and block the IMEI numbers of over 3 lakh handsets by December 2025, with 20,853 arrests recorded by February 2026. A new money restoration module became operational in April 2026 to speed up the return of frozen funds to victims.
The checklist, written out in order
Print this, or keep it in a note on a second device. The sequence assumes the worst case: an unlocked phone in a stranger’s hands with UPI apps signed in.
- Suspend the number with your operator. Ask for suspension, not disconnection, so the number survives onto a replacement SIM.
- Mark the device lost in a browser. Set a new lock PIN. Hold the remote wipe back, because a wiped phone stops reporting its location.
- Ask the bank to disable UPI and net banking on that device. Get the service request number and timestamp. That timestamp starts your three-day clock.
- Dial 1930 if money has already moved. Have the time, amount and beneficiary ready, and write down the acknowledgement number before you hang up.
- File the complaint on cybercrime.gov.in. The call and the portal record are two halves of one process, and the bank will ask for the second.
- Block the IMEI on Sanchar Saathi. You need the IMEI and a police complaint reference. The block takes effect within 24 hours.
- Change your email password and sign out of all sessions. Then reset anything whose recovery route runs through that mail address.
- Collect a replacement SIM the same day. Expect incoming SMS to be barred for about 24 hours afterwards.
- Send a written complaint to the bank within three working days. Attach the service request number, the 1930 acknowledgement and the disputed transactions.
- Diarise the tenth working day and the thirtieth day. Those two dates decide whether you escalate.
Do not wipe first
A remote wipe feels decisive and is usually premature. It ends tracking and any chance of recovery, and destroys nothing a lock screen was not already protecting. Wipe only once the SIM is dead and the accounts are frozen.
When the bank says no: the escalation ladder
Most disputes end at the first rung. The ones that fail usually do so because the customer never created a paper trail, or escalated to the wrong forum too early. The Reserve Bank Integrated Ombudsman Scheme, 2026, in force from 1 July 2026, tightened these timelines.
The 90-day filing window is the change that catches people out. Under the old 2021 scheme you had a year from the bank’s response. Since 1 July 2026 you have 90 days from the expiry of the bank’s response period or its last communication, whichever is later. Miss it and a valid claim becomes unmaintainable on a technicality.
Decoder: what each status actually means
Half the anxiety in the days after a loss comes from reading a status message and not knowing whether it is good news. Here is every state you are likely to meet.
| What you see | What it means | What to do next |
|---|---|---|
| Phone shows on the map | The device is online and location services are active | Do not go to the address. Give the location to the police with your complaint number |
| Find My shows last seen | The device is off or offline; the timestamp is the last contact | Enable the notify-when-found option and continue with the account steps |
| CEIR: request submitted | Your IMEI block request is queued | Save the request ID. The block takes effect within 24 hours |
| CEIR: blocked | The handset cannot register on any Indian network, even with a new SIM | Nothing further. Police tracking continues after blocking |
| CEIR: request already exists | The police have already filed a block against that IMEI | Contact the district nodal officer with your FIR copy |
| Bank: shadow reversal credited | A provisional credit under the 10 working day rule | Not final. Keep the file open until the bank closes the investigation, within 90 days |
| Bank: closed, no deficiency found | The bank asserts customer negligence | Ask in writing what evidence discharged its burden of proof, then start the 90-day ombudsman clock |
| New SIM active, no SMS arriving | The routine bar on incoming SMS after a duplicate SIM is issued | Wait roughly 24 hours before attempting OTP-based resets |
Six settings that make the next loss survivable
Everything above is damage control. These decide how much damage there is to control, and each takes under five minutes on a calm afternoon.
Why the SIM matters more than the screen lock
Indian telecom rules already assume SIM misuse. A duplicate SIM has incoming SMS barred for roughly a day, and under the TRAI portability amendment in force since 1 July 2024, no porting code can be issued within seven days of a SIM swap or replacement. Those delays protect you from a fraudster who obtains a duplicate of your number, but they work against you too when you are the one replacing a SIM in a hurry. Plan for a day without OTPs.
What we know
- The RBI circular of 6 July 2017 gives zero liability for third-party breaches reported within three working days of the bank’s alert, and caps liability at ₹5,000, ₹10,000 or ₹25,000 per transaction on the fourth to seventh working day.
- Banks must credit the disputed amount within 10 working days, value dated to the transaction date, and resolve within 90 days. The burden of proof sits with the bank.
- RB-IOS 2026 took effect on 1 July 2026, raising the ceiling to ₹30 lakh for financial loss and ₹3 lakh for harassment, and cutting the filing window to 90 days.
- A CEIR block takes effect within 24 hours and stops the handset registering on any Indian network, including with a different SIM.
- The DoT reported over 7 lakh handsets recovered nationally by November 2025, including more than 50,000 in October 2025 alone.
- I4C reported ₹11,158 crore saved across 32.80 lakh cyber fraud complaints up to 30 June 2026.
What is still unclear
- National recovery rates are not published as a consistent monthly series. The best detail is state level, and Karnataka’s 39.8 per cent is unlikely to hold everywhere.
- The ₹8,189 crore and ₹11,158 crore figures rest on different bases and complaint counts, so the trend shows direction rather than a precise series.
- Banks differ on whether the four-to-seven-day cap applies once per incident or once per transaction. The circular says per transaction; practice varies.
- The 24-hour SMS bar after a duplicate SIM is applied consistently by operators but is described in customer communications rather than one public regulation, so the duration can vary.
- How quickly the April 2026 money restoration module actually returns frozen funds has not been reported with outcome data.
Frequently asked questions
I lost my phone with banking apps on it. What should I do first?
Suspend the SIM with your operator before anything else. That stops OTPs reaching the handset, which is what makes every other credential resettable. Then lock the device remotely, freeze UPI and net banking, dial 1930 if money has moved, and block the IMEI on Sanchar Saathi.
Can someone use UPI on my phone without knowing my UPI PIN?
For regular UPI payments, no: every transfer needs the PIN. UPI Lite is the exception. It is an on-device wallet that spends without a PIN, up to ₹4,000 per transaction, holding up to ₹50,000. On an unlocked phone that balance is spendable, so keep it low.
How many days do I have to report an unauthorised transaction to get a full refund?
Three working days from the bank’s communication about the transaction, counted on your home branch’s schedule and excluding that day. Report within that window for a third-party breach and your liability is zero. Where the bank’s own negligence caused the loss, zero liability applies whenever you report.
What happens if I report the fraud after seven days?
Your liability is set by the bank’s board approved policy, which it must publish and must have disclosed when you opened the account. That is not automatically full liability, but the fixed caps no longer protect you. Ask for the policy in writing.
Is blocking the IMEI on Sanchar Saathi worth doing if the phone is probably gone?
Yes. A blocked IMEI cannot register on any Indian network even with a new SIM, which removes the resale value behind most thefts. Blocking does not stop police tracking either: the CEIR alerts them when the device is switched on.
Should I file a police FIR for a lost phone, or is an online complaint enough?
File both. A police complaint reference is needed for the CEIR block and is what banks and insurers ask for. The cybercrime.gov.in complaint is a separate record covering the money and pairs with your 1930 call.
The bank rejected my claim saying I was negligent. What can I do?
Ask in writing what evidence it relied on, since the 2017 circular puts the burden of proving customer liability on the bank. If 30 days pass without a satisfactory reply, file with the RBI Ombudsman at cms.rbi.org.in or on 14448, within 90 days. Filing is free.
How long does it take to get a duplicate SIM, and will OTPs work immediately?
A duplicate SIM is usually issued the same day at an operator store with your ID. Incoming SMS is typically barred for about 24 hours afterwards as an anti-swap measure, so OTP resets will fail in that window. Change your email password first, from a device that does not need an SMS code.
Does the RBI three-day rule apply to credit cards and prepaid wallets too?
Yes. It covers scheduled commercial banks, small finance banks, payments banks and prepaid instrument issuers, with a parallel circular for cooperative banks. Caps differ: ₹10,000 for prepaid instruments, gift cards and credit cards up to a ₹5 lakh limit, ₹25,000 above that.
Can I get my money back if the thief transferred it and withdrew it in cash?
It becomes much harder once cash is withdrawn, which is why the first hour matters. The 1930 helpline exists to place a lien while the funds are still sitting in the beneficiary account. Mumbai Police recorded close to ₹202 crore blocked or recovered in 2025 through it.
The short version
Suspend the SIM, lock the device, freeze UPI and net banking, dial 1930 if money has moved, block the IMEI, then change your email password. Ten minutes, every door closed. If money did move, report in writing within three working days and your liability is zero; on the fourth to seventh day it is capped at ₹5,000 to ₹25,000 per transaction by account type; after that the bank’s policy applies. The bank owes a provisional credit in 10 working days and a decision in 90. If it goes quiet for 30 days, the ombudsman route opens for 90.
