How UPI Fraud Actually Happens: The Five Warning Signs

Almost none of the money lost to UPI fraud involves anyone hacking anything. It relies entirely on the victim completing the transaction themselves, because that's the only way money can leave a UPI-linked account — which makes one specific feature of how UPI requests work worth understanding before anything else on this list.

The one fact that explains most UPI scams

UPI has always had two request types: a Pay request, where you send money and just need to confirm, and a Collect request, where someone else asks you to authorize sending them money, and it requires you to enter your UPI PIN to approve. NPCI discontinued person-to-person Collect requests entirely from October 1, 2025, specifically because this was the mechanism behind the classic fake-refund scam described below — Collect requests are now permitted only for registered merchants, not individuals. That closed off one major fraud route, but the underlying rule it existed to protect hasn't changed: entering your PIN never receives money, no matter what request type or app flow is asking for it, and fraud still almost entirely exploits people not noticing that.

Warning sign 1: a "refund" or "cashback" that requires your PIN

A refund or receiving money never requires you to enter your PIN, ever, under any circumstance, on any app. Before October 2025, this scam most often arrived as a fake Collect request disguised as a refund; with person-to-person Collect requests now discontinued by NPCI, a stranger can no longer send you one directly. What hasn't gone away is the underlying trick — a scam payment link, a fraudulently registered "merchant" account that can still send a Collect request, or a message that walks you through a scan-to-pay flow while calling it a "refund." Whatever form it takes, if entering your PIN is framed as necessary to receive money, that's the scam, not a step toward getting money.

Warning sign 2: QR codes for receiving payment

Scanning a QR code and entering your PIN is how you pay someone, it is never how you receive money. A common scam has a buyer on OLX or a similar marketplace ask a seller to scan a QR code to "receive" payment for an item, the seller scans it, enters their PIN thinking it confirms receipt, and instead sends money out.

Warning sign 3: requests to install a screen-sharing app

Fake customer care numbers (often found through fraudulent listings on search engines or fake social media "verified" support accounts) will walk a victim through installing a remote screen-sharing app like AnyDesk or TeamViewer under the pretext of "fixing" a banking app issue. Once installed, the scammer can see everything on your screen, including your PIN as you type it, or directly control your device. No genuine bank or UPI app support process requires installing a remote access app.

Warning sign 4: urgency plus an unfamiliar number

Fraud calls and messages consistently pair time pressure (your account will be blocked today, your KYC expires in an hour) with a request to act immediately via a link or a call to a number that isn't your bank's official listed number. Legitimate KYC updates happen through your bank's app, branch, or verified channels, not urgent unsolicited calls demanding immediate remote action.

Warning sign 5: being asked to share your UPI PIN, OTP, or app password over call or chat

No bank, UPI app, or NPCI representative will ever ask for your PIN, OTP, CVV, or app password over a phone call, SMS, or chat, for any reason, including "verification" or "reversing a wrong transaction." These are entered only inside the app during a transaction you initiated, this rule has no exceptions.

Why Voice Calls Feel More Convincing Than Text-Based Scams

A live voice call creates social pressure and urgency that a text message doesn't. A scammer speaking in a calm, official tone and using real banking terminology exploits the same trust cues that make a genuine bank call convincing. This is exactly why the source of the call matters more than how professional it sounds — sounding legitimate is trivially achievable with basic research and confidence, not proof of actual legitimacy.

The Specific Trap of 'Verify to Avoid Blocking' Messages

Messages claiming a UPI ID or bank account will be blocked unless you verify immediately through a provided link are almost always fraudulent, since account blocking for genuine compliance reasons goes through formal, traceable notices from the bank directly inside its own app or through registered communication channels, not a single urgent SMS with an embedded link demanding instant action.

Building the Habit of Checking the Request Type First

Before entering a PIN for any transaction, a two-second glance at whether the screen says 'Pay' or 'Collect' and to whom, instead of just tapping through a familiar-looking flow on autopilot, is the single habit that prevents the largest share of UPI fraud, since nearly every variant of this scam depends on the victim not noticing which request type they're approving.

What to do if you've already lost money

1. Call your bank's official helpline immediately, most support blocking or a dispute request for very recent transactions.
2. Report on the National Cyber Crime Reporting Portal (cybercrime.gov.in) or call 1930 within a few hours, as speed materially affects recovery chances.
3. Screenshot the transaction ID, UPI reference number, and any chat or call details for the complaint.

Every version of this fraud, the fake refund, the QR code, the screen-sharing app, the urgent call, comes back to the same single fact: your UPI PIN sends money, it never receives it. Any request that says otherwise is the scam, not a step toward fixing one.