UPI Fraud: How the Scams Work and How to Respond
Entering your UPI PIN sends money out. It never brings money in. Almost every UPI scam hides that one fact.
UPI fraud rarely breaks UPI itself. The payment rails, the bank's switch and the app usually work exactly as designed. What the fraudster breaks is the customer's understanding of one rule: entering the UPI PIN sends money out of your account. It never brings money in.
Almost every UPI scam is a way of getting the customer to enter that PIN, or to hand over control of the phone, while believing something else is happening: receiving a refund, collecting a prize, paying a small verification fee or helping 'customer care' fix a problem.
You save ₹300
- Full 120-question mocks
- Cyber law coverage
- Module-wise practice
One payment, no subscription · Valid for 2 months
Common UPI Fraud Patterns
Fake collect request
The story the victim is told
'Approve this request to receive your refund or payment'
What is really happening
Approving the request with the PIN pays the fraudster
QR code 'to receive money'
The story the victim is told
'Scan this QR code to get the amount for your item'
What is really happening
Scanning a payment QR and entering the PIN sends money out
Tampered merchant QR
The story the victim is told
A shop's printed QR looks normal
What is really happening
A sticker over the real code sends payments to the fraudster's account
Fake customer care
The story the victim is told
A number found through a web search or social media post promises to fix a failed transaction
What is really happening
The 'agent' asks for the PIN, an OTP or a screen-sharing app
Screen-sharing takeover
The story the victim is told
'Install this app so I can guide you'
What is really happening
The fraudster watches the PIN being typed and operates the phone
Wrong-credit trick
The story the victim is told
'I sent money to you by mistake, please return it'
What is really happening
No genuine credit was received; a fake SMS or a collect request does the work
| Pattern | The story the victim is told | What is really happening |
|---|---|---|
| Fake collect request | 'Approve this request to receive your refund or payment' | Approving the request with the PIN pays the fraudster |
| QR code 'to receive money' | 'Scan this QR code to get the amount for your item' | Scanning a payment QR and entering the PIN sends money out |
| Tampered merchant QR | A shop's printed QR looks normal | A sticker over the real code sends payments to the fraudster's account |
| Fake customer care | A number found through a web search or social media post promises to fix a failed transaction | The 'agent' asks for the PIN, an OTP or a screen-sharing app |
| Screen-sharing takeover | 'Install this app so I can guide you' | The fraudster watches the PIN being typed and operates the phone |
| Wrong-credit trick | 'I sent money to you by mistake, please return it' | No genuine credit was received; a fake SMS or a collect request does the work |
What to Tell a Customer at the Counter
- checkYou never need your UPI PIN to receive money.
- checkNever scan a QR code someone sends you in order to 'get' a payment.
- checkFind a company's helpline only on its official app or website, never through a search result or a social media comment.
- checkNever install a screen-sharing or remote-access app at a stranger's request.
- checkNever dial a code a stranger sends, especially one starting with *21*: it can switch on call forwarding.
- checkIf money has gone, call the bank and 1930 immediately. Minutes matter.
What Happens After a Report
The National Cyber Crime Helpline 1930 feeds the Citizen Financial Cyber Fraud Reporting and Management System, which I4C runs to connect police, banks, payment intermediaries and wallets on one platform. A report there lets the beneficiary bank be alerted while the money may still be in the first account it landed in, before it is split across mule accounts.
On the bank side, RBI's Digital Payment Security Controls Directions, 2026 expect banks to monitor transfers to mobile numbers and Virtual Payment Addresses (VPAs) against which vishing or other fraud has been recorded, and to give customers a way inside the app to flag a transaction as fraudulent at once.
Quick practice on banking operations. No signup.
Who Bears the Loss
A UPI debit is an electronic banking transaction, so RBI's customer liability rules apply. If the customer entered the PIN themselves after being tricked, the bank will usually treat it as customer negligence. RBI's revised rules for banks, applying to transactions from 1 January 2027, add a one-time compensation for small losses even in such cases, if reported within five calendar days, and treat failures at a third-party app provider as a third-party breach. Details are on the customer liability page.
How the IIBF Exam Tests This
Expect a short scenario and four labels: was it phishing, vishing, a collect-request scam or a SIM swap? Read for the mechanism, not the channel. A phone call that ends with the customer approving a collect request is still a collect-request fraud. Also expect the 'first action' question: the answer is to block further debits by reporting to the bank, alongside 1930, not to visit the police station first.
FAQs
Can someone take money from my account with just my UPI ID?expand_more
No. A UPI ID (VPA) is like an account number for receiving money. Money leaves only when the account holder authorises it with the UPI PIN, which is why fraudsters work so hard to get the customer to enter it.
What should I do immediately after a UPI fraud?expand_more
Report it to your bank through its 24x7 channel so further debits are blocked, and report it on 1930 or cybercrime.gov.in. Keep the transaction ID (UTR), date, amount and the fraudster's UPI ID or number ready.
Will the bank refund money lost in a UPI scam?expand_more
It depends on whose failure caused the loss. If the bank or a third party in the system was at fault and you report promptly, you can get zero liability. If you shared your PIN or approved the payment yourself, you usually bear the loss up to the time you report it, subject to RBI's small-value compensation scheme for transactions from 1 January 2027.
Is scanning a QR code safe?expand_more
Scanning to pay a merchant you can see is normal. Scanning a code someone sends you so that you can 'receive' money is always a scam, and printed QR codes can be covered by a fraudster's sticker, so check the payee name before you enter the PIN.
Next steps
- Online Banking Fraudarrow_forward
- Customer Liabilityarrow_forward
- Reporting Cyber Crimearrow_forward
- Social Engineeringarrow_forward
120 questions, 2 hours, scored instantly.