What is UPI Fraud?

The Unified Payments Interface (UPI) has transformed digital payments in India by making instant money transfers simple and convenient. However, its widespread adoption has also made it one of the most common targets for cybercriminals.

UPI fraud refers to any fraudulent activity in which a person is deceived into transferring money, sharing confidential credentials, or authorising a transaction through a UPI-enabled application. Fraudsters often exploit trust, urgency, fear, or lack of awareness rather than technical vulnerabilities.

Contrary to popular belief, most UPI frauds do not occur because the UPI system itself has been hacked. Instead, they occur because victims are manipulated into voluntarily approving transactions or revealing sensitive information.

Common Types of UPI Fraud

1. Collect Request Scam

A fraudster sends a “Collect Money” request while falsely claiming that the request is required to receive money.

For example:

“Please accept this request to receive your refund.”

In reality, approving the request authorises payment from your account.

---

2. QR Code Scam

A scammer shares a QR code claiming it is required to receive payment or you may find a QR code pasted somewhere with offers such as free benefits, etc.

Scanning such a QR code and authorising the transaction may instead transfer money from your account.

Remember:

Receiving money never requires scanning someone else’s QR code.

---

3. Fake Customer Care Scam

Fraudsters impersonate customer support representatives from banks, payment apps, or e-commerce platforms.

They may:

• ask you to install remote access applications;
• request OTPs or UPI PINs;
• send fraudulent payment requests;
• direct you to fake websites.

You should never install APIs from unknown sources no matter what!!!! And never share PIN or OTP with any customer care personnel….

---

4. Remote Access Application Scam

Victims are persuaded to install screen-sharing or remote access applications.

Once installed, fraudsters observe confidential information or guide victims into authorising transactions.

---

5. KYC Update Scam

Victims receive calls or messages claiming that their bank account or wallet will be blocked unless Know Your Customer (KYC) details are updated immediately.

The victim is directed to a fake website or asked to disclose banking credentials. This may take place in other places where you might be receiving money like Platforms such as Ko-fi, Patreon, Paypal or even Youtube.

---

6. Cashback and Reward Scam

Fraudsters promise cashback, prize money, loyalty rewards, or government benefits.

Victims are tricked into approving payment requests while believing they are receiving money.

---

7. Marketplace Scam

On platforms used for buying and selling goods, fraudsters pretend to be genuine buyers.

Instead of paying for the item, they send a payment request that debits the seller’s account.

---

Warning Signs

Be cautious if someone:

• creates urgency;
• insists on immediate payment;
• asks for your UPI PIN;
• requests an OTP;
• asks you to install an application;
• asks you to scan a QR code to receive money;
• claims your account will be blocked immediately;
• asks you to share your mobile screen.

These are common indicators of fraud.

---

What To Do Immediately If You Have Been Scammed

Step 1

Call 1930 immediately.

Prompt reporting can improve the chances of preventing further movement of funds.

---

Step 2

Contact your bank immediately.

Request that:

• the transaction be reported as fraudulent;
• beneficiary accounts be frozen where possible;
• your complaint reference number be recorded.

---

Step 3

File a complaint through the National Cyber Crime Reporting Portal.

Keep a copy of the complaint acknowledgement.

---

Step 4

Preserve all evidence.

Do not delete:

• SMS messages;
• WhatsApp chats;
• call logs;
• screenshots;
• transaction IDs;
• bank statements;
• emails;
• QR codes;
• payment requests.

---

Step 5

Secure your accounts.

Immediately:

• change passwords;
• change email passwords if linked;
• enable two-factor authentication;
• review recent transactions;
• log out from all devices where appropriate.

---

Evidence Checklist

Preserve the following:

✓ UPI Transaction ID

✓ Date and time

✓ Amount transferred

✓ Beneficiary UPI ID

✓ Mobile number used by the fraudster

✓ Bank statements

✓ Screenshots

✓ Call recordings (if available)

✓ WhatsApp conversations

✓ Email correspondence

---

Can Your Money Be Recovered?

Recovery depends on several factors, including:

• how quickly the fraud was reported;
• whether the funds remain available in the beneficiary account;
• cooperation between financial institutions;
• investigative progress by the authorities.

Prompt reporting significantly improves the possibility of tracing or freezing funds.

---

Can the Bank Be Held Responsible?

Whether a bank bears liability depends on the facts of each case.

Relevant considerations may include:

• whether the transaction was authorised;
• whether banking procedures were followed;
• compliance with applicable regulatory directions;
• negligence, if any, on the part of the customer or the bank.

Legal advice should be obtained where liability is disputed.

---

How to Protect Yourself

Follow these simple precautions:

• Never share your UPI PIN.
• Never disclose OTPs.
• Never approve a collect request unless you initiated it.
• Never scan a QR code to receive money.
• Verify customer care numbers through official websites.
• Install applications only from trusted sources.
• Keep your mobile operating system updated.
• Enable app locks and biometric authentication where available.
• Regularly review your bank statements.

---

Frequently Asked Questions

• Can someone withdraw money using only my mobile number?

Generally, no. Additional authentication is ordinarily required. However, scammers may attempt to manipulate you into completing the transaction yourself.

• Is sharing my UPI ID dangerous?

Sharing your UPI ID alone does not usually allow someone to debit your account. However, they may use it to send fraudulent payment requests.

• Do I need to share my UPI PIN to receive money?

No.

You never need to disclose your UPI PIN to receive money.

• Is scanning a QR code required to receive payment?

No.

Receiving money does not require scanning another person’s QR code.

• Can I recover funds after several days?

Recovery becomes more difficult as time passes, but reporting the incident remains important regardless of when it occurred.

Need Assistance?

If you have been affected by UPI fraud:

• preserve all evidence;
• report the incident without delay;
• cooperate fully with your bank and investigating authorities; and
• seek legal advice where necessary regarding available remedies.

Remember:

Awareness is your strongest defence against cyber fraud.