UPI Fraud in India
UPI fraud cost Indians Rs 1,087 crore in FY24. Learn how every major UPI scam works, how to spot them instantly, and exactly what to do if you are targeted.
6/10/20269 min read
UPI Fraud in India — How It Works and How to Protect Your Money
Category: Banking and Financial Safety
Reading Time: 9 minutes
In This Article
How big the UPI fraud problem really is
The seven most common UPI fraud methods
Real word-for-word scripts scammers use
Warning signs of a UPI fraud attempt
How to protect yourself in five steps
What to do immediately if you are defrauded
How to report UPI fraud in India
Frequently asked questions
India processes over 20 billion UPI transactions every month — making it the most widely used digital payment system in the world. But this extraordinary scale comes with a serious shadow.
According to data presented in the Lok Sabha by the Finance Ministry, India recorded 13.42 lakh UPI fraud incidents worth Rs 1,087 crore in the financial year 2023–24 alone — nearly double the number of cases reported just one year earlier. In the first half of FY 2024–25, a further 6.32 lakh fraud cases were already reported, amounting to Rs 485 crore.
A survey by LocalCircles, reported by Business Standard, found that one in five UPI users in India has personally experienced fraud — and that 51 percent of those victims never filed an official complaint, meaning the true scale of the problem is likely far higher than official figures show.
The RBI's Annual Report for FY 2024–25 recorded 13,516 digital payment fraud cases accounting for 56.5 percent of all reported banking frauds, with total losses of Rs 520 crore.
UPI fraud is not a problem that only affects careless or uneducated users. It affects doctors, engineers, business owners, and senior citizens alike — because the scams are designed by professionals who understand human psychology far better than most people realise.
This guide explains exactly how UPI fraud works, how to recognise every major type of attack, and the specific steps you can take to protect your money starting today.
How UPI Fraud Actually Works — The Basics
UPI fraud works differently from most financial crimes. Criminals do not hack into the UPI system itself — the system's security infrastructure, maintained by the National Payments Corporation of India (NPCI) and regulated by the Reserve Bank of India (RBI), is robust.
Instead, fraudsters exploit the human element. They manipulate victims into authorising transactions themselves — using social engineering, fake interfaces, and psychological pressure to make people hand over their money willingly, often believing they are doing something entirely safe.
This is what makes UPI fraud so difficult to combat through technology alone — and why personal awareness is the most powerful protection available.
The Ministry of Home Affairs, through the Indian Cyber Crime Coordination Centre (I4C), has confirmed that UPI-based fraud consistently leads all categories of financial cybercrime in India both by volume and by total value of losses.
Source: https://www.pib.gov.in/PressNoteDetails.aspx?NoteId=155384&ModuleId=3®=3&lang=2
The Seven Most Common UPI Fraud Methods
1. The Fake Payment Request — Collect Request Fraud
UPI allows users to send collect requests — asking someone else to approve a payment to you. Criminals exploit this by sending a collect request to a victim, framing it as a receipt of money. The message says something like, "Accept Rs 5,000 sent to your account" — but entering your PIN does not receive money. It sends it.
This is the most common and most damaging form of UPI fraud. The RBI and NPCI have both issued specific warnings about collect request fraud, advising users to never enter their UPI PIN in response to any payment request — only when sending money themselves.
Source: https://www.pib.gov.in/PressReleaseIframePage.aspx?PRID=2110405
2. Fake QR Code Fraud
A criminal shares a QR code with the victim — often in the context of a marketplace transaction, a cashback offer, or a refund. The victim is told to scan the code to receive money. But scanning a QR code on UPI initiates a payment — it does not receive one.
The scammer may create a QR code that requests a specific amount. The victim scans it, enters their PIN believing they are receiving money, and the money leaves their account instead.
Business Standard reported that fake QR codes are among the most widely used methods in UPI fraud, particularly in peer-to-peer marketplace transactions and online resale platforms.
3. Screen Sharing App Fraud
A caller contacts the victim, often pretending to be from a bank's customer care team or a government agency. They ask the victim to install a screen-sharing application — such as a remote access tool — claiming it is needed to resolve an account issue or process a refund.
Once the screen-sharing app is active, the criminal can see everything on the victim's screen — including their UPI PIN, OTPs, and banking credentials — as they are entered. They use this access to initiate and authorise fraudulent transactions in real time.
The Ministry of Home Affairs has specifically warned citizens against installing any application suggested by someone who contacts them unsolicited, noting that remote access tools are a primary mechanism in high-value UPI fraud cases.
Source: https://www.pib.gov.in/PressNoteDetails.aspx?NoteId=155384&ModuleId=3&lang=2
4. SIM Swap Combined With UPI Fraud
A criminal first performs a SIM swap — convincing the victim's mobile network to transfer their phone number to a new SIM. With control of the victim's number, they can receive OTPs and verification codes intended for the victim and use these to access and drain UPI-linked bank accounts.
According to Business Standard reporting on MHA data, SIM swap operations are one of the four primary technical mechanisms behind high-value UPI fraud in India, alongside phishing links, counterfeit QR codes, and remote access applications.
5. Phishing Links Disguised as Bank or UPI Alerts
The victim receives a message — by SMS, WhatsApp, or email — that appears to come from their bank or a UPI platform. The message warns of an account issue and provides a link to resolve it. The link leads to a fake website that collects the victim's UPI credentials, bank account details, or OTP.
The RBI and NPCI have both run awareness campaigns specifically warning about phishing links, advising customers that no bank or payment platform will ever send a link asking for a PIN, OTP, or full card details.
Source: https://www.pib.gov.in/PressReleaseIframePage.aspx?PRID=2110405
6. Fake Customer Care Fraud
Victims searching online for customer care numbers for their bank or a payment app often find fraudulent numbers listed in paid search results or fake websites. When they call these numbers, the person who answers impersonates a bank representative and extracts account details, OTPs, or remote access to the victim's device.
The RBI has issued repeated advisories warning customers that the only legitimate contact numbers for banks and payment apps are those printed on the back of official bank cards or listed on the bank's official verified website.
Source: https://www.pib.gov.in/PressReleaseIframePage.aspx?PRID=2110405
7. Lottery, Cashback, and Job Offer Fraud
A message arrives informing the victim they have won a cashback, a lottery prize, or are eligible for a government benefit — and that it will be transferred directly to their UPI account. To receive it, they need to make a small payment first, or share their UPI details. There is no prize. The payment is the theft.
According to India Data Map analysis drawing on NCRB and NPCI data, younger users are disproportionately targeted through fake job and income opportunity scams, while rural households are more frequently targeted through phishing-led UPI drains.
Source: https://indiadatamap.com/2025/10/11/online-fraud-in-india-2025-analysis/
Real Word-for-Word Scripts Scammers Use
Reading the exact language scammers use helps you recognise fraud attempts instantly when they arrive.
The Collect Request Script
"Hello, I am sending you Rs 10,000 for the item. Please accept the payment request I have sent to your UPI ID. Just enter your PIN to confirm receipt."
Why it works: The victim believes entering their PIN confirms receipt of money. In reality, entering a PIN on a collect request authorises a payment out of their account.
The Fake Refund Script
"This is customer care. We have processed your refund of Rs 2,500. Please scan this QR code to receive the amount in your account. You do not need to enter any amount — just scan and confirm."
Why it works: The victim believes scanning a QR code receives money. Scanning and confirming sends money instead.
The Remote Access Script
"Hello, I am calling from your bank's technical team. We have detected suspicious activity on your account. To secure it, please download this application so our team can verify your account details remotely."
Why it works: It combines authority, urgency, and reassurance to convince the victim to install a tool that gives the criminal access to their screen.
The Fake Customer Care Script
"Thank you for calling. I can see your account here. To process your request, I need to send you an OTP for verification — please share it with me."
Why it works: It sounds legitimate, but sharing the OTP can authorise a transaction.
The Golden Rule of UPI — Memorise This
Your UPI PIN is only ever needed to send money. Never to receive it.
If anyone — a caller, a message, a notification, a QR code, or a collect request — asks you to enter your UPI PIN to receive money, it is fraud.
Scanning a QR code is always a payment out of your account. Accepting a collect request is always a payment out of your account. Entering your PIN is always authorising a debit from your account.
The NPCI, the RBI, and every major bank in India have repeated this rule in public awareness campaigns.
Source: https://www.pib.gov.in/PressReleaseIframePage.aspx?PRID=2110405
Warning Signs of a UPI Fraud Attempt
Someone asks you to enter your UPI PIN to receive money.
Someone sends you a collect request from an unknown UPI ID.
Someone asks you to share an OTP or PIN over the phone.
Someone asks you to install a new application to process a refund.
A QR code is shared with you as part of receiving a payment or cashback.
A customer care number found through an online search asks for sensitive information.
The caller creates urgency and pressure.
How to Protect Yourself — Five Steps
Step 1: Understand What Your UPI PIN Is For
Your UPI PIN authorises payments from your account. It is never needed to receive money or process refunds.
Step 2: Never Share Your OTP, PIN, or Bank Details With Anyone
The RBI's zero-liability policy may provide protection when fraud is reported quickly and the customer has not shared sensitive credentials.
Source: https://indiadatamap.com/2025/10/11/online-fraud-in-india-2025-analysis/
Step 3: Set a Daily UPI Transaction Limit
Set a daily limit appropriate to your needs so potential losses remain capped.
Step 4: Verify Before You Pay or Approve
Always verify the recipient name linked to the UPI ID before confirming any transaction.
Step 5: Never Install Applications Suggested Over the Phone
If someone asks you to download an app during an unsolicited call, end the conversation immediately and report it.
Source: https://www.cybercrime.gov.in
What to Do Immediately If You Are Defrauded
Call your bank's fraud helpline immediately and request account protection.
Call the National Cyber Crime Helpline at 1930.
File a complaint at cybercrime.gov.in.
File an FIR at your nearest police station.
Escalate unresolved complaints to the RBI Banking Ombudsman.
Preserve screenshots and evidence.
Sources:
How to Report UPI Fraud in India — All Official Channels
National Cyber Crime Helpline: 1930 (24×7)
National Cyber Crime Reporting Portal: https://www.cybercrime.gov.in
RBI Central Payment Fraud Information Registry: Report through your bank
Source: https://www.pib.gov.in/PressReleaseIframePage.aspx?PRID=2110405
RBI Banking Ombudsman: https://bankingombudsman.rbi.org.in
Local Police: File an FIR under applicable IT Act provisions
Sanchar Saathi Chakshu Portal: https://sancharsaathi.gov.in/sfc
Frequently Asked Questions
Can I get my money back after UPI fraud?
Possibly. Recovery depends on how quickly the fraud is reported and the circumstances of the transaction.
Is scanning a QR code safe?
Yes, when paying a verified merchant and checking the merchant name before confirming. It is not safe when someone claims scanning a QR code will send money to you.
How do I verify a UPI ID before sending money?
Check the registered recipient name displayed in your UPI application before confirming the payment.
What is the safest way to receive payment on UPI?
Share your UPI ID or QR code. You do not need to enter your PIN to receive money.
My bank says they cannot refund the fraud. What can I do?
Escalate the matter through the RBI Banking Ombudsman if you believe RBI guidelines apply to your case.
What is the Chakshu facility?
Chakshu is a service on the Sanchar Saathi portal that allows citizens to report suspected fraud calls, SMS messages, and WhatsApp messages.
Are senior citizens more at risk?
Yes. Senior citizens are frequently targeted by impersonation and coercion-based scams due to perceived unfamiliarity with digital payment systems.
Related Articles
What Is SIM Swapping and How to Protect Your Number | CyberSafe
How Malicious Apps Secretly Steal Your Data (and How to Stop Them) | CyberSafe
The Risk of Public Wi-Fi When Using Social Media | CyberSafe
The Bottom Line
UPI fraud in India is not a rare problem. With over 13 lakh reported cases in a single financial year and significant under-reporting, the true scale is likely much larger.
However, one simple rule prevents the majority of scams:
Your UPI PIN is only ever needed to send money.
If someone asks you to enter it to receive money, claim a refund, unlock an account, or verify your identity, it is a scam.
Report fraud immediately by calling 1930, filing a complaint at cybercrime.gov.in, and notifying your bank. Fast action greatly improves the chances of limiting losses and recovering funds.