IT Act Section 43: Any person who, without permission, accesses or causes wrongful financial loss through fraudulent use of digital payment systems — including UPI, card networks, payment gateways and banking portals — is liable for compensation up to ₹1 crore. This civil remedy provides victims a direct route to claim compensation without waiting for criminal proceedings to conclude.

IT Act Section 66: Dishonestly or fraudulently accessing payment systems, manipulating transaction data, intercepting OTPs and using stolen card credentials — imprisonment up to 3 years or fine up to ₹5 lakh or both. The primary criminal provision for all forms of online payment fraud involving unauthorised system access.

IT Act Section 66C — Identity Theft: Using stolen card credentials, net banking passwords, UPI PINs or digital identities to fraudulently initiate transactions — imprisonment up to 3 years and fine up to ₹1 lakh. Directly applicable to card not present fraud, credential theft via phishing and UPI account takeover for fraudulent transactions.

IT Act Section 66D — Cheating by Impersonation: Posing as banks, payment companies, government departments, army officers or genuine buyers/sellers using computer resources to fraudulently extract payments — imprisonment up to 3 years and fine up to ₹1 lakh. Covers UPI collect scams (posing as genuine buyers), OLX army scams and fake payment gateway fraud.

BNS Section 318 — Cheating: The primary criminal provision for all forms of transaction fraud that involve deceiving a person to deliver money or property — imprisonment up to 7 years and fine. Covers the full spectrum of online transaction fraud including UPI collect scams, fake payment sites, advance payment fraud and business email compromise.

BNS Section 319 — Cheating by Personation: Fraudulently assuming the identity of an army officer, bank official, RBI representative or genuine buyer/seller to extract payments — imprisonment up to 3 years and fine. Specifically applicable to the OLX Army scam, RBI impersonation calls and fake buyer fraud on classifieds platforms.

BNS Section 316 — Criminal Breach of Trust: Where insiders at payment companies, banks or e-commerce platforms assist fraudsters by leaking customer data used to target victims for transaction fraud — imprisonment up to 7 years and fine. Also applicable to payment gateway operators who fail to implement adequate fraud prevention despite knowing their platform is being misused.

Payment and Settlement Systems Act 2007 (PSS Act): Governs all payment systems in India including UPI, IMPS, NEFT, RTGS and card networks. Fraudulent manipulation of payment instructions, interception of payment flows and operation of unauthorised payment collection platforms are criminal offences. The RBI can impose significant penalties on regulated payment operators who fail to prevent or report fraud on their platforms.

RBI Customer Liability Circular 2017: Victims of unauthorised electronic transactions are entitled to zero liability if they report within 3 working days of receiving communication about the fraud — the bank must reverse the amount within 10 days. For delayed reporting (4–7 days), liability is capped at ₹5,000 or the transaction amount, whichever is lower. Victims must report immediately and formally invoke this circular in written complaints to their banks.

Consumer Protection Act 2019: E-commerce platforms, payment aggregators and digital service providers that fail to adequately protect customers from fraud or that facilitate fraudulent transactions through negligence can face complaints before District Consumer Commissions. Victims can claim compensation for mental agony, financial loss and deficiency of service — providing an additional civil remedy alongside criminal and RBI channels.