Learn how UPI scams in India work, discover 7 dangerous UPI scams tricks, and follow practical tips to protect your UPI PIN, bank account, and hard-earned money.
Imagine you are selling an old mobile phone online. A prospective buyer contacts you, agrees to your rate and promises to pay instantly via UPI. A few seconds later they send you a QR code and ask you to scan it to get the money. Everything looks good, so you follow their instructions. But instead of being paid, you accidentally make a payment from your own bank account. This is just one of the many ways UPI scams can turn a regular digital transaction into a costly mistake.
The Government of India said that in the financial year 2025-26, UPI processed around 24,161.69 crore transactions worth ₹314 lakh crore, showing how much the digital payments have seeped into the daily lives of the people. That scale is handy, but it also offers a playground for criminals who use trust, urgency, confusion and lack of awareness.
The important thing to understand is that UPI itself is not the problem. A lot of UPI scams work because fraudsters dupe people into authorizing transactions, disclosing sensitive information, or installing malicious apps.
They might be pretending to be bank employees, online shoppers, customer support staff, delivery agents or people offering tempting rewards. Whether their stories differ, their intention is the same: to get your money or financial information.
In this guide, we will discuss seven dangerous UPI scams techniques, how these UPI scams work in day-to-day situations and what practical ways you can adopt to avoid becoming a victim. Whether you are a student, working professional, small business owner or regular digital payment user, knowing these warning signs can help you to practice better digital payment security.
Also Read:- Why Short-Form Video Marketing Is Dominating in 2026: 7 Powerful Reasons Brands Can't Ignore
7 Common UPI Scams in India
1. Fake QR Codes: Scan to Pay, Not to Collect Money
QR codes are now found in Indian shops, cafes, petrol pumps and roadside stalls. They offer a quick and easy way to pay, but they can be exploited by fraudsters who persuade people to scan a code by deception. These QR code scams are one of the important UPI scams to know because the fraud often starts with a simple misunderstanding.
Let’s say you list a product for sale on an online marketplace. A buyer emails you and says that they want to pay upfront right away. Instead of asking for your UPI ID, they send you a QR code and ask you to scan it to receive the money. They may even say the code is linked to a secure payment gateway. “By scanning the code, opening your payment app and entering your UPI PIN, you may end up authorizing a payment to the fraudster, instead of getting money.
The main trick is simple: a QR code does not necessarily mean you are getting money. Before paying, scan the payment QR code and verify the name and transaction details of the Payee shown in your app. If the transaction involves a payment, you will be asked to enter your UPI PIN to authorize the payment. You don’t need to enter your UPI PIN to just receive money in your account. The National Payments Corporation of India (NPCI) specifically warns users against fake cashback links and QR codes asking them to enter UPI PIN for claiming a reward.
How to stay safe: Don’t scan a strange QR code because someone promises to send you money. Before you approve a transaction, check the amount and beneficiary. A real buyer will pay you through your UPI ID or other real payment methods and will not ask you to authorize a payment in his favor.
2. Collect Request UPI Scams: The Fake Request for Money
One of the most deceptive UPI scams is the collect request which can make a payment request look like a normal notification. The scammer may tell you the money is ready to credit to your account but you have to approve a request first. In fact they may be asking you to send them money.
Imagine you have a second-hand laptop for sale. The buyer says that they have sent ₹5,000 as an advance and wants you to approve a notification so that you can complete the transaction. You receive a request on your UPI app, but instead of checking the details, you think it is a request for an incoming payment. If you accept the request and enter your PIN you may end up paying the buyer.
Such collect request UPI scams are often successful because users associate payment notifications with money going into their accounts. Fraudsters will try to make the confusion sound more convincing by using phrases like “Accept payment,” “Confirm receipt,” or “Release your funds.” So the best thing is to check the transaction details themselves, and not trust the caller. The wording may vary between apps and situations.
It’s not only online retailers that are at risk. Scammers may pose as friends, customers, service providers or business contacts and send a request for money with a fictitious reason. They may also try to create a sense of urgency by saying that the request will expire in a few minutes. UPI scams can be minimized.
Remember, you verify incoming payment through your transaction history or account balance and not on someone else’s instructions. If you get a collect request you haven't been expecting, see if it's asking you to pay or authorize a debit. If you don't know what it's for or who it's for, toss it.
How to stay safe: Don’t share your UPI PIN on the basis of a request for approval from the caller. A valid transaction should be something that makes sense to you and you should be able to independently verify why you are being asked to authorize it.
3. Fake Payment Screenshots: The Imaginary Cash
A screenshot saying “Payment Successful” can be quite convincing especially when you are busy serving customers or juggling a few transactions at the same time. They take advantage of this trust and send edited screenshots, or they use fake pages of payment confirmations, or show you an old transaction that is not related to the purchase you are making now. This is another common pattern linked to UPI scams.
Suppose a shopkeeper sells goods worth ₹1,200. A customer scans the shop's QR code then shows a screenshot that appears to be proof of payment. The shopkeeper is busy, sees the green success symbol and hands over the goods. Later while checking the bank account the shopkeeper finds that no money was received.
In some cases, the fraudster may use image editing tools to create a fake screenshot of UPI payment. In others, they show a payment that is still pending or failed hoping that the seller will not check it carefully. The same technique can affect people selling furniture, mobile phones, clothes, electronics or other items through social media and online marketplaces.
The problem is not that screenshots are always fake. The problem is that a screenshot is not independent proof that money has reached your account. Someone can show a picture on their phone without making a purchase. That’s why sellers have to check the credit through their own payment app, bank notification or account statement.
These fake UPI payment screenshot tricks work best if a scammer hurries the seller, distracts him with conversation, or says the bank notification is delayed. They may also request the seller to trust them as they have already presented proof of payment.
How to keep safe: See the credit in your own account before you hand over goods or complete a service. If it is pending, wait until it is clear. A buyer’s screenshot, verbal assurance or sense of urgency should not substitute your own verification.
4. Fake Cashback and Rewards UPI Scams: When Free Money Gets Expensive
Who doesn’t want cashback, shopping rewards or a surprise payment? Fraudsters know this very well and this is why they use attractive offers to trap people in UPI scams. A message might contain ₹500 cashback, a festival reward, a lucky draw prize or a refund from a popular payment service. It could be via SMS, WhatsApp, social media or an unfamiliar website.
The message will usually ask you to click on a link, scan a QR code or type in confidential details to claim the reward. Scammers will sometimes copy the branding of banks and payment apps to make it look real. Some might call and say there is a cashback amount waiting but it has to be approved right now.
Once you have followed their instructions, the fraudster may trick you into authorizing a payment, sharing an OTP or visiting a phishing page designed to capture your personal information. In some cases they may ask you to pay a little “processing fee” to receive the reward. The victim loses money or gives away sensitive information, and the promised cashback never materializes.
These fake cashback UPI scams are not limited to a single payment application. The fraudsters can clone any known brand or put together a believable looking campaign. They might also exploit festivals, shopping events or public benefit schemes when people are more likely to expect special offers. A good rule of thumb is to be skeptical of unexpected rewards, particularly if they ask for confidential information or payment approval. Open the official app yourself, don’t follow the link sent to you by an unknown person, to check whether the offer exists.
How to stay safe: Never share your UPI PIN or OTP to claim cashback. Also, never pay a fee to get a reward you have not verified yourself. If anything sounds too good to be true and needs immediate attention, take a minute to look it up on the company’s official site.
5. Fake Customer Care UPI Scams: The Helpful Voice on the Phone
When a payment fails or money disappears, most people need help fast. Fraudsters exploit this anxiety by posing as customer support agents from banks, payment applications, online shopping platforms, or utility companies. These fake customer care UPI scams can lead to serious online payment fraud as victims may willingly abide by the instructions of the caller. Like when you Google the customer care number of a payment app because of some problem in a transaction.
You get an unlisted number, you call it, and you talk to someone who sounds like they know what they're doing. The person asks for your UPI ID, bank details or an OTP stating that this is required to process your refund. Then they may ask you to download a screen sharing app or authorize a transaction to “verify” your account.
The caller will have a few details about your issue, and the conversation will sound real. But fraudsters can collect information from public posts, fake websites, leaked data or the info you give during the call. They want you to trust them and therefore hand over control of your device or account.
The NPCI warned that the complaints posted on social media and search engines may be misused by scammers and downloading of unknown applications can put the users to fraud.
No genuine support interaction will ask you to share your UPI PIN. If you need assistance please use the help section within the official payment application, the verified website of your bank or contact details printed on official bank materials. Never take the first number that shows up in a search result – particularly if the site looks odd or has strangely worded content.
How to stay safe: Never reveal your UPI PIN or OTP to any caller and do not download any app on the prompting of a stranger. If someone claims to be from your bank, hang up and dial the bank back on a verified number.
6. Remote Access App UPI Scams: Giving Thieves a Window Into Your Phone
Some UPI scams do not just depend on misleading messages, but try to get inside the victim's device. Remote access app UPI scams are a type of fraud where a scammer convinces someone to install an app that lets them share their screen, provide remote assistance, or control their device. They might say the app is needed to fix a payment problem, do KYC verification, facilitate a refund or correct a technical error.
Once the victim installs the application and grants the requested permissions, the scammer may be able to see sensitive information on the screen or guide the victim into performing actions that benefit the criminal. Depending on the app and permissions, the fraudster may observe notifications, manipulate the victim's actions, or attempt to obtain credentials. The exact level of access varies by application, device, and permission settings.
Imagine receiving a call from someone claiming that your electricity bill payment failed and your connection will be disconnected unless you act immediately. The caller offers to help and asks you to install a remote support application. While you focus on resolving the bill issue, the person may direct you to open your payment app, approve a request, or disclose an OTP.
This is a classic example of how UPI scams combine technology with social engineering. The application is only one part of the trick for UPI scams; the real danger lies in trusting an unknown person and following instructions without understanding what they do.
How to stay safe: Do not install remote access or screen-sharing applications at the request of an unknown caller. Review app permissions, remove suspicious applications, and contact your bank immediately if you believe someone has gained access to your device. If you have already installed an application and suspect fraud, disconnect from the interaction and use a trusted device to contact your bank and secure your accounts.
7. Phishing Links and Fake KYC Updates: The Message That Looks Official
“Your bank account will be blocked today.” “Complete your KYC immediately.” “Your UPI service has been suspended.” These alarming messages are designed to make you act before you have time to think. Phishing is a technique in which criminals impersonate a trusted organization to steal information, redirect payments, or persuade victims to install harmful software.
A fraudulent message may contain a link to a website that resembles your bank's login page or a payment application's support portal. Once you enter your credentials, the information can be captured by the criminal. Other messages may ask you to update KYC details, confirm your identity, or claim a refund by sharing an OTP.
These phishing UPI scams are often personalized. A fraudster may use your name, mention a bank you use, or refer to a recent transaction to make the message feel authentic.
The message may even include a logo and formal language, but these details are easy to imitate. The safest approach is to avoid clicking links in unexpected messages, especially those that threaten immediate account suspension or promise an urgent refund.
Instead, open the official app directly or type the organization's known website address into your browser. If the message claims to be from your bank, confirm it through an official channel. Your UPI PIN is used for authorizing a transaction and not for establishing your identity to a caller or to claim a benefit. A proper KYC process should be done through validated channels and you should never share your PIN or OTP with a person calling you unexpectedly.
How to stay safe: Check the sender, check links carefully, never enter banking credentials on a website reached through a suspicious message. If you have already given out sensitive information, call your bank right away and report the incident.
How to Prevent UPI Scams? Develop These 7 Digital Payment Habits
Understanding how UPI scams work is important, but turning that knowledge into everyday habits is what really protects your money. You don’t need to be a cybersecurity expert to make payments safer; you just need to know what you’re approving, check the person or business involved, and avoid sharing information that gives others access to your account.
10 Practical Ways to Strengthen Your UPI Scams Prevention Habits
Don’t share your UPI PIN or OTP. Do not share your PIN with anyone, even if they say they are from your bank, payment app or customer support.
Remember, just because you accept money doesn’t mean you have to authorize a payment. If someone tells you to put your PIN in to get a refund, cashback or payment stop and check the transaction.
Check recipient name and amount. Before you approve a transaction, make sure the details in your app match the person or business you want to pay.
Never trust a screenshot by itself. Make sure that the money has actually hit your own account before you deliver the products or complete the sale.
Use the official customer support channels. Don't trust phone numbers given by strangers or unverified search listings. Instead, open the payment app yourself or go to your bank's verified website.
Do not click on unknown links or download applications you are unsure of. Unsafe apps may request permissions that can compromise your personal information and suspicious links can direct you to phishing pages.
Turn on transaction notifications. Bank SMS alerts and app notifications can help you catch any unexpected debits and take quick action.
What Should You Do If You Become a Victim of UPI Scams?
Even the careful can be fooled by a convincing message or a stressful phone call. If you are the victim of UPI scams and have lost your money, do not waste time arguing with the fraudster or negotiating for a refund.
Step 1: Call cybercrime helpline immediately
Call 1930, India’s national cybercrime helpline to report financial cyber fraud at the earliest. You can also file a complaint on the official National Cyber Crime Reporting Portal at cybercrime.gov.in. Provide accurate details about the transaction, including the approximate time, amount, transaction reference, and relevant account or payment information. Follow the instructions given by the helpline and complete any required online complaint formalities.
Step 2: Inform your bank and payment app
Report the incident to your bank through its official fraud-reporting channel and raise a complaint in the payment app where appropriate. Ask the bank to record the complaint, investigate the transaction, and advise you on steps to secure your account or prevent further unauthorized activity. Keep your complaint or reference number for future communication. Prompt reporting may help the relevant institutions take action, although recovery of the money is not guaranteed.
Step 3: Secure your accounts and device
If you disclosed credentials, installed a suspicious app, or allowed someone to access your screen, take steps to secure your accounts from a trusted device. Contact your bank for guidance, revoke suspicious app permissions, uninstall unsafe applications, and change any affected passwords or credentials as appropriate. Never share another OTP or PIN with someone who claims they can recover your lost money.
Step 4: Preserve evidence
Save transaction IDs, bank alerts, phone numbers, messages, screenshots, emails, and relevant URLs. Do not delete the conversation before preserving useful evidence, and avoid confronting the suspected fraudster if doing so could put you at further risk.
The Reserve Bank of India's guidance on unauthorized electronic transactions highlights the importance of reporting promptly. Customer liability depends on the circumstances, including whether the transaction involved customer negligence and how quickly the bank was notified; therefore, do not assume that every disputed payment will automatically be refunded.
When responding to UPI scams, speed matters. Report the incident, follow your bank's instructions, and use official reporting channels rather than relying on promises from strangers.
How The Drop Organization (TDO) Can Help Build Cybersecurity Awareness?
Many UPI scams succeed not because the technology is impossible to secure, but because criminals exploit predictable human behavior. A person may know that they should never share their PIN, yet still reveal it when a caller sounds authoritative or claims that an urgent payment problem must be resolved immediately. This is why cybersecurity awareness should focus on practical decision-making as well as technical knowledge.
The Drop Organization (TDO), which provides cybersecurity and ethical hacking training, encourages learners to understand how cyber threats operate and how responsible digital behavior can reduce risk. Through learning opportunities such as The Hack Track (THT) and the Drop Certified Security Course (DCSC), learners can explore cybersecurity concepts and develop a stronger understanding of online threats and security practices.
For students and beginners, learning about phishing, social engineering, suspicious links, and digital payment security can be a useful starting point. The same awareness that helps identify a fake login page or a suspicious phone call can also help someone recognize UPI scams before authorizing a transaction.
Cybersecurity education isn’t just about how attackers think, but also how to respond safely. If you are a professional in security or just a UPI user making your daily payments, being informed will help you to make better decisions on the internet.
Final Thoughts: Beware Before You Hit “Pay”
UPI has made digital payments faster, easier and more accessible in India, from local markets to online businesses. But along with the growth of digital payments, users also need to be aware of the risks of UPI scams and other UPI scams. A QR code, payment notification, phone call or cashback offer may look innocent but you should know exactly what you are being asked to do before you do anything.
These are seven dangerous tricks for UPI scams that have one common denominator – they all depend on fooling someone into trusting something that requires a closer look. The tricks are: fake QR codes, collect requests, fake payment screenshots, cashback offers, fake customer care calls, remote access applications, and phishing links. The best defense is to slow down, check the details of any transaction and keep your credentials private and use official support channels. Make UPI scams prevention a daily habit.
Always check for incoming payments in your own account. Never share your UPI PIN or OTP. Report suspected UPI scams immediately. If something about a deal seems off, or you feel pressured, take a moment to confirm the facts. Remember, awareness is one of the strongest defenses against UPI scams. A few seconds of careful verification can help keep your hard-earned money safe and your digital payment experience safer.
DISCUSSION
Comments