UPI fraud cases in India increased by 300% between 2021 and 2024, according to the Reserve Bank of India. In the financial year 2024-25, over 18,000 UPI fraud complaints were registered on the national cybercrime portal, with estimated losses exceeding ₹1,800 crore. Despite this, UPI remains one of the safest digital payment systems in the world, with a fraud rate below 0.01% across 14 billion monthly transactions. The problem is not UPI itself. The problem is that scammers have found increasingly sophisticated ways to trick people into authorising transactions themselves. Every UPI scam works the same way at its core: the scammer convinces you to take an action. Understanding the specific tactics they use is how you stop them.
How UPI Works (and Why Scams Require Your Action)
A brief technical point that matters for understanding every scam in this guide:
UPI transactions require authentication. Every payment must be authorised through your UPI PIN, which only you know. No one can withdraw money from your account without this PIN. There is no way to remotely access your UPI PIN or force a transaction without your input.
This means every UPI scam requires your participation. The scammer must convince you to either:
- Enter your UPI PIN to authorise a payment (often disguised as "receiving" money)
- Approve a collect request that you didn't initiate
- Share your UPI PIN, OTP, or screen with the scammer
- Install an app that gives the scammer remote access to your phone
Understanding this single fact protects you against every scam below: if you didn't initiate the transaction, don't enter your PIN.
The 8 Most Common UPI Scams in India
1. The Collect Request Scam
How it works: A stranger sends you a UPI collect request (a request for you to pay them). The request message says something like "Refund of ₹5,000" or "Cashback reward" or "Prize money." You see the notification, read the message, and think you're receiving money. You enter your UPI PIN to "accept the refund." In reality, you've just authorised a payment from your account to the scammer.
Why it works: Many people don't understand the difference between receiving money (which never requires your UPI PIN) and paying money (which always does). Scammers exploit this confusion by framing the collect request as an incoming payment.
The rule: Receiving money on UPI never requires you to enter your UPI PIN. If someone asks you to enter your PIN to "receive" money, it is a scam. No exceptions.
How to protect yourself:
- Never accept collect requests from unknown numbers or UPI IDs.
- Before approving any collect request, read it carefully. It will clearly say "Pay ₹X to [name]." If it says "Pay," you are sending money, not receiving it.
- Disable auto-pay for collect requests in your UPI app settings.
2. The Fake Customer Care Scam
How it works: You search for a customer care number on Google (for your bank, a delivery service, an airline, etc.). The top results include fake numbers planted by scammers through Google Ads, fake websites, or SEO manipulation. You call the number thinking you've reached official support. The "customer care agent" asks you to install a screen-sharing app (AnyDesk, TeamViewer, QuickSupport) for "troubleshooting" or asks you to share your UPI details for "verification."
Once they have screen access, they can see your UPI PIN as you type it, initiate transactions from your phone, or transfer money directly.
Why it works: Most people trust Google search results and don't verify whether a customer care number is official. The scammer plays the role of a helpful support agent, which lowers your guard.
How to protect yourself:
- Never search for customer care numbers on Google. Find them only on the official website or app of the company.
- No legitimate customer care agent will ever ask you to install AnyDesk, TeamViewer, or any screen-sharing app.
- No customer care agent will ever ask for your UPI PIN, full card number, CVV, or OTP.
- If someone asks to "remotely access your phone to fix the issue," hang up immediately.
3. The QR Code Scam
How it works: A scammer contacts you (often through OLX, Facebook Marketplace, or WhatsApp, posing as a buyer for something you're selling) and says they want to pay you via UPI. They send you a QR code and ask you to scan it to "receive the payment." The QR code is actually a pay request. When you scan it and enter your UPI PIN, you send money to the scammer instead of receiving it.
In a more sophisticated variant, scammers paste fake QR codes over legitimate ones at shops, parking meters, or donation boxes.
Why it works: Scanning a QR code feels like a receiving action. People associate scanning with "accepting" payment. Scammers exploit this association.
The rule: Scanning a QR code on UPI always means you are paying. You never need to scan a QR code to receive money. To receive money, you share your UPI ID or phone number, and the sender initiates the payment.
How to protect yourself:
- Never scan a QR code to receive money. It's not how UPI works.
- When selling something online, share your UPI ID and let the buyer send money to you. Never scan anything they send.
- Always check the amount and recipient name displayed on your screen before entering your PIN.
- At physical locations, verify that QR codes haven't been tampered with or pasted over.
4. The Fake Payment Screenshot Scam
How it works: A buyer (on OLX, Marketplace, or in a physical transaction) shows you a screenshot of a "successful" UPI payment. The screenshot looks like a genuine transaction confirmation. Based on this "proof," you hand over the goods or provide a service. In reality, no payment was made. The screenshot was fabricated using image editing tools or fake payment receipt generators (easily available online).
Why it works: People trust visual confirmation. A screenshot that shows a green checkmark and a transaction ID feels like proof. In busy or high-pressure situations, sellers don't verify their own bank account or UPI app before releasing goods.
How to protect yourself:
- Never rely on the buyer's screenshot as proof of payment. Always check your own UPI app or bank account for the credited amount.
- Wait for the money to actually appear in your account before handing over goods or services.
- Be especially cautious with high-value transactions. Scammers deliberately target sellers of expensive items (phones, electronics, vehicles).
5. The Overpayment and Refund Scam
How it works: A scammer sends you a small genuine UPI payment (say ₹1) to build trust. They then claim they "accidentally" sent you a larger amount (say ₹10,000) and send you a fabricated screenshot as proof. They urgently request you to "refund" the excess amount. You check your account, see only the ₹1, but the scammer insists the larger amount is "processing" and will appear soon. Under social pressure, you send the "refund" of ₹9,999, which the scammer pockets.
In a variant, the scammer sends a genuine but small amount and then immediately sends a collect request for a much larger amount disguised as a "reversal."
Why it works: The initial genuine payment creates trust. The urgency and social pressure of being asked to return "someone else's money" compels people to act quickly without verifying.
How to protect yourself:
- Never send a "refund" based on someone else's claim or screenshot. Verify the actual credited amount in your own account.
- If someone genuinely sent you money by mistake, they can raise a dispute through their bank or UPI app. You are not required to manually refund it.
- No legitimate refund requires you to send money to a different UPI ID than the one that sent you the original payment.
6. The SIM Swap and Account Takeover
How it works: The scammer gathers your personal information (name, phone number, Aadhaar details) through social media, data breaches, or phishing. They contact your mobile operator and request a SIM replacement, impersonating you. Once they receive the new SIM, your original SIM is deactivated. The scammer now receives all your OTPs and can reset your UPI PIN, access your bank accounts, and initiate transactions.
Why it works: Mobile operator KYC processes, while improving, can still be bypassed through social engineering of telecom store employees or through fraudulent online SIM replacement requests.
Warning signs:
- Your phone suddenly shows "No Network" or "SIM not registered" for an extended period.
- You receive an unexpected SMS saying "SIM upgrade request received."
- You stop receiving OTPs for banking and other services.
How to protect yourself:
- If your phone loses network unexpectedly and doesn't recover within a few minutes, contact your mobile operator immediately from another phone. Ask if a SIM replacement was requested.
- Set a SIM lock or PIN with your mobile operator so that SIM replacements require additional verification.
- Enable email-based or app-based 2FA for your banking apps instead of relying solely on SMS OTPs.
- Don't share your Aadhaar number, full name, and date of birth on social media or public profiles. This combination is often enough for SIM swap social engineering.
7. The Investment and Trading Scam
How it works: You're added to a WhatsApp or Telegram group promoting stock tips, cryptocurrency investments, or forex trading. The group shows impressive "returns" through fabricated screenshots. An "expert" or "mentor" guides you to invest through a specific platform or UPI ID. Initial small investments may show genuine-looking returns (sometimes scammers actually pay small returns to build trust). Once you invest a larger amount, the money disappears. The platform is fake, the group is controlled by scammers, and the "returns" were fabricated.
In a more direct variant, scammers contact you claiming to be from your broker or mutual fund company, offering an "exclusive" high-return scheme that requires direct UPI transfers.
Why it works: Greed combined with social proof (seeing other "members" reporting profits) overrides scepticism. The initial small genuine returns build trust that is then exploited.
How to protect yourself:
- Legitimate investments are made through SEBI-registered brokers and AMCs, never through direct UPI transfers to individuals.
- If someone guarantees returns, it is a scam. No legitimate investment carries guaranteed returns.
- Verify any broker or platform on the SEBI website before investing.
- Be deeply suspicious of unsolicited additions to "investment" groups on WhatsApp or Telegram.
- Check the RBI's Sachet portal for lists of entities not authorised to accept public deposits.
8. The Reward, Cashback, or Lottery Scam
How it works: You receive a message (SMS, WhatsApp, email) saying you've won a prize, cashback, lottery, or reward. To "claim" your winnings, you need to click a link, enter your UPI details, or pay a small "processing fee" or "tax" via UPI. The link may lead to a phishing page that captures your UPI credentials, or the "processing fee" is simply stolen.
Why it works: The prospect of free money triggers excitement that overrides rational assessment. The "processing fee" is kept small enough to seem reasonable relative to the "prize."
How to protect yourself:
- You cannot win a lottery or contest you never entered.
- Legitimate companies never ask you to pay a fee to receive a prize.
- Never click links in unsolicited messages claiming you've won something.
- Never enter your UPI PIN or banking details on any page reached through an unsolicited link.
What to Do Immediately If You've Been Scammed
The first hour is critical. Act in this order:
1. Call 1930
The National Cyber Crime Helpline (available 24/7) can initiate an immediate freeze on the receiving account. The faster you call, the higher the chance of catching your money before it's withdrawn or moved. For a detailed walkthrough of the complaint process, read our guide on how to file a cybercrime complaint in India.
2. File a Dispute Through Your UPI App
Open the UPI app you used (Google Pay, PhonePe, Paytm, etc.). Find the fraudulent transaction in your history. Select "Raise Dispute" or "Report Issue." This initiates a dispute with NPCI (National Payments Corporation of India), which mediates between your bank and the receiving bank.
3. Contact Your Bank
Call your bank's fraud helpline (the number on the back of your debit card or in your banking app). Report the fraudulent transaction. Request a temporary freeze on your account if you suspect further unauthorised access.
4. File Online at cybercrime.gov.in
Submit a detailed complaint at cybercrime.gov.in under "Online Financial Fraud." Include transaction IDs, timestamps, the scammer's UPI ID or phone number, and all screenshots.
5. File an FIR
Visit your nearest police station with printed evidence. An FIR creates a formal legal record and is required for insurance claims and bank dispute escalation.
7 Rules That Prevent All UPI Scams
If you follow these seven rules, you are protected against every UPI scam described above and any future variant:
- Your UPI PIN is like your ATM PIN. Never share it with anyone. No bank employee, customer care agent, or payment app representative will ever ask for it.
- Receiving money never requires your PIN. If someone says you need to enter your PIN to receive money, it's a scam.
- Never scan a QR code to receive money. QR codes are for paying. To receive, share your UPI ID.
- Always verify payments in your own app. Never rely on screenshots, confirmations, or claims from the other party.
- Never install screen-sharing apps (AnyDesk, TeamViewer, QuickSupport) on anyone's instruction.
- Find customer care numbers only on official apps and websites. Never search Google for support numbers.
- If it sounds too good to be true, it is. No legitimate entity offers guaranteed returns, lottery winnings you never entered, or free money that requires a "processing fee."
How Verified Communication Reduces UPI Fraud
A significant percentage of UPI scams begin with unsolicited contact from an anonymous stranger: a fake buyer on a marketplace, a fraudulent customer care agent, a scammer in a WhatsApp group, or an impostor claiming to be from your bank. The scam succeeds because the victim cannot verify who they're actually communicating with.
On AirlockChat, every user is government-verified through DigiLocker. No one can contact you without your explicit consent. If someone claims to be a buyer, a professional, or a representative of any kind, their verified government identity is visible. Scammers who rely on anonymity and unsolicited contact cannot operate on a platform where both are structurally eliminated.
While AirlockChat is a messaging platform and not a payment platform, the principle is consistent: verified identity and consent-first communication close the channels that scammers depend on to reach their victims.
Key Takeaways
UPI itself is secure — every scam requires you to authorise the transaction yourself. The 8 most common scams all rely on confusion, impersonation, or social pressure to trick you into entering your PIN, approving a collect request, or installing remote access software. Protect yourself with two core rules: never enter your PIN to "receive" money, and never share your PIN, OTP, or screen with anyone. If you've been scammed, call 1930 within the first hour for the best chance of fund recovery. UPI fraud is preventable when you understand that the only person who can authorise a payment from your account is you.