10 Dangerous UPI Scams in India — How They Work & How to Stay Protected

UPI scams in India cost users crores each year. Learn how the 10 most dangerous UPI frauds work, real-life examples, RBC/NPCI guidelines, exact steps to recover, and smart prevention tactics. UPI fraud in India, UPI scam protection tips, online banking fraud India, UPI collect request scam, fake QR code UPI scam, SIM swap fraud India, how to report UPI fraud ,instant payment fraud, screen sharing scam, refund scam, cybercrime helpline 1930, NPCI fraud awareness.

Introduction to UPI Scams in India – why this matters now

UPI transformed Indian payments by making instant bank-to-bank transfers as easy as a tap. That convenience has powered mass adoption — but it has also created new, fast-moving opportunities for fraudsters. Unlike card or cheque fraud, UPI steals often complete in minutes: the user authorises a payment (or is tricked into authorising it), and the money is gone. The system itself (built around two-factor authentication and tokenisation) remains secure, but most losses occur because people are manipulated into giving away credentials, approving collect requests, or running apps that expose their phones. Similar behavioural manipulation patterns are visible across broader online payment threats such as Digital Payment Frauds in India Indians Are Falling For. For readers of Penny Blue Print — who care about practical safety and solid, verifiable advice — understanding the psychology and the mechanics behind these scams is more useful than sensational headlines. The sections below describe how frauds work, give separate, short real-life examples, and then explain precise, practical safeguards and recovery steps.

1. Collect-request scam (most common social-engineering play)

How it works:

Scammers sending a collect request exploit the victim’s lack of awareness about how UPI works. A collect (or “request”) message looks like a normal UPI notification; the fraudster persuades the victim that accepting the request is necessary to receive money (for example, a buyer paying for an item). In reality, approving a collect request with your UPI PIN authorises a debit — it sends money from your account to the requester. The scam relies entirely on social engineering: urgency, trust (a marketplace buyer or a familiar-sounding person), and confusion about “approve” vs “receive.” Because UPI moves funds instantly, the scam completes within seconds and banks may find it hard to recover funds unless you report right away.

Example:

A user lists a laptop on a second-hand site and is told a buyer will “send the payment.” The seller sees a UPI collect request for the exact amount and — thinking they need to accept the payment — enters their UPI PIN. Moments later the seller finds ₹12,500 debited. The buyer’s number is unreachable and the transaction shows as “successful.” The seller later realises they approved a debit, not a receipt.

2. Fake QR-code / QR-substitution scam

How it works:

QR codes are convenient but blind: scanning a QR launches a payment flow whose beneficiary is encoded in the code. Fraudsters generate or substitute QR codes so the payee becomes the scammer. Tactics include: (a) showing a printed QR in a public place that actually points to the fraudster’s UPI ID, (b) sending an image of a QR as part of a “refund” or “deposit” process, or (c) digitally swapping a legitimate merchant’s QR on a marketplace listing. Because smartphone users often trust visual QR prompts, victims may scan and confirm a payment thinking they are receiving money or confirming a transfer. This scam also appears as QR images posted in comments on marketplace listings (the listing looks genuine; the code is not). NPCI and payment apps repeatedly warn that scanning a QR and entering a UPI PIN always initiates a payment and will not credit you automatically.

Example:

A tenant is promised refund of a rental deposit by a landlord; the landlord sends a QR image and says “scan to get ₹5,000 back.” The tenant scans, sees a familiar app screen, enters the UPI PIN — and immediately sees ₹5,000 leave their account. Later they learn the QR linked to a fraudster’s UPI ID, not the landlord’s.

Prevention:

• Never scan a QR you did not verify in person.
• If someone says “scan to receive,” politely refuse and ask for a direct credit or bank transfer instead.
• Verify merchant UPI IDs from the official merchant app or invoice.

3. KYC / Bank-update impersonation

How it works:

Scammers call, SMS, or WhatsApp pretending to be from your bank, NPCI, or “RBI” (the central bank is often invoked to create authority). The message claims your UPI/Internet banking will be suspended unless you perform an “urgent KYC” or “reset”. Targets are directed to phishing sites that mimic bank pages or to “support staff” who ask for OTPs, UPI PIN, or card/CVV details. Sometimes these calls mention details scraped from data breaches to appear believable. RBI’s public advisories are explicit: banks will never ask for UPI PINs or OTPs over phone. Sharing OTP, PIN, or CVV immediately hands the attacker the keys to your account.

Example:

An account holder receives a voicemail that looks like an official bank alert, with the bank name and last four digits of their account. The caller says the user must verify KYC via a provided link; the victim visits the site, enters OTP and card CVV — and within minutes URI transactions start showing on their statement.

Prevention (short pointers):

• Never enter OTP or UPI PIN on links received by SMS/WhatsApp.
• Confirm any bank call by hanging up and calling the official number shown in your banking app.

4. Screen-sharing / remote-control app scam

How it works:

Scammers instruct victims to install remote-access apps such as AnyDesk, TeamViewer, or QuickSupport, claiming it’s for “verification” or “refund processing.” Once the app runs, the fraudster watches actions in real time and may even control the phone to open banking apps, request OTPs, or capture UPI PIN entries. Some attackers use overlays to capture PINs visually. This is particularly effective on less tech-savvy or elderly users who trust the caller. Banks explicitly warn users not to give remote access to their phones for transaction assistance.

Example:

A senior receives a call that their pension payment failed and is asked to install a “verification” app. The caller watches them open the bank app, then instructs them to enter their UPI PIN “so we can check the screen.” The fraudster immediately performs UPI transfers while watching.

Prevention:

• Never allow remote access to your phone for banking help.
• If someone needs to verify, insist they explain what they will see and never enter PINs while connected

5. SIM-swap / mobile-port takeover

How it works:

In SIM-swap fraud, an attacker convinces a telecom provider to port or reissue your mobile number onto a SIM in their possession. With your number, they receive OTPs and calls and can trigger UPI PIN resets or authorise transactions that require an SMS OTP. Extended financial disruption from such events can sometimes influence long-term credit exposure similar to scenarios CIBIL Score Guarantor Risks. Methods include social engineering telecom staff, using leaked KYC data, or creating fake documents. RBI and banks have case precedents where SIM swaps enabled large unauthorised debits — and immediate reporting to both bank and telco is crucial. Telecoms and police units are improving controls, but personal vigilance (like setting a SIM-lock PIN) helps.

Example:

A user notices sudden “no network” on their phone and then receives OTP messages for transactions they did not initiate. By the time they contact their operator, their number has been ported and ₹50,000 transferred from their account. The user files a cybercrime complaint and contacts the bank to try to reverse transfers.

Prevention:

• Set a unique SIM-PIN or customer-set PIN with your telecom operator.
• Immediately contact your mobile operator if network drops unexpectedly; inform your bank at once.

6. Cashback / reward claim scam

How it works:

Scammers exploit the popularity of cashback offers. They send messages claiming you’ve won cashback or reward and ask you to claim via a link or collect request. Because the message promises money, victims often follow instructions and — in the process of “claiming” — approve a debit. Legitimate reward crediting happens automatically in the beneficiary’s account; you should never need to enter a PIN to receive cashback. NPCI and banks repeatedly flag such messages as fraudulent.

Example:

A customer receives a WhatsApp message: “You have won ₹750 cashback — click to claim.” The link asks the user to log into a mimic UPI app and enter the UPI PIN to “confirm identity.” Instead they authorise a payment and lose funds; the “cashback” never appears.

Prevention:

• Treat unexpected “rewards” with suspicion.
• Verify promotions only through official bank or app channels.

7. Fake customer-care number and search-result spoofing

How it works:

Fraudsters buy web domains or manipulate search engine ads to present fake customer-care numbers. A victim searching “bank customer care number” may call a scammer pretending to be support. Once on the phone, the scammer extracts OTPs or instructs the victim to approve transactions for “verification.” Banks and NPCI recommend using numbers from the official website or the bank’s app rather than general internet searches. Local police and cyber cells advise checking domain legitimacy and avoiding numbers from untrusted sources.

Example:

A user Googles their bank’s helpline and dials the top result (an ad). The agent claims suspicious activity and asks for OTPs to freeze the account. The victim shares OTP, and transfers show up minutes later.

Prevention:

• Always use the number from your bank’s official website or app.
• Cross-check a support number via multiple official channels before sharing any OTP.

8. Investment / trading group pump-and-dump scams

How it works:

Scammers run Telegram, WhatsApp or social media groups promising “guaranteed returns” from trading, small-cap tips or crypto alerts. They show forged screenshots of account statements and ask members to deposit money via UPI for quick transfers. Early small withdrawals build trust; later, larger deposits are requested and the group admins vanish. Instant UPI transfers help scammers move cash fast and privately. Regulatory bodies warn investors to avoid “guaranteed return” claims — markets never guarantee consistent profits.

Example:

Members of a WhatsApp group deposit ₹5,000 each to test a “trading bot.” One member withdraws a small profit and posts a screenshot, encouraging larger deposits. When 50 members send ₹20,000 each, the group admin deletes the channel and blocks everyone.

Prevention:

• Avoid investment groups promising guaranteed returns.
• Don’t move money to third-party wallets or individuals for “exclusive” tips.

9. Emergency impersonation (emotion-based pressure)

How it works:

This scam preys on empathy. Attackers call impersonating a family member in distress (accident, hospital, police custody) and demand immediate payment via UPI. Often, they social-engineer the victim by first gathering family information from social media to sound believable. Panic short-circuits verification; victims send money quickly and the scammer disappears. Law enforcement and cyber helplines recommend independent verification — call the relative directly, contact neighbours, or check with police/hospital before sending money.

Example:

A caller says “This is your son — I’m in hospital, need ₹60,000 now.” The victim, terrified, opens the bank app and transfers funds via UPI. Afterward they call their son; he is fine and at work. The scammer used personal details pulled from social profiles to convince the caller.

Prevention (short pointers):

• Take a breath: verify through another channel before sending money.
• Insist on a callback to the person’s known number, not the caller’s number.

10. Refund reversal / failed-refund scam

How it works:

Scammers call buyers or customers claiming a refund failed and ask them to “reapprove” a refund or scan a QR to credit the amount. They may instruct customers to approve a collect request as “reprocessing.” In safe systems, refunds are credited automatically to the original payment method; no PIN or approval from the recipient is required. When victims follow instructions, they end up sending money to the scammer instead of receiving the refund. NPCI fraud-awareness notes specifically warn against accepting refund QR links or approving collect requests that are unsolicited.

Example:

After cancelling an order, a customer gets a call: “Your refund failed; please scan this QR to re-credit it.” Trusting the call, the customer scans and authorises a payment. Later the bank confirms the refund was already processed and the scanned QR belonged to a fraudster.

Prevention:

• Check your app’s refund status before scanning QR codes or accepting collect requests.
• Contact the merchant via the official app or email for confirmation.

What Reserve Bank of India and National Payments Corporation of India say about UPI safety

Both RBI and NPCI emphasise that UPI relies on user authentication mechanisms (PINs, device binding, and in some cases SMS OTP) and that user confidentiality of credentials is paramount. RBI’s public advisories repeatedly instruct customers not to share passwords, PINs, OTPs, or CVV under any circumstances, and to avoid public Wi-Fi for banking. NPCI’s UPI documentation highlights two-factor authentication, tokenisation (where applicable), and merchant verification; NPCI also runs awareness campaigns on common frauds like collect requests and QR substitution. Because the technical safeguards are strong, RBI and NPCI consistently frame fraud prevention as primarily a user-behaviour issue — educate users, limit unnecessary sharing of sensitive data, and report incidents quickly so banks can act. For specific RBI consumer advisories about not sharing PINs/OTPs, and NPCI’s fraud-awareness pages, see the clickable sources at the end.

What to do immediately if you suspect UPI fraud — step by step

Time matters. The faster you act, the better the chance of stopping further loss.

1. Immediately block or disable UPI in the app — most banking apps or UPI apps allow a quick disable/lock of UPI payments. This prevents additional unauthorised debits.
2. Contact your bank’s fraud/chargeback team using the official number in the app; ask them to place an emergency hold or to reverse the transaction if possible. In certain cases, temporary transaction restrictions may follow, affecting scheduled repayments in ways similar to EMI When Bank Account Is Frozen in India. Provide transaction IDs and timestamps. Banks have limited windows but can sometimes reverse transfers if notified quickly. During investigations, banks may differentiate between outgoing and incoming fund restrictions, a distinction that becomes clearer in Debit Freeze vs Credit Freeze in Bank Account.
3. File a complaint on the National Cyber Crime Reporting Portal (call 1930 or register at cybercrime.gov.in) so there is an official record and the I4C / local cyber cell can coordinate recovery and investigation. This portal also helps escalate to banks and telecoms for SIM-swap or blocking.
4. Inform your telecom provider if SIM swap is suspected; ask them to block further porting and to freeze the number. Provide any suspicious SMS or call logs.
5. Collect evidence — screenshots of messages, transaction records, caller IDs, and any QR image. This helps police and bankers trace where the funds went.
6. If amount is large, file an FIR at the local police station and share the FIR number with the bank and cyber portal.

(Short actionable checklist for readers: call bank → block UPI → file at cybercrime.gov.in or call 1930 → contact telco → collect evidence.)

Common misconceptions

• “UPI is inherently unsafe.” Not true. UPI uses secure protocols and has regulatory oversight; the primary risk is social engineering and credential exposure.
• “Small amounts don’t matter.” Fraudsters test small transactions to validate control and then escalate to larger thefts. Early reporting makes small-value recoveries easier.
• “If bank approved transaction, it cannot be reversed.” Not always true — banks sometimes reverse fraudulent transactions when notified quickly and when the transfer path is traceable. But timely reporting is essential.

9 Practical protection steps

• Never share OTP, UPI PIN, CVV, or passwords with anyone — not over phone, SMS, or WhatsApp.
• Don’t approve collect requests unless you initiated them and know the requester.
• Disable screen-sharing apps after use and never install them for banking help.
• Use official app numbers and website links only; verify customer-care numbers from the bank app.
• Set transaction limits and separate UPI IDs for business vs personal use.
• Enable push alerts for all transactions and review statements weekly.
• Register a SIM-lock PIN with your telecom operator and consider adding a port-out PIN.
• Keep OS and apps updated; avoid banking over public Wi-Fi.
• If in doubt, call the bank using the number inside your official app.

Conclusion — a clear, realistic final word

UPI’s speed and ubiquity are enormous benefits — but they demand equal attention to personal security practices. Most UPI scams succeed because they manipulate human attention and trust, not because of a broken payment system. Read the signs above, follow the immediate actions if something goes wrong, and adopt the protective behaviours listed. With simple habits — verifying numbers, refusing unrequested collect requests, and reporting quickly — most UPI scams are preventable. Strengthening overall financial resilience also involves understanding systemic scenarios such as What Happens If a Bank Fails in India.

FAQs

Disclaimer

This article is published for educational and awareness purposes only. The information is based on publicly available guidelines from regulatory and law-enforcement sources and is not legal, financial, or security advice. Readers are advised to verify details directly with their bank, payment service provider, or official authorities before taking any action. Penny Blue Print is not responsible for losses arising from misuse of information or fraudulent activities by third parties.