UPI Scams in India: Common Tricks and How to Avoid Them
10 min read Scammers rarely hack UPI. They trick people into approving payments themselves. Learn the common tricks and the simple rules that stop them. October 08, 2026 08:10 By Disha Varia, Guj Times
UPI itself is well protected. Most losses happen because a person is persuaded to do something, such as approving a request or sharing a code. The tricks below keep appearing in different forms, so learning the pattern is more useful than memorising each story.
1. "Scan this QR code to receive money"
A buyer on an online classifieds site says they will pay you and sends a QR code to "receive" the amount. Scanning a QR code is for paying. Money is never received by scanning or by entering a PIN.
2. Collect request disguised as a refund
You receive a request that looks like a refund notification, but approving it takes money out of your account. Read each request carefully, and decline those you do not expect.
3. Fake customer care numbers
People search for a company's helpline and call a number that a scammer has put in search results. Get support numbers from the official app or website only.
4. Screen-sharing apps
A caller asks you to install an app so that they can "fix" a failed payment. Those apps let them see your screen, including OTPs. Never install one at the request of a stranger.
5. APK files and fake bank messages
Messages that say your account will be blocked unless you install a file or click a link are scams. Read how to recognise them in our guide on fake apps.
6. Wrong payment, "please return it"
A stranger claims they sent you money by mistake and asks you to send it back. Check your bank statement first; if the money is not there, do not pay. If it is, ask your bank to handle the return.
Simple rules that stop most scams
- PIN only to send money, never to receive.
- Never share OTPs, PINs or card details.
- Do not act under pressure. Scammers create urgency on purpose.
- Verify the name on the payment screen.
If you have been cheated
Act quickly. Inform your bank at once, call the national cyber fraud helpline 1930 and file a complaint at cybercrime.gov.in. The earlier you report, the better the chance of limiting the loss.
New to UPI? Start with how UPI works.
Short answers
I tapped a suspicious link but entered nothing. Am I safe? Probably, but close the page, do not install anything it offers, and run a Play Protect scan. If you did enter details, change the passwords and call your bank.
Can the bank reverse a payment that I approved? Not automatically. Report quickly to your bank and to 1930, because in some cases funds can be held if the report is early.
The quick test: who is asking for what?
Before you act on any payment screen, ask: am I sending money or receiving money? If you are receiving money, you will never be asked for a PIN. If someone is asking you to send money to get something back, it is almost always a scam.
Teach one rule to the elders at home
Many victims are parents and grandparents who trust a confident voice on the phone. Teach them one rule: never enter a PIN, share a code or install an app because someone phoned you. If they are unsure, they should hang up and call you or the bank on its official number.
Report quickly
If you lose money, call the national cyber crime helpline 1930 as soon as possible and report on cybercrime.gov.in. Also tell your bank. Early reporting can improve the chance that the money can be held, though nobody can promise recovery. Keep screenshots, phone numbers and the transaction ID.
Four situations, and what to do in each
Example 1: the "wrong transfer" call. Your phone shows a credit of a few thousand rupees and, a minute later, a stranger phones to say he sent it by mistake and asks you to return it. The safest way is not to send anything back yourself. Tell him to contact his own bank and raise a complaint, and let your bank handle any reversal. Sometimes the first credit is part of a trick, and returning money to a different account than the one it came from can make you the next victim.
Example 2: the buyer on a marketplace. You list an old phone for sale and a "buyer" says he will pay by sending a QR code or a payment request. A QR code or request only ever takes money out of your account. If the buyer is genuine, he will pay you by scanning your QR or by entering your UPI ID himself. Never scan a code or approve a request to receive money.
Example 3: the electricity-bill message. An SMS says your power will be cut tonight unless you call a number. Real electricity boards do not ask you to phone a private mobile number or install an app. Pay bills through the official website or the app your provider has published, and ignore the number in the message.
Example 4: the fake payment screenshot. Small shopkeepers are sometimes shown an edited screenshot as proof of payment. Do not release goods on a screenshot alone. Check the credit in your own payment app, SMS from the bank, or the sound-box notification from the provider, and look at the amount and time.
Why people fall for these tricks
Scammers use three levers: urgency ("do it now"), authority ("I am from the bank") and reward ("you have won a refund"). Each one is designed to stop you from thinking. A simple habit that breaks the spell is to say "I will call you back" and end the call. Then call the number printed on your card or on the official website, never the number the caller gave you.
Protect the account you use every day
Consider keeping only a modest balance in the bank account linked to your daily UPI app and holding savings in another account. Even if something goes wrong, the loss is limited. Turn on SMS and app alerts for every debit. If your bank lets you set a lower daily transaction limit, set one that matches your normal use.
What to do in the first hour after a fraud
- Call the national cyber crime helpline 1930 at once and note the complaint number.
- Phone your bank on its official number and ask them to block further debits and register a dispute.
- Report on the cybercrime.gov.in portal and keep screenshots of the chat, the number, the UPI ID and the transaction ID.
- Change your UPI PIN and the password of your banking app, and remove any screen-sharing app that you were asked to install.
Speed matters because a quick report can help the bank to trace the money, though nobody can promise that it will be recovered. Do not pay anyone who offers to "recover" your money for a fee.
If an older relative is the target
Sit with them once and show these four situations on their own phone. Agree on one family rule: before any payment to a stranger, they phone you first. Written down and stuck on the fridge, this one rule has prevented many losses.
Official sources and further reading
- NPCI: The organisation that runs UPI.
- National Cyber Crime Reporting Portal: Report UPI fraud. The helpline number is 1930.
User Comments (0)
Apps to explore
