When must banks cover losses from UPI scams in one's accounts?

If a bank's security failure leads to a UPI scam, it must cover the loss, even if the customer does not report it immediately. In cases involving third-party breaches where neither the customer nor the bank is at fault, the bank must restore the money if the customer reports the fraud within three working days of receiving the bank's alert.