UPI Fraud in India: 25+ Scams, Prevention Tips & How to Recover Your Money

Fraudsters use cloned smartphone applications (such as "Paytm Spoof", "FakePay", or custom web-based screenshot generators) that generate a pixel-perfect imitation of a successful payment completion screen in Google Pay, PhonePe, or Paytm without initiating any actual bank transaction.

1. The scammer stands at a merchant checkout counter or buys high-value electronics from an individual seller.
2. They ask for the seller's phone number or scan the QR code to note down the merchant's exact registered business name and VPA.
3. Opening a spoofing application on their phone, they enter the merchant's name, the exact invoice amount, and press "Generate".
4. The spoof app renders a counterfeit green checkmark screen complete with fake time, animation, sound effects, and a fictitious 12-digit transaction ID.
5. The fraudster flashes the screen in front of the busy cashier, claims to be in an extreme rush, and walks out with goods before ledger credit.

• ✕The customer insists on flashing their phone screen quickly and refuses to wait 30 seconds for your SMS or soundbox announcement.
• ✕The customer becomes aggressive or claims "network is slow on your side, see my screen has deducted it".
• ✕Slight typographic discrepancies: mismatched font weights, incorrect battery/status bar icons on the screenshot, or lack of interactive scroll.

• ✓Never look at the buyer's screen as proof of payment. Treat customer screens as completely untrusted input.
• ✓Listen for the automated audio announcement from your IoT Soundbox (Paytm, PhonePe, Google Pay soundbox).
• ✓Open your own merchant dashboard app (PhonePe Business, Paytm for Business, Google Pay for Business) and refresh the live transaction feed.

• •Train all cashiers and counter staff: "No soundbox voice announcement or merchant app notification = No goods handed over."
• •Place a clearly visible sign at checkout: "Goods will only be released after payment reflects in our merchant terminal."

• ➜Retain store CCTV footage showing the suspect's face, vehicle number, and timestamp.
• ➜Record the exact phone number or VPA shown on the spoof screen.
• ➜File an immediate complaint on cybercrime.gov.in and report retail theft at the local police station with CCTV evidence.

Scammers forge incoming SMS text messages using bulk web SMS gateways or personal SIM cards, drafting messages that mimic official bank alerts (e.g., "Your a/c no. XX1234 has been credited by INR 15,000 via UPI/Ref 4310...").

1. The fraudster identifies the victim's registered mobile number from an advertisement or invoice.
2. Using an unauthorized bulk SMS service or virtual phone number, they transmit a custom SMS formatted like a genuine commercial banking alert.
3. In other cases, the fraudster sends an ordinary SMS from a 10-digit personal mobile number (e.g., +91 98765 XXXXX) with text like "Rs. 20,000 credited to your SBI a/c".
4. The victim checks their notification shade, sees the message, and mistakenly assumes their bank account balance has increased.

• ✕SMS arrives from a 10-digit personal mobile number rather than an official bank alphanumeric sender ID (header).
• ✕The SMS does not increment your actual available balance when checked inside your authentic mobile banking app.
• ✕Spelling mistakes, odd punctuation, or generic phrases not used by your specific bank.

• ✓Open your official bank mobile application (e.g. YONO SBI, HDFC MobileBanking, iMobile) and check your actual account balance and mini-statement.
• ✓Never rely on push notifications or SMS alone for high-value sales.

• •Never dispatch products, transfer goods, or issue refunds based solely on incoming SMS text.
• •Enable Push Notifications inside your bank app, which are cryptographically delivered and cannot be spoofed by external SMS tools.

• ➜Immediately contact the shipping or logistics company to recall or halt in-transit delivery of the item.
• ➜Report the mobile number and forged SMS to the National Cyber Crime Reporting Portal (cybercrime.gov.in) and Chakshu portal (sancharsaathi.gov.in).

A deceptive social engineering trap where a fraudster sends a QR code to a seller, claiming that scanning the QR code in a UPI app is required to deposit money or receive an advance token amount.

1. A scammer approaches someone selling household goods, furniture, or a vehicle on platforms like OLX or Quikr.
2. The scammer agrees to the asking price immediately without negotiation to create excitement and lower defenses.
3. The scammer sends an image of a QR code via WhatsApp or chat, instructing: "Sir, this is our company barcode. Scan it in Google Pay or PhonePe to instantly receive ₹10,000 advance into your account."
4. When the seller scans the QR code, the UPI app actually opens a "Pay ₹10,000" transfer window and asks for the UPI PIN.
5. The scammer reassures: "Don't worry, enter your PIN and it will credit the amount." As soon as the PIN is entered, ₹10,000 is debited from the victim's bank account.

• ✕Anyone instructing you to "scan a QR code to get paid". QR scanning is strictly an OUTBOUND payment action.
• ✕The caller remains on the phone line exerting intense time pressure ("Enter PIN within 30 seconds or link expires").
• ✕The payment screen displays "Pay" or "Transfer", never "Receive".

• ✓Understand the technical architecture: To receive money on UPI, the sender ONLY needs your UPI ID or phone number. You do not touch your phone or scan anything.

• •Never scan a QR code sent over chat or WhatsApp.
• •Remember the absolute rule: If you are scanning, money is leaving your account.

• ➜Immediately call 1930 within the first 10 minutes to initiate a freeze on the recipient beneficiary bank account.
• ➜Open your UPI app, locate the transaction, tap "Report Fraud / Dispute", and note the 12-digit UTR number.

Exploiting the UPI "Collect Request" protocol, where a fraudster initiates a debit pull from your UPI ID, crafting the remark text to read like a credit, refund, or prize reward.

A social engineering phone call where the fraudster convinces the victim that UPI technology requires entering their secret MPIN as a two-way handshake to "unlock" or "receive" inbound funds.

Scammers target consumers awaiting refunds from e-commerce, food delivery, or airline portals (Swiggy, Zomato, Flipkart, IRCTC), sending malicious links or collect requests disguised as instant refund processing.

Cybercriminals target peer-to-peer sellers on classified portals (OLX, Facebook Marketplace, Quikr) by posing as eager buyers, defense personnel, or company procurement managers who manipulate payment mechanisms.

Fraudsters set up fake e-commerce profiles or classified ads offering premium smartphones, used cars, or luxury electronics at absurdly discounted prices, demanding advance booking tokens via UPI.

A covert physical tampering scam where fraudsters paste their own counterfeit printed QR code sticker directly over a merchant's genuine standee QR code at a busy retail counter.

Scammers plant fake customer support phone numbers on public forums, blogs, fake review portals, and social media comment sections, posing as official helplines for UPI apps, banks, or e-commerce giants.

Cybercriminals manipulate Google Search results using paid Google Ads, SEO keyword stuffing, and rogue Google Maps business edits to place fraudulent helpline numbers at the very top of search queries for airlines, couriers, and banks.

Phishing SMS and WhatsApp messages claiming that your bank account, debit card, or UPI profile has been suspended due to pending KYC (Know Your Customer) or PAN update, urging you to click a link to avoid permanent closure.

Scammers trick victims into installing legitimate remote-access desktop/mobile applications (AnyDesk, TeamViewer QuickSupport, RustDesk, Splashtop) under the guise of technical troubleshooting, allowing the attacker to view and control the phone screen.

Cybercriminals hijack a friend or relative's WhatsApp account (via SIM swap, WhatsApp Web QR scanning, or OTP theft) and send urgent money transfer requests via UPI to all recent contacts.

Scammers clone social media profiles (Instagram, Facebook, LinkedIn) of trusted friends, public figures, or relatives, and message followers requesting urgent UPI transfers for artificial crises.

Intimidating SMS and WhatsApp messages threatening immediate disconnection of home electricity power or water connection tonight unless a pending bill or surcharge is paid immediately via a provided mobile number or UPI link.

Phishing SMS campaigns claiming a parcel cannot be delivered due to an "incorrect house address" or "unpaid customs fee of ₹5", directing victims to a malicious payment portal that steals banking credentials.

Sophisticated investment syndicates lure victims through Telegram, WhatsApp, and Facebook groups into fake institutional stock trading platforms, IPO allotment pools, or crypto arbitrage schemes, demanding heavy deposits via UPI.

Predatory digital lending operations advertise instant, paperless loans with no credit score (CIBIL) checks on social media, demanding advance "processing fees", "GST charges", or "insurance deposits" via UPI before disbursal.

Fraudsters offer lucrative part-time work-from-home jobs (liking YouTube videos, rating Google Maps locations, hotel reviews), paying small real rewards initially to build trust before coercing victims into depositing large sums for "prepaid tasks".

Attackers fraudulently obtain a replacement SIM card or eSIM profile for your mobile number from your telecom service provider, intercepting SMS OTPs and device-binding handshakes required to control your UPI applications.

Scammers register deceptive Virtual Payment Addresses (VPAs) that closely mimic legitimate disaster relief funds, charities, corporate entities, or government accounts (e.g., creating `pm.carees@icici` instead of the genuine `pmcares@sbi`).

Targeted sabotage of retail payment counters involving either physical standee replacement, SIM card theft from IoT Soundbox speakers, or volume/software tampering of merchant audio alert devices.

Scammers target shopkeepers and business owners, impersonating merchant support desks (e.g. "Paytm Merchant Helpdesk", "PhonePe Business Support"), claiming the store's daily settlement failed and requires manual authorization.

Attackers create spoofed payment gateway web pages (mimicking Razorpay, Cashfree, or CCAvenue) or forged UPI intent links that trigger unauthorized debits or harvest sensitive payment credentials.