UPI has changed how India pays. A vegetable vendor, a rickshaw driver, a small shop — almost everyone takes a QR code payment now, and most of us barely carry cash. That convenience comes with a risk that grows every year: UPI fraud.
The numbers tell the story. UPI fraud cases in India have risen sharply as usage has grown, and the losses run into hundreds of crores each year. What makes these scams so effective is that they rarely involve breaking into your phone. They involve talking you into sending the money yourself — or into handing over the one thing that lets a stranger move it.
The good news is that almost every UPI scam follows a pattern, and once you know the pattern, it is easy to stop. This article explains how the common scams work, what to do the moment you suspect one, and the simple habits that keep your money safe.
How UPI actually works — and why that matters
To spot a scam, it helps to know one basic fact about UPI: you never need to enter your PIN to receive money. Never.
Your UPI PIN is only for sending money or approving a payment. If someone says you must enter your PIN, approve a request, or share an OTP to receive a payment, a refund, or a cashback, they are lying. That is the single most important rule in this whole article, and it stops most UPI fraud on its own.
A genuine payment request from someone who owes you money looks different from a scam request, but at a glance they can look alike. A collect request asks you to approve a payment from your account. Fraudsters send collect requests dressed up as refunds or payments, hoping you will approve without reading. Always read the amount and the direction of the money before you approve anything. If a request asks you to pay when you were expecting to receive, stop.
The most common UPI scams in India
The first scam to know is the fake payment request. You list a sofa or a phone for sale on an online marketplace. A buyer contacts you quickly, agrees to your price without bargaining, and says they will pay by UPI. Instead of sending money, they send you a collect request, sometimes labelled as a refund or a security deposit. If you enter your PIN, the money leaves your account. A real buyer sends money; they never ask you to approve a payment to receive one.
The second is the fake customer care scam. You search online for the customer care number of a bank, a wallet, or a delivery company, and call a number that turns out to belong to a fraudster. Or you receive a call claiming your bank account will be blocked, your KYC is incomplete, or a suspicious transaction needs verification. The caller sounds professional, may know your name and your bank, and asks you to install a screen-sharing app or share an OTP. Banks never ask for your OTP, PIN, or CVV on a call. No genuine KYC update happens over the phone with a stranger.
The third is the QR code trick. A fraudster sends you a QR code and says scanning it will credit money to your account. In reality, scanning a UPI QR code and entering your PIN sends money to the other person. QR codes are for paying, not for receiving. Never scan a code someone sends you with a promise of money coming in.
The fourth is the phishing link. You get an SMS or a WhatsApp message saying your electricity bill is unpaid, your parcel is stuck, or you have won a reward, with a link to fix it. The link opens a page that looks like your bank or a government site and asks for your UPI PIN or card details. Real banks and government departments do not send payment links over SMS and WhatsApp. If a message creates urgency — pay in two hours or your connection is cut — that urgency is the scam.
The fifth is the fake UPI handle and the lookalike app. Fraudsters create UPI IDs that resemble a genuine business, or circulate modified versions of payment apps. Double-check the name that appears before you pay a new person. If you meant to pay “Sharma General Store” and the name shows something slightly different, stop and verify.
Red flags that should make you pause
Most scams share the same warning signs. Learn them, and trust your unease.
Urgency is the biggest one. “Your account will be blocked in 30 minutes.” “Pay now or the order is cancelled.” “This offer expires in ten minutes.” Genuine banks and businesses do not run on that kind of clock. Urgency is designed to stop you thinking.
Secrecy is another. “Do not tell anyone, this is a confidential verification.” A real bank process does not need secrecy. If someone asks you to keep a transaction hidden from your family or the bank, they are protecting themselves, not you.
Requests for your PIN, OTP, or CVV are an absolute stop sign. Your bank, the police, and no government officer will ever ask for these. Anyone who does is a fraudster, whatever their story.
Too-good offers are a flag as well. Double your money, a free phone for a small processing fee, cashback ten times the payment. These are bait, and the fee or the PIN you enter is the catch.
Finally, watch for payment requests that arrive out of nowhere, especially from strangers, and for links that arrive by SMS or WhatsApp from unknown numbers. A little suspicion here costs nothing. The lack of it can cost a lot.
What to do if you have already been scammed
If money has left your account, act fast. Speed matters, because banks and the police can sometimes freeze the fraudster’s account before the money moves on.
First, report it to your bank immediately, through the app, the helpline, or a branch. Tell them the transaction details and ask them to flag the fraud.
Second, call the national cybercrime helpline, 1930, or report on the National Cybercrime Reporting Portal at cybercrime.gov.in. This is the official channel, and a complaint here is what triggers the process of tracing and freezing the money.
Third, report the fraud inside your UPI app as well. Google Pay, PhonePe, Paytm and BHIM all have a way to report a transaction. It helps the platform flag the fraudster’s account.
Fourth, if you shared your PIN or OTP, change your UPI PIN at once and check your bank statements for other transactions you did not make. If a screen-sharing app was installed, uninstall it and run a security scan.
Do not let embarrassment stop you from reporting. Fraudsters rely on people feeling too foolish to complain. Reporting quickly is the single best thing you can do after a loss, and it protects the next person too.
Simple habits that keep your UPI safe
Safety is mostly a set of small habits, and none of them takes more than a minute.
Set a strong UPI PIN that is not your birth year or 1234, and never share it with anyone, including family members who offer to make a payment for you. If someone else knows your PIN, change it.
Turn on transaction alerts for your bank account and your UPI app, and actually read them. A small debit you do not recognise is often a test by a fraudster before a bigger one. Report it at once.
Keep your daily UPI limit in mind. Most apps let you set or lower your per-day limit. A lower limit caps the damage if something ever goes wrong.
Lock your phone with a PIN or fingerprint, and keep your UPI app updated. Updates often contain security fixes, and an outdated app is an easier target.
Be careful on public Wi-Fi. Avoid making payments on open networks in malls or stations if you can help it, and never install apps from links sent by strangers. Download payment apps only from the official Play Store or App Store.
Finally, keep a small emergency fund separate from your everyday spending account, so that even a bad day does not leave you with nothing. Our guide on building an emergency fund in India explains how much to keep and where to park it.
UPI settings worth checking today
A few minutes in your UPI app’s settings can make a real difference.
First, check your transaction limits. Most apps show your daily limit and let you lower it. If you rarely pay more than ₹10,000 a day by UPI, a limit of ₹20,000 is plenty, and it caps the damage if your phone is ever misused.
Second, review your linked bank accounts. Many people have old accounts linked that they no longer use. Remove any account you do not need on UPI, so there is less to protect.
Third, check your autopay mandates. Subscriptions for streaming, cloud storage, or SIPs can be set to auto-debit through UPI. Review the list once in a while and cancel the ones you no longer use. A forgotten mandate is a small leak that adds up over a year.
Fourth, make sure your UPI app itself is locked behind your phone’s fingerprint or face unlock, not just a swipe. If your phone is lost or stolen, that lock is the first line of defence before anyone can open the app.
Finally, note your bank’s real helpline number and the cybercrime helpline 1930 in your phone. In a panic, people search online and land on fake numbers. Having the right number saved removes that risk entirely.
Helping parents and older family members stay safe
Fraudsters often target older people, because they may be newer to smartphones and more trusting of a caller who sounds official. A short conversation with your parents or grandparents can prevent a large loss.
Explain the one rule in simple words: never enter a PIN to receive money, and never share an OTP with anyone on the phone. Show them what a collect request looks like, and tell them to call you before approving any payment they were not expecting.
If they use a smartphone, help them set a strong lock, turn on transaction alerts, and save the bank’s real helpline number in their contacts, so they never need to search for it online. And agree on a family rule: any call about money, from any number, gets checked with a family member first. No exceptions, no rush.
The bottom line
UPI is safe when you use it with your eyes open. The system itself has strong protections — the PIN, the daily limits, the alerts. The weak point is almost always a person being rushed, tricked, or frightened into overriding those protections.
Remember the core rules: never enter a PIN to receive money, never share an OTP or PIN with anyone, never approve a request without reading it, and never trust urgency from a stranger. Keep your alerts on, your PIN private, and your app updated, and most scams will fail at the first step.
And if something does go wrong, report it fast — to your bank, to 1930, and to the cybercrime portal. Quick reporting is how money gets frozen and fraudsters get caught, and it is the best help you can give yourself and everyone else using UPI.