UPI Fraud: Common Scams, How to Stay Safe and What to Do If You're Hit

UPI scams rarely involve hacking into a bank. Far more often, someone persuades you to approve the payment yourself, by creating urgency, fear or the hope of easy money. So the best defence is to recognise the script.

The scripts to know

“Enter your PIN to receive this.” You’re told you’ve got a refund, a prize, or payment for something you’re selling. You’re then sent a QR code or a payment request to approve. Approving it takes money out of your account. It doesn’t bring money in.

NPCI directed banks and UPI apps to stop person-to-person collect requests from 1 October 2025, reports said, because they were being misused. Merchant requests continue. So be very suspicious of any request appearing to come from a person, and read what’s on the screen before you approve anything.

“You’ve been overpaid.” A buyer or stranger sends a fake screenshot or SMS, and asks you to return the “extra”. Check your account in your bank’s own app, not the message.

The fake helpline. You search online for customer care, or get a call from “the bank” or “your UPI app”. The person sounds helpful and asks you to install a screen-sharing app, or to read out an OTP. Once they have control or the code, they can act as you.

“Your account or KYC will be blocked.” An urgent SMS or call pushes you to a link or a form. Nobody updating your KYC needs you to read out a PIN or OTP over a call or type it into a link from a message.

The government or police scare. Callers claim to be officials, say you’re under investigation, and demand a “security deposit”. Hang up, and contact the authorities yourself using a number you’ve found independently.

Job and investment offers. Small “tasks” pay you a little at first. Later you’re asked to pay in to unlock bigger returns. Those returns don’t arrive.

Loan app traps. A fake app demands upfront fees or threatens you and your contacts. See how to spot fake loan apps.

Five habits that can help

1. Pause on any urgency. Fraud relies on panic. A real bank won’t object if you hang up and call back on the number printed on your card or shown on its website.
2. Keep your PIN, OTP and card details to yourself. Nobody from a bank, NPCI, the police or an app needs them.
3. Read before you approve. Check the payee’s name and the amount every time you pay, particularly after scanning a QR code.
4. Never install remote-access apps at a caller’s request, and download apps only from official app stores.
5. Don’t lend your account. Letting someone route money through your account for a commission could make you part of a fraud.

It also helps to set a lower daily transaction limit in your app if it allows this, to keep SMS alerts switched on, and to use a separate account with a smaller balance for day-to-day UPI payments.

If it happens: the first hour

Do these in order, and don’t stop to feel embarrassed. These scams catch careful people too.

1. Tell your bank immediately. Use the official helpline or app. Report the transaction as fraud, ask them to block further debits, and get a complaint or reference number.
2. Call 1930 or go to cybercrime.gov.in. That’s the National Cyber Crime helpline and reporting portal. Have the transaction ID, time, amount and the fraudster’s UPI ID or phone number ready.
3. Secure your phone and accounts. Uninstall any screen-sharing app, change your UPI PIN and banking passwords, and check for other transactions.
4. Keep the evidence. Save screenshots of messages, call logs, and all your reference numbers.
5. Beware of “recovery agents”. Anyone who offers to get your money back for a fee is often part of the same scam.

For card fraud, our guide on what to do after credit card fraud covers the extra steps.

What RBI’s liability rules say

These rules are changing, so check which version applies to your transaction.

As of November 2026, under RBI’s existing framework for unauthorised electronic banking transactions:

From 1 January 2027, new RBI directions apply to transactions at commercial banks. Separate directions cover other types of bank. Key changes include:

• zero liability for a third-party breach if you report within five calendar days
• a resolution deadline of 45 calendar days for domestic fraud
• one-time compensation for small frauds where the gross loss is up to ₹50,000, once in a lifetime: 85% of the net loss or ₹25,000, whichever is less, subject to conditions including reporting within five calendar days to both the bank and 1930 or the portal

For example, on a ₹20,000 net loss, 85% would be ₹17,000. On a ₹40,000 net loss, 85% would be ₹34,000, so the ₹25,000 cap would apply. Ask your bank how the rules apply to your particular case, because the facts matter.

If your bank doesn’t help

Use the bank’s formal grievance process and keep a record. If it hasn’t replied in 30 days or the timeline RBI has set for such cases, or if you’re unhappy with the reply, you can complain to the RBI Ombudsman at cms.rbi.org.in, under the Reserve Bank – Integrated Ombudsman Scheme, 2026. It’s free, and you need to file within 90 days of that period ending or of the bank’s last communication, whichever is later. The contact centre on 14448 can guide you. Your complaint to the police or cyber portal is separate and should still go ahead.

Bottom line

Remember one rule: a PIN sends money. Then build the habit of pausing whenever someone is rushing you. If something goes wrong, report it within minutes to your bank and to 1930. Keep your deposits secure too, and see how to compare savings accounts for what to look for in a bank’s fraud support.