UPI Fraud: 12 Common Scams and How to Stay Safe
Twelve common UPI scams explained with the warning sign for each, plus the exact steps to take if you lose money, including the 1930 helpline.
Almost every UPI fraud works the same way: the scammer makes you do something, whether entering your PIN, scanning a code, sharing your screen or installing an app. UPI itself is rarely “hacked”. This guide explains the 12 scams Indians most often fall for, the exact warning sign for each, and what to do in the first hour if money has already left your account, including calling the 1930 cybercrime helpline.
Key Takeaways
- You never need to enter your UPI PIN or scan a QR code to receive money. A PIN request always means money is leaving your account.
- If you are defrauded, call 1930 or report at cybercrime.gov.in immediately. Speed matters because the system can alert banks to freeze funds.
- Under RBI rules, reporting an unauthorised electronic transaction to your bank within three working days can protect you from liability in eligible cases.
- No bank, police officer, courier or government agency will ask you to install a screen-sharing app, pay to “verify” anything, or stay on a video call under “digital arrest”.
- Report suspicious calls, SMS and WhatsApp messages, even when you lost nothing, through Chakshu on Sanchar Saathi.
The One Rule That Stops Most UPI Fraud
Before the list, remember this: your UPI PIN is only for sending money. You do not enter it to receive a payment, to get a refund, to claim a prize or to “verify” your account. The same goes for scanning QR codes. A QR code is scanned to pay, never to receive.
If anyone, on any call, chat or website, asks you to enter your PIN or scan a code so that money can come to you, stop. That single rule defeats a large share of the scams below.
A useful change also happened recently. The National Payments Corporation of India (NPCI) directed banks and UPI apps to stop processing person-to-person “collect requests” from 1 October 2025, because fraudsters used them to trick people into approving payments. Merchant collect requests, such as those from shopping or ticketing apps you are actively using, still exist. So a payment request that appears while you are not buying anything deserves suspicion.
12 Common UPI Scams and How to Spot Them
1. “Enter your PIN to receive money”
How it works: A buyer on an online marketplace, a caller offering cashback or someone “returning” money sends you a link or a request and says you must approve it to receive the amount.
Warning sign: any request for your UPI PIN in connection with receiving money. Do this: decline and block. Real payments land in your account with nothing to do on your side.
2. QR code scam
How it works: The fraudster, often posing as a buyer for something you listed online, sends a QR code and asks you to scan it “to receive the advance”.
Warning sign: anyone asking you to scan a code to get paid. Do this: ask them to pay to your UPI ID or number instead. At shops, check that the name shown after scanning matches the shop before you enter your PIN, since tampered or pasted-over QR stickers are a known trick.
3. Fake customer care numbers
How it works: You search online for a bank, courier, airline or payment app helpline and call a number posted by fraudsters. The “agent” then walks you through steps that transfer your money.
Warning sign: helpline numbers found in search ads, social media comments or random websites. Do this: use only numbers from the official app, the back of your card, or the company’s official website.
4. Screen-sharing and remote-access apps
How it works: The caller asks you to install a screen-sharing or remote-control app “to fix your problem”. Once installed, they can see your OTPs and PIN entries.
Warning sign: any request to install an app during a support call. Do this: refuse. Genuine banks do not need access to your phone screen.
5. KYC update and account block messages
How it works: An SMS or WhatsApp says your bank account, UPI or wallet will be blocked today unless you update KYC through a link.
Warning sign: urgency plus a link from an unknown number. Do this: do not click. If worried, open your bank’s official app or visit a branch.
6. Electricity, gas or phone bill disconnection threats
How it works: A message claims your electricity will be cut tonight because the last bill was not updated, and gives a mobile number to call.
Warning sign: official-sounding threats from a personal mobile number. Do this: check your bill status on the official electricity board website or app.
7. “Wrong transfer, please return it”
How it works: You get an SMS that looks like a credit alert, or a real small amount, followed by a desperate call asking you to send it back, often a larger figure. In some versions, the credit alert is completely fake.
Warning sign: pressure to return money quickly. Do this: check your actual balance in the bank app, not the SMS. If money really came in by mistake, tell the caller to raise it with their bank, which can process a reversal properly.
8. Fake payment screenshots at shops
How it works: A customer shows a “payment successful” screen at your shop and leaves with goods, but no money arrived. Edited screenshots and fake payment apps make this easy.
Warning sign: the customer shows their phone instead of letting your system confirm. Do this: rely on your soundbox announcement or your own app notification before handing over goods.
9. Part-time job and task scams
How it works: You are offered easy money to like videos, review hotels or rate products. The first few tasks pay small amounts. Then you are asked to “invest” or “top up” to open up bigger tasks, and the money disappears.
Warning sign: any job that asks you to pay. Do this: exit the group and report it.
10. Investment and trading groups
How it works: WhatsApp or Telegram groups promise guaranteed daily returns from stock tips, IPO allotments or crypto. A fake app shows growing profits, but withdrawals are blocked unless you pay “tax” or “fees”.
Warning sign: guaranteed returns and unregistered apps. Do this: invest only through SEBI-registered brokers and official apps from the Play Store or App Store, and never through links shared in groups.
11. “Digital arrest” and fake police or customs calls
How it works: Callers pose as police, CBI, customs, courier companies or regulators and claim a parcel in your name contains drugs, or your Aadhaar was used in a crime. They keep you on a video call for hours and demand money to “clear” your name.
Warning sign: any official demanding payment over a video call. Do this: hang up. There is no such thing as a digital arrest under Indian law. Talk to your family and your local police station directly.
12. Malicious APK files and fake apps
How it works: You receive a file like “wedding_invitation.apk”, “traffic_challan.apk” or a “bank reward” app on WhatsApp. Installing it can give fraudsters access to your SMS messages, including OTPs.
Warning sign: any file ending in .apk sent by chat. Do this: never install apps from outside the official app store, and keep “install unknown apps” switched off in your phone settings.
Quick Reference: Scam, Red Flag and Safe Response
| Scam type | Red flag | Safe response |
|---|---|---|
| PIN to receive | PIN asked for incoming money | Decline; PIN is only for paying |
| QR code | Scan to “receive” | Share your UPI ID instead |
| Fake helpline | Number found via search or social media | Use numbers from official app or website |
| Screen sharing | “Install this app so I can help” | Refuse and hang up |
| KYC or bill threat | Urgent deadline plus link | Check in the official app |
| Wrong transfer | Pressure to return money | Verify balance; send them to their bank |
| Job or task | Pay to earn more | Exit and report |
| Investment group | Guaranteed returns | Use only registered brokers |
| Digital arrest | Official demanding money on video call | Hang up; contact local police |
| APK file | App sent by chat | Delete without opening |
Settings That Make Your UPI Safer
- Set a strong UPI PIN that is not your birth year, 1234 or your card PIN. Change it if you have ever shared it.
- Use a screen lock and app lock for your UPI apps.
- Lower your daily UPI limit in your app if you rarely make large payments. It limits damage if something goes wrong.
- Turn on SMS and email alerts for every transaction so you notice problems immediately.
- Keep only needed UPI apps and remove old bank accounts you no longer use from linked apps.
- Update your phone and apps regularly for security fixes.
- Use a separate account with a smaller balance for daily UPI spending, keeping savings in another account not linked to UPI.
What to Do in the First Hour After a UPI Fraud
Speed is the most important factor in recovering money. Follow these steps in order:
- Call 1930 immediately. This is the national cybercrime helpline run by the Indian Cyber Crime Coordination Centre under the Ministry of Home Affairs. Keep ready the amount, date and time, your bank name, and the transaction reference (UTR) number.
- File a complaint online at the National Cyber Crime Reporting Portal (cybercrime.gov.in), even if you have called 1930. Note down the acknowledgement number.
- Inform your bank through its official helpline or app, and ask them to block UPI on the affected account. Get a complaint reference number in writing.
- Change your UPI PIN, and your net banking passwords if you shared any details.
- Save evidence: screenshots of chats, call logs, the fraudster’s UPI ID or number, links and payment receipts.
- Uninstall any app the fraudster asked you to install, and consider resetting your phone if it was a remote-access app or unknown APK.
Your rights under RBI rules
The Reserve Bank of India’s circular on limiting customer liability in unauthorised electronic banking transactions sets out when you are protected. In brief, if the fraud happened because of a third-party breach, where neither you nor the bank was at fault, and you report it to your bank within three working days of receiving the transaction alert, your liability is zero. Delays or cases involving your own negligence, such as sharing your PIN or OTP, can mean partial or full liability. The bank is expected to credit the amount of an eligible unauthorised transaction within ten working days of your report. Rules are updated from time to time, so check the current RBI guidance and your bank’s customer protection policy.
Report Suspicious Calls Even If You Lost Nothing
Many people ignore a fraud call once they have hung up. Reporting it helps block the number for others. The Department of Telecommunications runs the Chakshu facility on Sanchar Saathi for reporting suspected fraud calls, SMS and WhatsApp messages where no money was lost. Cases with actual financial loss should go to 1930 or cybercrime.gov.in instead.
Also talk to older family members. Parents and grandparents are often targeted with KYC, electricity bill and digital arrest calls. A five-minute conversation about the “PIN is only for paying” rule can save them lakhs.
Frequently Asked Questions
Do I need to enter my UPI PIN to receive money?
No. You never need your UPI PIN, or to scan a QR code, to receive money. If someone asks you to do either to get paid, it is a scam.
What is the cybercrime helpline number in India?
The national cybercrime helpline is 1930. You can also file complaints online at cybercrime.gov.in, the government’s official cybercrime reporting portal.
Can I get my money back after a UPI fraud?
Sometimes. Quick reporting through 1930 allows banks to be alerted and suspicious funds to be frozen before they are withdrawn. Recovery is not guaranteed, but the chances are much better if you report within the first hour.
Is my bank responsible for UPI fraud losses?
It depends on the case. Under RBI’s customer liability framework, you may have zero liability if the fraud resulted from a third-party breach and you reported it within three working days. If you shared your PIN or OTP, your liability may be higher. Check with your bank and the RBI guidelines.
Are UPI collect requests still allowed?
NPCI directed banks and apps to stop person-to-person collect requests from 1 October 2025. Merchants can still send collect requests, for example when you choose UPI at checkout on a shopping site. Be wary of any request you did not initiate.
How can I report a fraud call if I did not lose money?
Use the Chakshu facility on the Sanchar Saathi portal or app to report suspected fraud calls, SMS and WhatsApp messages.
Stay Alert, Not Afraid
UPI remains one of the safest and most convenient ways to pay in India. Fraudsters depend on panic, greed and urgency, not on breaking the technology. Keep your PIN private, never scan or approve anything to receive money, use only official helplines and apps, and report fraud to 1930 the moment it happens. Rules and features change, so follow updates from your bank, NPCI and RBI.
