India is slowly moving toward a cashless economy where transactions take place digitally through UPI (Unified Payments Interface). While UPI is extremely helpful for making quick and easy transactions, it also comes with its own risks. The number of cyber fraud cases rose by 85% from FY23 to FY24, with 13.42 lakh users subjected to fraud and losses amounting to approximately ₹1,087 crore. What makes the situation even more alarming is that 51% of victims never reported the fraud, highlighting a serious issue that could pose a major threat to the digital ecosystem, especially as over 350 million users in India use UPI, according to a 2024 report.
While these scam cases are surprisingly high, in many instances, users’ own negligence and lack of awareness lead them into traps. UPI itself is a highly secure system that ensures safe transactions. However, fraudsters use social engineering techniques to trick people into scams—urgency, fear, rewards, and authority become their primary tools. They often impersonate customer care representatives from banks or officials from government agencies such as the CBI or ED to appear legitimate and lure victims into clicking suspicious links, sharing OTPs, or scanning QR codes. We will delve deeper into these different techniques to help you recognise such scams and explain the immediate actions you should take to prevent losses.
Why is UPI being targeted?
The UPI system has over 350 million users in India who process almost 20 billion transactions every month, making it an attractive platform for cybercriminals to exploit users online. People who have only recently started using UPI are often unaware of the guidelines and lack knowledge about safe usage practices. This allows scammers to take advantage of their situation by tricking them into fraud.
The “Request Money” trap (collect request scam)
In this scam, the fraudster sends a request to your UPI app and tells you to accept the request and enter your PIN to receive money. However, once you do that, money gets debited from your account instead of being credited. This often happens when scammers pose as legitimate individuals offering refunds or rewards or impersonate buyers who claim to be sending payment for a listed product. Many people are unaware that during a UPI transaction, you only need to enter your PIN when you are sending money, not receiving it.
QR code scam — scanning doesn’t mean receiving money
One of the most peculiar scams involves fraudsters sending QR codes and claiming that scanning them will help you receive money, whereas QR codes are actually used for making payments to others. There have also been cases where a merchant’s QR code at a shop is secretly replaced with another QR code. As a result, when customers make payments by scanning the code, the money gets transferred to the fraudster’s account instead of the shop owner’s. Therefore, before sending money, always confirm the name displayed on the UPI app with the shop owner.
Screen-sharing scam (AnyDesk / TeamViewer fraud)
Sometimes scammers impersonate bank officials or representatives from government agencies and claim that your KYC is expiring, there has been a suspicious transaction, or there is a technical issue with your account. To resolve the issue, they ask you to install screen-sharing applications such as AnyDesk or TeamViewer. Once they gain access to your device, they can monitor everything on your screen, including your PINs and OTPs, enabling them to transfer money from your account. Keep in mind that no bank or legitimate authority will ever ask you to install an app or share access to your screen.
Fake customer care scam (Google search trap)
While searching online for the customer care number of a bank or UPI app, many people end up calling numbers that appear at the top of search engine results. The person on the other side often sounds professional and trustworthy and tricks victims into sharing personal details and OTPs, leading to fraud and unauthorised money transfers. This happens because people assume the number found online is genuine. To avoid this scam, always look for customer care numbers on the bank’s official website or app. You can also find the official number on the card provided by your bank.
SIM swap fraud
This is one of the most dangerous forms of fraud because scammers exploit personal information to gain control of a victim’s SIM card. They collect details such as Aadhaar number, date of birth, and phone number through various online sources and use them to request a SIM swap. After some time, the victim’s phone loses network connectivity because the mobile connection has been transferred to another SIM card controlled by the fraudster. The scammer then uses this access to change account credentials and transfer money to different accounts. If this happens, your first step should be to immediately contact your telecom provider and inform them about the issue, which can help minimise the damage.
What to Do If You’ve Been Scammed on UPI
If you realise you’ve been scammed, the next 30 minutes are crucial in determining whether you can recover your money. Here’s what you should do, in order:
Call 1930 immediately. This is the Government of India’s National Cybercrime Financial Fraud Helpline—toll-free and available 24/7. It is directly connected to banks in real time and can help freeze the fraudster’s account before the money is moved further. Do not wait to confirm anything. Call immediately.
Next, report the fraudulent transaction within your UPI app. Go to the transaction details and raise a dispute. Save the complaint ID you receive.
Then contact your bank’s helpline and ask them to flag the transaction as fraudulent in writing. Make sure to obtain a reference number.
Finally, file a complaint on cybercrime.gov.in. Upload your transaction ID, screenshots, and any messages exchanged with the scammer. Save the acknowledgement number for future reference.
Under RBI guidelines, if you report the fraud within three working days and the fraud did not occur due to your own negligence, the bank is legally required to refund the full amount. After seven days, recovery depends entirely on the bank’s discretion. In such situations, speed is everything.
