UPI Fraud: The 7 Scams Costing Indians the Most Money Right Now

A techie in Pune sold his old laptop on OLX. The buyer said he’d pay via UPI and asked him to scan a QR code to “accept” the payment. He scanned it, entered his PIN to confirm receipt, as instructed, and watched 47,000 rupees leave his account instead of arrive in it. The entire thing took under two minutes. He wasn’t careless or technically clueless, he does this for a living. He was just momentarily distracted by a routine-sounding request, which is exactly what these scams are built around.

UPI fraud in India isn’t really a technology problem. NPCI’s systems are robust, and UPI itself hasn’t been “hacked” in any meaningful sense. Nearly every rupee lost happens because someone was convinced, in the moment, to either share something they shouldn’t have or approve something they misunderstood. According to data the government tabled in Parliament, UPI fraud losses touched 805 crore rupees across 10.64 lakh reported cases in FY26 up to November alone, following 981 crore rupees lost in FY25 and a peak of 1,087 crore rupees in FY24. Here are the seven scams behind most of that money, and exactly how each one works.

The One Rule That Explains Almost Every Scam on This List

Before getting into specifics, it’s worth burning one fact into memory: your UPI PIN is only ever needed when you are sending money. Nobody, not a buyer, not a “bank representative,” not customer support, ever needs your PIN to send you money or to help you receive a refund. If any situation asks you to enter your PIN in order to receive money, it is not a receipt confirmation, it is you authorising an outgoing payment. Nearly every scam below is a variation on tricking you into forgetting this one rule at exactly the wrong moment.

1. The Fake Collect Request Scam

This is what happened to the techie in Pune, and it’s one of the most common patterns on resale platforms like OLX, Facebook Marketplace, and Quikr. A “buyer” says they’ve sent payment and asks you to scan a QR code or approve a request to “receive” the money. What you’re actually looking at is a Collect Request, a request for money to be pulled from your account, disguised to look like an incoming payment. The moment you enter your PIN, you’ve authorised a payment out, not in.

The fix is simple and absolute: money you’re receiving never requires your PIN. If you’re selling something and a buyer asks you to scan anything or approve anything before you see money actually land in your account balance, decline and ask them to simply send the payment directly to your UPI ID instead.

2. Digital Arrest Scams

This is the most psychologically brutal scam on this list, and the one behind some of the largest individual losses reported in India. Fraudsters impersonate CBI, Enforcement Directorate, customs, or police officials, and call claiming your Aadhaar or bank account is linked to a serious crime like money laundering or drug trafficking. They keep you on a continuous video call, sometimes for days, isolating you from contacting family or a lawyer, insisting you stay in “digital custody” until you transfer your savings to “prove your innocence” or “clear your name.”

More than 30,000 digital arrest complaints were filed in 2025 alone, with total losses estimated near 3,000 crore rupees for the year, and the victims are disproportionately educated professionals and senior citizens, not naive or unaware users. No real law enforcement agency in India conducts investigations over a video call or asks for money to clear your name. If you receive a call like this, the correct response is to hang up and verify independently through the actual agency’s official contact channels, not any number the caller provides.

3. SIM Swap Fraud

This one is quieter and more technically involved. Fraudsters gather a victim’s personal details, often from breached KYC databases, then visit a telecom store with forged documents and get a duplicate SIM card issued in the victim’s name. Once the new SIM is active, the victim’s original phone loses signal entirely, and the fraudster starts receiving the OTPs needed to reset UPI PINs or authorise transactions. By the time the victim notices their phone has gone silent and figures out why, the account is often already drained.

This scam typically targets higher-balance accounts, with reported losses in individual cases ranging from roughly 2 lakh to 25 lakh rupees. The Department of Telecommunications introduced a mandatory 5-day cooling period for SIM swap requests as a safeguard. If your phone unexpectedly loses network signal for an extended period with no clear explanation, treat it as an emergency, contact your telecom provider and your bank immediately, rather than assuming it’s a network issue.

4. Fake Customer Care Numbers

Searching online for your bank’s or payment app’s customer care number and calling the first result that appears feels harmless, but it’s become a major fraud vector. Scammers create fake support pages and listings that rank in search results or appear as sponsored content, and calling these numbers connects you directly to a fraudster posing as legitimate support staff. In just one quarter of 2026, the Indian Cyber Crime Coordination Centre reported removing over 4,200 fake customer care pages from search results.

These fake representatives typically ask you to install a remote screen-sharing app “to resolve your issue,” or ask for your PIN or OTP “for verification.” Legitimate customer support never needs either. Always use the official number listed directly inside your banking or UPI app, never one found through a general web search.

5. QR Code Swap Fraud

This is a low-tech, high-impact scam mostly affecting shopkeepers and small vendors, though customers can be caught out too. A fraudster physically replaces a shop’s printed QR code sticker with their own, redirecting customer payments straight into their own account instead of the merchant’s. Since customers assume they’re paying the store directly, this can go unnoticed for a surprisingly long time.

Shop owners should periodically verify their displayed QR code matches their actual account by doing a small test transaction themselves, and customers can protect themselves by confirming the payee name that appears on the confirmation screen actually matches the shop’s name before entering their PIN.

6. Malware and Malicious Link Scams

Not every scam requires you to consciously hand over your PIN. Clicking a link in a text message, email, or WhatsApp forward, often disguised as a delivery notification, a prize claim, or an urgent account alert, can silently install malware that captures your banking credentials or screen activity without you realising anything unusual happened. Research into newer UPI users has found victims who lost money after simply clicking a link, with no memory of ever sharing an OTP or PIN at all.

The safest habit here is treating unexpected links in messages, especially ones creating urgency around a delivery, a prize, or an account problem, as suspicious by default, and navigating directly to a company’s official app or website instead of clicking through.

7. Fake Payment Screenshot Scams

This one specifically targets small vendors and shopkeepers during busy, distracted moments. A scammer makes a purchase, then shows the shopkeeper a doctored or fake “payment successful” screenshot on their phone, sometimes paired with a fake notification sound played from another device, and walks away with the goods before the shopkeeper realises no actual payment ever came through.

Vendors can protect themselves by getting into the habit of checking their own bank or UPI app for confirmed, credited payment, not a customer’s screen, before handing over goods, especially during busy periods when it’s easiest to be rushed.

The Numbers Behind These Scams

Fiscal Year	Reported UPI Fraud Cases	Total Losses
FY24	13.42 lakh	₹1,087 crore
FY25	12.64 lakh	₹981 crore
FY26 (up to Nov 2025)	10.64 lakh	₹805 crore

These figures, tabled in the Lok Sabha by the Finance Ministry, cover UPI-specific fraud. Broader digital and cyber fraud in India, including non-UPI channels like investment scams and digital arrest cases, is considerably larger, with the Indian Cyber Crime Coordination Centre estimating overall cyber fraud losses near 22,495 crore rupees for 2025 alone, alongside a 24 percent jump in total complaint volume.

What to Do Immediately If You’ve Been Scammed

Speed is genuinely the single biggest factor in whether you recover any money. Call your bank’s fraud helpline or your UPI app’s support line immediately to report the transaction and request an account freeze if further fraud seems likely. Simultaneously, file a complaint on the National Cyber Crime Reporting Portal, or call the national cyber crime helpline at 1930. Banks can sometimes freeze a scammer’s account and recover funds if reported within the first few hours, but recovery odds drop sharply the longer you wait, and there’s no guarantee of any recovery once funds have been withdrawn by the fraudster.

About This Guide

This article uses UPI fraud statistics tabled in the Lok Sabha by the Finance Ministry, covering FY24 through FY26 (up to November 2025), along with figures from the Indian Cyber Crime Coordination Centre for broader digital fraud context. Fraud patterns and reported figures continue to evolve, so please refer to current RBI, NPCI, and I4C advisories for the latest guidance, and report any suspected fraud immediately through your bank or the national cyber crime helpline, 1930.

Common Mistakes That Make People Vulnerable

Assuming that receiving money ever requires your PIN is the single most exploited misunderstanding on this entire list. Internalising the opposite, PIN is only for sending, closes off a huge share of these scam patterns immediately.

Trusting a phone number found through a general web search rather than your bank’s official app is another common vulnerability, especially now that fake customer care listings have become sophisticated enough to rank well in search results.

People also frequently underestimate how quickly they need to act after realising something’s wrong, treating it as something to sort out “tomorrow morning” rather than an emergency requiring an immediate call to their bank and the 1930 helpline.

Finally, dismissing a call from “the police” or “CBI” as something that couldn’t possibly be fake, simply because of how authoritative and urgent it sounds, is exactly the psychological lever digital arrest scams are built to exploit. Genuine legal authorities do not conduct investigations over a continuous video call or ask for money transfers to prove innocence.

My Take

What strikes me most about this list is how little of it actually requires the victim to be careless in any ordinary sense. A software engineer got scammed in under two minutes doing something that felt completely routine. That’s the real danger with UPI fraud in India right now, it doesn’t rely on ignorance, it relies on exploiting a brief moment of distraction or urgency against people who otherwise know better. The single habit worth building above all others is a genuine pause before entering your UPI PIN, every single time, asking yourself plainly: am I sending money right now, or is someone asking me to enter this to “receive” something? If it’s the latter, stop immediately.

Frequently Asked Questions

1. Can someone steal my money just by knowing my UPI ID? No. A UPI ID alone cannot be used to debit money from your account. Every outgoing payment requires your UPI PIN, which is why scams focus on tricking you into entering it rather than trying to bypass it.

2. Do I need to enter my PIN to receive money on UPI? No, never. Receiving money on UPI never requires your PIN. If any request asks you to enter your PIN to “receive” a payment, it’s a scam, most likely a disguised Collect Request.

3. What is a digital arrest scam? It’s a scam where fraudsters impersonate police, CBI, or other officials, keeping victims on a prolonged video call and claiming they’re under investigation, pressuring them to transfer money to avoid arrest. No genuine law enforcement agency operates this way.

4. How quickly should I report a UPI fraud? Immediately. Report to your bank and the national cyber crime helpline, 1930, or the National Cyber Crime Reporting Portal, within the first few hours if possible, since recovery chances drop significantly the longer you wait.

5. Can banks always recover money lost to UPI fraud? Not always. Recovery depends heavily on how quickly it’s reported and whether the funds are frozen before the scammer withdraws them. Fast reporting significantly improves the odds, but full recovery isn’t guaranteed.

6. How do I verify a bank or UPI app’s customer care number is genuine? Always use the number listed directly within your official banking or UPI app, never a number found through a general web search, since fake customer care listings have become increasingly common and convincing.

7. What is a SIM swap scam? It’s a fraud where someone obtains a duplicate SIM card in your name using stolen personal details, then uses the OTPs sent to that SIM to reset your UPI PIN or authorise transactions, often while your original phone loses signal entirely.

8. Is it safe to click links in messages claiming to be from delivery services or banks? Not unless you can independently verify the sender, since malicious links can install malware or lead to fake pages designed to steal your credentials, sometimes without any obvious sign that something’s wrong.

9. How much money has India lost to UPI fraud recently? According to Finance Ministry data tabled in Parliament, UPI fraud losses totalled 805 crore rupees across 10.64 lakh cases in FY26 up to November 2025, following 981 crore rupees in FY25 and a peak of 1,087 crore rupees in FY24.

10. What should shopkeepers do to avoid QR code and fake screenshot scams? Periodically verify that displayed QR codes match their actual account, and always confirm a payment has genuinely landed in their own bank or UPI app balance before handing over goods, rather than relying on a customer’s screen as proof.

Disclaimer

This article is for informational and educational purposes only and does not constitute legal or financial advice. Fraud statistics are based on data tabled in Parliament and figures reported by the Indian Cyber Crime Coordination Centre, and scam patterns continue to evolve over time. If you suspect fraud, contact your bank immediately and report it through the National Cyber Crime Reporting Portal or the 1930 helpline. This article does not identify any real individuals; examples used are illustrative composites based on commonly reported scam patterns.