UPI Fraud: 11 Ways Scammers Steal and How to Stop Each

UPI itself is rarely broken. The system run by NPCI checks the PIN, the device and the SIM every time, which is why almost every UPI fraud complaint describes the same thing: the victim pressed the button. The scammer's whole job is to make that button look like something else. Here are the 11 ways they do it, and the habit or setting that stops each one.

Keep one rule in mind throughout. Your UPI PIN is needed to send money and for nothing else. If anyone, in any story, needs you to enter it to receive money, confirm an account, claim cashback or "verify" a refund, that is the moment the money leaves.

The 11 UPI fraud tricks, and what defeats each

1. The collect request dressed up as a payment

A collect request is a legitimate feature: a merchant asks you to pay and you approve it with your PIN. Scammers send one with a note like "Refund ₹2,000" or "Cashback credited", and the victim approves it thinking they are accepting money. The app does say "Pay", but the note is what people read. Defence: never approve a request you did not initiate. Turn off collect requests in the app settings if yours allows it, and treat any incoming request as a bill.

2. "Scan this QR to receive your money"

On OLX and Facebook Marketplace, a "buyer" agrees your price and sends a QR code to "transfer the amount". Scanning a QR and entering a PIN always pays the other side. Defence: to receive money you give your UPI ID or show your own QR; you never scan theirs. Our post on the scan to receive money lie walks through the OLX version.

3. The screen sharing app

A "customer care executive" asks you to install AnyDesk, TeamViewer QuickSupport or a similar screen sharing app so they can "fix" a stuck refund. From that moment they see your OTPs and PIN as you type them, and can operate the phone. Defence: no bank, wallet or delivery company needs to see your screen. We cover the mechanics in screen-sharing app fraud.

4. The malicious APK

A WhatsApp message carries a file: "PM Kisan beneficiary list.apk", "Wedding invitation.apk", "SBI reward points.apk". Installed, it asks for SMS permission, forwards your messages to the gang, and lets them register UPI on their own handset using your number. Money then leaves while your phone looks normal. Defence: never install an APK from a chat. Keep Google Play Protect on, and check Settings for apps you do not recognise.

5. The fake payment screenshot

This one hits shopkeepers and delivery staff. The customer shows a payment-success screen, edited or from a prank app, and walks out. Defence: a payment exists only when your soundbox speaks, your own app shows it, or the bank SMS arrives. Screenshots are not money.

6. "I sent you money by mistake, please return it"

A stranger calls in a panic: they typed your number instead of their brother's and ₹5,000 went to you. Can you send it back? Often no money came at all; sometimes a collect request is sitting in your app, or a small real credit is followed by a request for a much larger "return". Defence: check your bank statement, not the app notification, and refund only through your bank's dispute process after the credit has settled.

7. The SIM swap that takes UPI with it

If a fraudster gets a duplicate SIM for your number, your UPI apps can be re-registered on their phone, because registration is tied to the SIM. The warning sign is your phone suddenly losing network for no reason. Defence: call your operator at once if the signal drops oddly, and read our SIM swap explainer for how the duplicate is obtained.

8. The AutoPay mandate that is not what it says

A UPI AutoPay mandate lets a merchant debit you on a schedule. Scammers set one up under the label of a one-time "registration" or "booking", and the debits continue monthly. Defence: read the mandate screen; it names the maximum amount and frequency. Review and cancel mandates from the app's AutoPay section every few months.

9. The "verify with ₹1" test

"Just send ₹1 to activate your refund; it comes straight back." The ₹1 is real, and you have now confirmed to the gang that your account is live and your PIN works; the next request is for the balance, or they move to trick 3. Defence: no refund, subsidy or prize in India requires a test payment, ever.

10. The lookalike UPI ID and swapped QR sticker

Merchant QR stickers get replaced overnight with one pointing to a mule account; charity drives and temple donation QRs are copied with one character changed. Defence: before you enter the PIN, read the name the app shows for the recipient. UPI shows the registered name every time; make it the habit to read it aloud.

11. Taking the phone itself

A stolen or borrowed phone with no screen lock, or a PIN written in Notes, is the oldest trick. Snatchers in Delhi and Bengaluru test the phone for a bank app before deciding whether to sell the handset or drain the accounts. Defence: a screen lock plus a separate app lock, no PIN stored anywhere, and the ability to block the SIM and the IMEI through CEIR within minutes.

Setting up UPI so a mistake costs little

Our step-by-step secure UPI setup guide shows each setting by app.

What to do in the first hour after a UPI fraud

Call 1930. Give the operator the transaction IDs, the receiving UPI ID or account, the amount and the exact time. The complaint enters the bank-freeze system so the receiving bank can hold whatever has not yet been withdrawn. Then file on cybercrime.gov.in, raise a dispute inside the payment app, and write to your bank the same day. Our reporting page has the sequence.

Why the written complaint matters. Under the RBI circular of 6 July 2017, a customer who reports an unauthorised electronic transaction within three working days has zero liability where the fraud was by a third party. Between four and seven working days liability is capped at ₹5,000 to ₹25,000 depending on the account type. (Source: RBI, circular DBR.No.Leg.BC.78/09.07.005/2017-18.) Banks argue that a PIN entered by the customer is "authorised"; you argue that deception is third-party fraud. The Ombudsman guide shows how to put that in writing, and the NPCI dispute explainer covers what the app-level dispute can and cannot do.

The scale is why the freeze step is worth the call. The national portal received more than 65.89 lakh financial-fraud complaints between 2021 and 2025, with over ₹8,189 crore placed under lien according to the Ministry of Home Affairs' July 2026 reply in the Lok Sabha. Lien-marked money is held, not returned; release needs a court order, and it only happens if the money was still there when the bank acted.

One warning for afterwards. Victims whose details circulate on scam lists get a call from a "recovery team" or "cyber lawyer" offering to retrieve the funds for an advance fee. That is a second fraud aimed at the same person. Nobody can guarantee recovery, and no genuine agency contacts you unasked. Our financial fraud response service handles the follow-ups for a fixed fee if you want help; the online financial fraud page explains the whole category.