Loan App Illegally Deducting via UPI AutoPay? Stop and Refund
NPCI UPI AutoPay Revocation and Bank Chargeback Guidelines
Executive Defense Summary:
Predatory digital lenders often slip recurring UPI AutoPay mandates into loan onboarding. These apps run automated daily balance sweeps, draining incoming wages the moment funds hit your account. Under NPCI operating guidelines and Reserve Bank regulations, you hold the absolute right to revoke any recurring mandate inside your UPI app. Banks must refund unauthorized debits reported within three days.
01. The Rogue Auto-Debit Crisis: Daily Sweeps Explained
One of the most aggressive debt recovery tactics deployed by digital lending apps in India is the recurring electronic sweep. When borrowers apply for quick personal loans, mobile applications frequently bundle a recurring Unified Payments Interface (UPI) AutoPay mandate or electronic National Automated Clearing House (e-NACH) instruction into the onboarding flow.
Rather than presenting a single deduction on the monthly due date, predatory lenders configure these mandates with daily frequencies. The moment a salary or deposit arrives, server scripts trigger instant debit requests. Borrowers receive bank SMS alerts showing repeated deductions of Rs 500, Rs 1,000, or Rs 2,500 until the savings balance is zero.
The Daily Sweep Mechanism:
1. The app registers a high ceiling limit (up to Rs 15,000) during initial setup.
2. Payment frequency is marked as As Presented instead of Monthly.
3. Balance-checking scripts run micro-debits multiple times daily.
4. Money is deducted before the borrower can make emergency cash withdrawals.
This practice leaves families unable to purchase groceries or pay rent. Continuous balance sweeping violates banking principles, consumer protection laws, and directives from the National Payments Corporation of India (NPCI) and the Reserve Bank of India (RBI).
02. NPCI UPI AutoPay Architecture and Consumer Controls
UPI AutoPay was introduced by NPCI under the UPI 2.0 framework for recurring payments like mutual fund SIPs, insurance premiums, and loan EMIs without entering a PIN for each execution under Rs 15,000.
To protect consumers from unauthorized billing, NPCI operating guidelines establish strict requirements for banks and payment apps:
Pre-Debit Notification (PDN): Merchants must send an SMS alert at least 24 hours prior to presenting any debit, stating the exact amount and merchant name.
Mandatory User Lifecycle Controls: Every UPI app must provide native options to Create, Modify, Pause, and Revoke mandates at any time.
Central Switch Termination: Clicking Revoke broadcasts the cancellation across the NPCI switch. Subsequent merchant debits are rejected automatically.
Borrowers do not need the lender permission to cancel an AutoPay mandate. Your payment instruction is a revocable customer authorization under Indian banking law.
03. Why Daily Sweeps Violate RBI Digital Lending Guidelines
On September 2, 2022, the Reserve Bank of India issued its Guidelines on Digital Lending (RBI/2022-23/111). These statutory directions govern all regulated banks, NBFCs, and their Lending Service Providers (LSPs).
Daily automated balance sweeping violates several provisions of the RBI framework:
- Key Fact Statement (KFS) Mandate: Lenders must specify the exact repayment schedule and EMI in the KFS. Deducting random daily amounts violates the contract.
- Ban on Unfair Auto-Charges: Lenders cannot siphon penal fees or late charges through auto-debits without advance, itemized accounting.
- Absence of Free Consent: Under Section 2(47) of the Consumer Protection Act 2019, bundling unannounced daily sweeps constitutes an Unfair Trade Practice.
When a lending app repeatedly drains your account balance without schedule adherence, it operates outside regulatory boundaries. You have clear legal grounds to sever the mandate immediately.
04. Step-by-Step Revocation: GPay, PhonePe, Paytm, and BHIM
To stop automated sweeps immediately, revoke the active mandate in the UPI app where it was registered:
Google Pay (GPay):
Profile icon > Autopay > Select active mandate > Tap Cancel Autopay > Enter UPI PIN. The screen confirms cancellation instantly.
PhonePe:
Profile icon > Autopay Settings > Choose lender or aggregator mandate > Tap Manage Autopay > Tap Remove Autopay > Authenticate with UPI PIN.
Paytm:
Profile icon > UPI & Payment Settings > Automatic Payments & Subscriptions > Select mandate > Tap Cancel Automatic Payment > Confirm with PIN.
BHIM App:
Home screen > Mandates > Active > Select the mandate > Tap Revoke Mandate > Confirm by entering your UPI PIN.
Always save a screenshot of the cancellation confirmation screen showing the mandate status as Cancelled.
05. Cancelling Mandates via Net Banking and Bank Stop-Payment
If the loan app created an e-NACH mandate via net banking or debit card credentials, cancel it at the banking level:
1. Net Banking Portal: Log in to net banking, navigate to e-Mandates or NACH Management, find the Unique Mandate Reference Number (UMRN), and click Cancel Mandate.
2. Branch Stop-Payment Letter: Submit a written instruction to your branch manager directing the bank to reject debits from the corporate user. Get a stamped duplicate copy.
3. Disable E-Commerce Limits: In your mobile banking app, turn off online card transactions and set daily payment limits to zero to prevent card-based recurring debits.
06. Section 25 PSSA: Does Revoking AutoPay Constitute a Crime?
Recovery agents often threaten borrowers with criminal prosecution under Section 25 of the Payment and Settlement Systems Act 2007 (PSSA) when an AutoPay mandate is revoked. This claim is legally misleading.
Section 25 applies to electronic transfers dishonoured due to insufficient funds. The statute provides clear borrower safeguards:
Four Statutory Steps Under Section 25:
1. The debit must be for discharging a legally enforceable debt.
2. The mandate must satisfy NPCI procedural guidelines.
3. The lender must issue a written demand notice within 30 days of the bounce.
4. The borrower gets a mandatory 15-day window to pay. No court complaint can be filed before this 15-day period expires.
In Laxmi Dyechem v. State of Gujarat (2012) 13 SCC 375, the Supreme Court recognized that stopping payment does not establish criminal intent when done to prevent unauthorized or disputed debits. Revoking stops unilateral account drainage while preserving your right to settle through lawful channels.
07. Filing Bank Chargebacks for Unauthorized Auto-Deductions
If money was deducted without a 24-hour Pre-Debit Notification or after mandate cancellation, initiate a formal chargeback:
Step 1: Download Statement: Highlight the date, timestamp, UTR reference number, and merchant name. Note the lack of prior SMS alerts.
Step 2: Raise App Dispute (UDIR): Select the transaction in your UPI app, tap Dispute, and choose Mandate Revoked / Unauthorized Debit.
Step 3: Lodge Bank Chargeback: Email your bank grievance cell demanding a refund under RBI unauthorized electronic transactions guidelines.
08. RBI Zero Liability Policy and Mandatory Compensation TAT
Under RBI Circular DBR.No.Leg.BC.78/09.07.005/2017-18 on Customer Protection, clear liability standards protect depositors:
Zero Customer Liability: Reporting an unauthorized electronic transaction within three working days relieves you of financial liability.
Shadow Reversal in 10 Days: The bank must credit the disputed amount back to your account within 10 working days without waiting for merchant agreement.
Burden of Proof on Bank: The bank must prove customer negligence; the customer does not bear the burden of proving innocence.
Under RBI Circular DPSS.CO.PD No.629/02.01.014/2019-20 on Turn Around Time (TAT), failed or unauthorized auto-debits must be resolved within T+1 working days.
Failure to reverse debits within this timeframe requires the bank to pay compensation of Rs 100 per day of delay directly to the customer.
09. Judicial Precedents: Supreme Court on Mandate Violations
Established judicial rulings define the legal duty of banks when handling customer accounts:
Canara Bank vs Canara Sales Corporation (1987) 2 SCC 666:
The Supreme Court held that a bank has no authority to debit a customer account without a valid, subsisting mandate. Any payment made without valid customer instructions is void ab initio, and the bank must restore the funds.
HDFC Bank Limited vs Jesna Jose (NCDRC RP No. 3333 of 2013):
The National Consumer Commission ruled that banks are strictly liable for unauthorized digital deductions unless they prove customer negligence with concrete evidence.
ICICI Bank vs Prakash Kaur (2007) and Shanti Devi Sharma (2008):
The Supreme Court condemned coercive debt recovery, ruling that financial institutions must follow due process rather than employing aggressive measures to extract payments.
10. Escalation Hierarchy: GRO, NPCI UDIR, and RBI Ombudsman
If your bank branch does not refund unauthorized debits within 48 hours, follow this escalation sequence:
1. Bank Principal Nodal Officer: File a formal escalation with your bank grievance cell. The bank has 30 days to resolve the matter.
2. NPCI Dispute Portal: Lodge an online complaint under the UPI AutoPay category on npci.org.in with your statement and revocation proof.
3. RBI Integrated Ombudsman (CMS): If the dispute is unresolved after 30 days, submit a complaint at cms.rbi.org.in. The Ombudsman can award refunds, delay compensation, and harassment damages.
4. Consumer Commission: File a petition before the District Consumer Commission under Section 35 of the Consumer Protection Act 2019 for deficiency in service.
11. Emergency Protocol When Your Bank Account Balance Hits Zero
If an app is actively draining your bank account, take these four immediate defense measures:
1. Divert Salary Credits
Notify your employer to transfer salary to a secondary bank account at an unaffected bank immediately.
2. Lock Digital Cards
Open mobile banking, turn off online card transactions, and set daily digital limits to zero.
3. Revoke All Mandates
Check GPay, PhonePe, Paytm, and BHIM to delete every active recurring mandate using your UPI PIN.
4. Report to Cyber Cell
File a complaint on cybercrime.gov.in or dial 1930 if the deductions involve unauthorized loan apps.
12. Verbatim Legal Notice and Bank Dispute Templates
Use these standard drafts to stop unauthorized auto-debits and demand immediate refunds:
Template A: Stop-Payment and Mandate Revocation Notice to Bank Branch Manager
URGENT: INSTRUCTION TO CANCEL RECURRING MANDATE AND STOP ELECTRONIC DEBITS
Date: [Insert Date]
To: The Branch Manager, [Bank Name], [Branch Address]
Subject: Immediate Revocation of UPI AutoPay / e-NACH Mandate for Account No: [Insert Account Number]
Dear Sir/Madam,
1. I hold Savings Account No: [Account Number] at your branch. I am writing to issue a formal customer instruction under RBI Master Directions on Customer Service to cancel and revoke all recurring electronic debit mandates registered in favor of [Insert Merchant/Lender Name], Mandate/UMRN Reference No: [Insert Reference Number].
2. I have revoked this payment authorization. Any future debit instruction presented against this mandate must be rejected as Mandate Revoked by Customer.
3. Under the Supreme Court ruling in Canara Bank v. Canara Sales Corporation (1987) 2 SCC 666, the bank has no legal authority to part with my funds without a valid, subsisting mandate. Any debit allowed subsequent to this notice will constitute a deficiency in service under Section 2(11) of the Consumer Protection Act 2019, rendering the bank liable for refund and statutory interest.
4. Please provide a written acknowledgment confirming the deregistration of this mandate within 24 hours.
Yours faithfully,
[Your Full Name]
[Contact Phone Number]
Template B: Formal Chargeback and Refund Demand for Unauthorized Deductions
FORMAL CHARGEBACK DEMAND UNDER RBI CIRCULAR DBR.No.Leg.BC.78/09.07.005/2017-18
Date: [Insert Date]
To: The Principal Nodal Officer / Grievance Cell, [Bank Name]
Subject: Chargeback Claim for Unauthorized Electronic Debits on Account No: [Account Number]
Dear Sir/Madam,
1. On [Insert Dates], unauthorized sums totaling Rs [Insert Total Amount] were automatically deducted from my account via UPI AutoPay by [Merchant Name] under Transaction Reference IDs: [Insert RRN / UTR Numbers].
2. These transactions are unauthorized because: (a) No mandatory 24-hour Pre-Debit Notification was provided as required by NPCI UPI AutoPay Guidelines; (b) The debits exceed agreed repayment terms; and (c) The mandate was revoked prior to presentation.
3. As per Paragraph 6 of RBI Circular DBR.No.Leg.BC.78/09.07.005/2017-18, I am reporting this unauthorized transaction within three working days. My liability is zero. Under Paragraph 9, your bank must credit the shadow reversal of Rs [Amount] back to my account within 10 working days.
4. Under RBI Circular DPSS.CO.PD No.629/02.01.014/2019-20, delay beyond prescribed TAT attracts compensation of Rs 100 per day payable to me. Failing immediate credit, I will escalate this to the RBI Integrated Ombudsman.
Yours sincerely,
[Your Full Name and Registered Email]
13. Frequently Asked Questions
Can a loan app legally deduct money from my bank account every day?[+]
No. Loan repayments must follow agreed amortization schedules in the Key Fact Statement under RBI Digital Lending Guidelines 2022. Daily sweeps, split debits, or balance skimming without explicit contractual authorization and 24-hour pre-debit notifications violate NPCI UPI AutoPay operating rules and RBI fair practice codes.
How quickly does revoking a UPI AutoPay mandate take effect?[+]
Revocation takes effect immediately on the central NPCI UPI switch. Once you enter your UPI PIN in Google Pay, PhonePe, Paytm, or BHIM to cancel, the mandate status changes to Revoked. Any subsequent debit attempt by the lender is instantly rejected by your bank.
Will cancelling my UPI AutoPay mandate make me liable under Section 25 PSSA?[+]
No. Section 25 of the Payment and Settlement Systems Act 2007 penalizes dishonour due to insufficient funds or exceeding limits. A borrower has the legal right to stop payment. Revoking stops unilateral account sweeps. The lender must issue a formal 30-day written demand notice before any court action.
Can my bank refuse to cancel an e-NACH or UPI AutoPay mandate?[+]
No. Under RBI Master Directions on Digital Payment Security Controls and NPCI rules, banks must provide native facilities to cancel mandates. If a bank branch refuses or fails to record a stop-payment instruction, it commits a deficiency in service under Section 2(11) of the Consumer Protection Act 2019.
What is a Pre-Debit Notification (PDN) and why is it mandatory?[+]
Under RBI e-mandate rules and NPCI guidelines, payment service providers must send an SMS or notification at least 24 hours prior to the actual debit. This informs the borrower of the exact debit amount and date, giving an opportunity to verify the charge or pause the mandate.
Can I get a refund for unauthorized auto-debits already deducted from my account?[+]
Yes. If a debit occurred without a mandatory 24-hour pre-debit alert, after you revoked the mandate, or through fraud, file a bank chargeback. Under RBI Circular DBR.No.Leg.BC.78/09.07.005/2017-18, reporting within 3 days gives you zero liability and a shadow reversal within 10 working days.
What compensation does the bank owe me if unauthorized debits are not reversed on time?[+]
Under RBI Harmonisation of Turn Around Time Circular DPSS.CO.PD No.629/02.01.014/2019-20, banks must resolve failed or unauthorized auto-debits within T+1 working days. Any delay beyond this timeline mandates compensation of Rs 100 per day of delay payable to the customer.
What should I do if a loan app created hidden mandates on different UPI apps?[+]
Open every UPI app installed on your smartphone: Google Pay, PhonePe, Paytm, and BHIM. Check the AutoPay or Mandates section for every linked account. Look for active mandates under aggregator names like Razorpay, Cashfree, or PayU, and cancel each one using your UPI PIN.
Can I file a police complaint if a loan app continues attempting auto-debits?[+]
Yes. If an unlicensed predatory loan app repeatedly attempts unauthorized withdrawals or engages in harassment, file a complaint on the National Cyber Crime Reporting Portal at cybercrime.gov.in or call 1930. You can also report the app on the RBI Sachet portal.
How does revoking a loan AutoPay mandate affect my credit score?[+]
Revoking the mandate itself does not show on your credit report. However, if the underlying loan EMI remains unpaid past the due date, the regulated lender will report the missed payment as Days Past Due (DPD) to CIBIL and other bureaus, reducing your credit score by 60 to 120 points.
Official Statutory Resources & Regulatory Portals
RBI & GOVT VERIFIEDAccess official government portals, regulatory ombudsman channels, and statutory dispute resolution bodies governing Indian banking and borrower rights:
- RBI Integrated Ombudsman Scheme (CMS)↗
File complaints against bank recovery abuse and fair practice violations
- RBI Sachet Portal (Illegal Recovery & Harassment)↗
Report unauthorized lending apps and aggressive recovery agency violations
- NALSA National Lok Adalat Schedules↗
Statutory alternative dispute resolution for mutually agreed OTS settlements
- National Consumer Helpline (NCH)↗
Government grievance redressal under Department of Consumer Affairs
- National Cyber Crime Reporting Portal (1930)↗
Official reporting for recovery blackmail, cyber threats, and extortion
- NPCI UPI AutoPay Operating Framework and Guidelines↗
Official National Payments Corporation of India technical framework on mandate creation, modification, and customer revocation.
- RBI Circular on Limiting Customer Liability (DBR.No.Leg.BC.78/09.07.005/2017-18)↗
Reserve Bank rules granting zero liability for unauthorized electronic transactions reported within three working days.
- Payment and Settlement Systems Act 2007 Section 25↗
Statutory provisions governing dishonour of electronic fund transfers, demand notice periods, and 15-day cure requirements.
- Canara Bank vs Canara Sales Corporation (1987) 2 SCC 666↗
Supreme Court ruling establishing that a bank cannot debit a customer account without a valid, subsisting customer mandate.
- RBI Harmonisation of TAT and Customer Compensation (DPSS.CO.PD No.629/02.01.014/2019-20)↗
RBI directions mandating Rs 100 per day compensation for delayed auto-reversals of failed or unauthorized digital transactions.
Community Discussion & Case Notes
0 CommentsNo comments posted yet. Be the first to share your experience below!
Join the Discussion & Share Your Experience
Have you dealt with this situation or received a notice? Share your questions or experience with other borrowers.
Find this content helpful?
If this guide has helped you navigate your settlement journey, consider showing some support to keep this platform running.