UPI Fraud: Types, Prevention and How to Report It in India

UPI fraud is the misuse of UPI payments, identities or related communication to steal money or gain access to a person’s bank account. It may involve a fraudulent collect request, QR code, fake payment confirmation, impersonation call, phishing link, screen-sharing app or compromised device.

UPI itself requires users to review and authorise transactions. Fraudsters therefore often rely on deception: they create urgency, pretend to be a trusted person or organisation, and persuade the user to approve a debit. Other cases may involve an unauthorised transaction after account or device access has been compromised.

The most important rule is simple: a standard incoming UPI payment does not require you to enter your UPI PIN. Entering the PIN authorises money to be debited from your account. Always read the transaction screen, beneficiary name and amount before approving anything.

Lost money through UPI fraud? Do this immediately

If money has already been transferred or debited:

1. Contact the bank and UPI app immediately through their official fraud-reporting channel.
2. Call the National Cybercrime Helpline at 1930 without delay.
3. File and track the complaint at cybercrime.gov.in.
4. Keep the UPI transaction or reference number, beneficiary UPI ID, amount, date, time, messages and screenshots ready.
5. Secure the affected bank, email, SIM and payment accounts from a trusted device.

Quick reporting can improve the chance of timely intervention, but it does not guarantee that the money will be recovered.

UPI fraud: quick safety checklist

Before approving a UPI payment or collect request, check the following:

• Did you initiate the transaction?
• Does the beneficiary name match the intended recipient?
• Are the amount and payment purpose correct?
• Are you being told to enter a UPI PIN to receive a refund, prize or incoming payment?
• Is someone pressuring you to act immediately or stay on a call?
• Were you asked to scan a QR code, install an app or share your screen to receive money?
• Are you relying on a screenshot instead of checking your own transaction history or bank account?

If anything appears inconsistent, cancel the request and verify the claim through an official channel.

What is UPI fraud and how is it done?

UPI fraud is any deceptive or unauthorised activity involving the Unified Payments Interface. Fraudsters may manipulate a victim into approving a debit, capture a UPI PIN or OTP, take control of a device, impersonate a trusted recipient, or misuse compromised account access.

The UPI system does not require a user to disclose the PIN to another person. Most scams work by changing how the victim interprets a normal payment action. A collect request is presented as incoming money, a payment QR code is described as a refund tool, or a debit approval is called an account-verification step.

Not every failed, delayed or disputed UPI transaction is fraud. A payment can remain pending or fail because of a technical issue. Fraud involves deception, unauthorised access or a deliberately false payment claim. This distinction matters because the next step differs:

• For a failed or pending legitimate transaction, use the complaint option in the UPI app or the official NPCI UPI Help service.
• For a suspected fraudulent or unauthorised transaction, immediately contact the bank or payment provider, call 1930 and report the incident at cybercrime.gov.in.

How does a UPI payment normally work?

UPI allows a person to send or receive money through a UPI app linked to a bank account. A payment can be initiated using a UPI ID, mobile number, QR code, saved beneficiary or another supported method.

When sending money, the payer should:

1. Enter or select the recipient’s UPI details.
2. Check the beneficiary name displayed by the app.
3. Enter the amount and review the transaction.
4. Enter the UPI PIN on the app’s authorised PIN screen to approve the debit.
5. Confirm the final status in the app and bank account.

The PIN is not a receipt code, refund code or verification number. It authorises a debit. A fraudster may describe the screen differently, but the transaction details shown by the app are what matter.

Common types of UPI fraud

1. Fraudulent UPI collect requests

A UPI collect request asks the recipient to approve a payment to the requester. Fraudsters may disguise it as a refund, cashback, prize, account verification or incoming payment. They then tell the victim to enter a UPI PIN to “accept” the money.

Approving the request actually sends money from the victim’s account. Never approve an unfamiliar collect request. Check who sent it, the amount and whether you were expecting to pay that person.

2. QR-code scams

A QR code can conveniently contain payment details, but scanning one usually begins a payment process. A scammer may claim that scanning a code will credit a refund, release a parcel payment or allow a buyer to send money.

Do not scan an unknown QR code merely to receive money. If the next screen asks for an amount or UPI PIN, you are likely authorising a debit. Cancel the transaction and verify the request independently.

3. Fake UPI payments and screenshots

A buyer may show a fake successful-payment screen, edited screenshot or fabricated message and pressure a seller to release goods or return an alleged excess payment. A notification sound or screenshot is not proof that money reached the account.

Check the transaction inside your own UPI app and bank statement. Confirm that the status is successful and that the amount has actually been credited. Do not rely on evidence controlled by the other person.

Also read: How to identify a fake UPI payment

4. Fake customer-care and refund calls

Fraudsters may place unofficial phone numbers on websites, advertisements or social-media pages and pretend to represent a bank, UPI app, merchant or delivery service. They may ask for an OTP or PIN, send a collect request, or persuade the person to install a remote-access app.

Use only the support option inside the official app or contact details published on the organisation’s verified website. Do not assume that a number appearing in search results is genuine.

5. Phishing links and fake UPI apps

A message may claim that KYC has expired, a reward is waiting or an account will be blocked. The linked page or app imitates a legitimate service and asks for credentials, payment information or device permissions.

Open the official UPI or banking app directly instead of using the link. Download financial apps only from the official app store and verify the developer and app name. 

For a deeper URL check, read DSN’s guide on how to identify a phishing link.

6. Screen-sharing and remote-access fraud

A supposed support agent may ask the victim to install a screen-sharing or remote-access app. Once access is granted, the fraudster may see messages, guide the victim through a transaction or capture sensitive information displayed on the device.

Banks and payment providers do not need remote control of a customer’s phone to issue a routine refund or resolve a complaint. End the call and contact the organisation using an official channel.

7. UPI ID impersonation

Fraudsters may create a UPI ID or payment profile that resembles a business, charity, friend or public figure. Similar spelling and a familiar profile name can make the identifier appear genuine at a glance.

Before paying, check the beneficiary name resolved by the app and confirm the UPI ID with the recipient through a trusted channel. A familiar-looking UPI ID alone is not proof of ownership.

8. Account or device takeover

If a fraudster gains control of a phone number, device, email account or banking credentials, they may attempt transactions without the account holder’s informed approval. Unexpected SIM disruption, new-device alerts, password-reset messages or unfamiliar UPI registrations should be treated seriously.

Contact the mobile operator and bank immediately through official channels. Secure the affected accounts from a trusted device and report any unauthorised transaction without delay.

How to identify a UPI fraud attempt

Look for a combination of the following warning signs:

• Someone says you must enter a UPI PIN to receive money.
• A buyer or support agent asks you to scan a QR code for a refund or credit.
• An unexpected collect request appears while you are on a call.
• The caller asks for an OTP, UPI PIN, password, card details or screen-sharing access.
• You are told that a small transfer is required to verify or activate your account.
• The beneficiary name does not match the person or organisation being claimed.
• A payment is shown only through a screenshot, SMS or sender-controlled app screen.
• The person objects when you try to verify the request through the official app, bank or merchant.
• The story changes after a payment, and another amount is demanded to release or recover the first one.

These are UPI-specific applications of broader scam behaviour. The difference is that the fraudster is trying to bring the victim to a payment-authorisation screen or gain access to the device or account used for UPI.

How to verify a UPI ID before sending money

A UPI ID check can reduce the risk of paying the wrong or impersonated account, but it cannot prove that the recipient is honest. Use the following process:

1. Enter the UPI ID only in your trusted UPI app. Avoid verification links or tools sent by an unknown person.
2. Read the beneficiary name shown by the app. It should reasonably match the intended recipient or business.
3. Confirm the UPI ID through another trusted channel. For a known person, use a saved phone number. For a business, use its official website, app, invoice or verified counter display.
4. Check the amount and purpose before authorising. A correct beneficiary does not make an unexpected or unclear request safe.
5. Use I4C’s suspect repository as an additional check when relevant. The National Cyber Crime Reporting Portal allows users to search reported identifiers, including UPI IDs. However, the absence of an identifier does not prove that it is safe because fraudsters can create or change accounts quickly.

Never enter a UPI PIN merely to “verify” an ID. A PIN entry authorises a transaction; it is not a general identity-check tool.

What is a transaction ID in UPI?

A UPI transaction ID or reference number identifies a specific transaction. Depending on the app and bank, users may also see labels such as transaction ID, UPI reference number, UTR or bank reference number.

The transaction details usually include:

• transaction or reference number;
• date and time;
• amount;
• payer and beneficiary details;
• status such as successful, pending or failed; and
• optional note or payment purpose.

Keep this information when raising a complaint. A transaction ID can help a bank, UPI app or authority trace the payment, but the existence of an ID does not by itself prove that a screenshot is genuine or that the recipient is trustworthy.

How to check UPI transaction status

To perform a UPI transaction status check:

1. Open the UPI app used for the payment.
2. Go to transaction history and select the relevant payment.
3. Review the status, amount, beneficiary and reference number.
4. Check the linked bank account or official bank statement for the corresponding debit or credit.
5. If the status remains pending or appears inconsistent, raise a complaint through the app or use the official NPCI UPI Help service.

Do not use an unknown website that asks for a UPI PIN, OTP or banking password to check a transaction. For a suspected fraud, checking the status is only one step; report it immediately instead of waiting for the transaction to update.

How to prevent UPI fraud

Use these habits every time you make or receive a UPI payment:

• Enter a UPI PIN only on the authorised PIN page of your trusted UPI app.
• Remember that a standard incoming payment does not require your UPI PIN.
• Review the beneficiary name, amount and purpose before approval.
• Decline unexpected collect requests and mandates.
• Do not scan a QR code to receive money from an unknown person.
• Confirm credits inside your own app and bank account rather than through screenshots.
• Never share your UPI PIN, OTP, password or card security details.
• Do not install remote-access or screen-sharing apps at a caller’s request.
• Keep the phone, UPI app and operating system updated.
• Use a device lock and protect the SIM and email account linked to banking services.
• Access customer support through the official app or verified website.
• Turn on transaction alerts and review them promptly.
• Discuss these patterns with family members who may be less familiar with UPI requests.

No checklist can eliminate every risk, but a consistent pause-and-review habit prevents many authorised-payment scams.

What to do if you become a victim of UPI fraud

Act immediately. Prompt reporting may help banks and authorities respond, although recovery cannot be guaranteed.

Step 1: Stop further transactions

Do not send more money, even if the fraudster claims that another payment will reverse the first one. End the call or chat and preserve the conversation before blocking the sender.

Step 2: Contact the bank and UPI app

Use the official in-app support option, bank website or verified helpline. Report the transaction as fraudulent or unauthorised and request the appropriate account-protection measures. Record the complaint or acknowledgement number.

RBI advises customers to notify their bank of unauthorised electronic transactions at the earliest because delay can increase the risk of loss.

Step 3: Call the cybercrime helpline at 1930

For cyber financial fraud in India, call 1930 as soon as possible. Provide accurate details about the transaction and follow the instructions given by the helpline.

Step 4: File a complaint at cybercrime.gov.in

Submit the complaint through the official National Cyber Crime Reporting Portal. Choose the financial-fraud reporting option and provide as much evidence as possible. Save the acknowledgement number so that the complaint can be tracked.

Step 5: Secure the affected accounts and device

From a trusted device, change affected banking, email and payment-app credentials where appropriate. Review active sessions and security settings. If a remote-access app was installed, disconnect the device and remove access safely. Contact the mobile operator if SIM compromise is suspected.

Step 6: Preserve evidence

Keep copies of:

• the UPI transaction ID, UTR or reference number;
• transaction date, time and amount;
• beneficiary name and UPI ID;
• bank and UPI-app complaint numbers;
• phone numbers, messages, emails and chat transcripts;
• suspicious URLs, QR codes, profiles or advertisements; and
• screenshots or recordings that were already available lawfully.

Do not alter the original evidence. Accurate information can help the bank and investigating authorities assess the incident.

Step 7: Escalate an unresolved service complaint appropriately

First complain to the concerned bank or regulated payment provider. If there is no response within the applicable period, or you are dissatisfied with the resolution, check eligibility to complain through the RBI Complaint Management System. Under the Reserve Bank–Integrated Ombudsman Scheme, the customer must generally approach the regulated entity first.

The cybercrime complaint and the bank-service complaint serve different purposes. Filing with one does not remove the need to notify the other where relevant.

Can money lost through UPI fraud be recovered?

Recovery may be possible in some cases, especially when the incident is reported quickly, but it is never guaranteed. The outcome depends on factors such as how the transaction occurred, how soon the bank and authorities were informed, whether funds can be traced or held, and the applicable liability and dispute rules.

For electronic banking transactions undertaken by customers of commercial banks on or after Jul 1, 2026 RBI’s updated directions require customers to notify the bank and report through the National Cyber Crime Reporting Portal or 1930 at the earliest. The directions provide zero liability where the bank is negligent and in specified third-party-breach cases reported to the bank within five calendar days. They also introduce conditional compensation for certain bona fide individual claims involving gross losses up to ₹50,000. Eligibility depends on the bank’s investigation, transaction classification and the detailed RBI conditions; it is not an automatic refund.

Other regulated bank categories may be governed by their applicable RBI directions and institutional policies. In every case, report immediately and retain the acknowledgement from the bank and cybercrime portal.

Do not trust a person or “recovery agent” who promises guaranteed recovery in exchange for an advance fee, OTP, UPI PIN or remote access. Such offers may be a second scam targeting people who have already suffered a loss.

FAQs

1. How are UPI frauds done?

UPI frauds are commonly carried out through deceptive collect requests, malicious QR-code instructions, fake payment confirmations, impersonation, phishing, screen sharing or compromised account access. The fraudster tries to make the victim authorise a debit or reveal information that enables a transaction.

2. Do I need to enter a UPI PIN to receive money?

No. A standard incoming UPI payment does not require the recipient to enter a UPI PIN. Entering the PIN authorises money to be debited from the account. Always read the transaction screen before approval.

3. What is a UPI collect request?

A UPI collect request asks you to approve a payment to another person or organisation. Approving it with your UPI PIN sends money from your account. Decline any collect request that you did not expect or cannot verify.

4. Can scanning a QR code credit money to my account?

Scanning a QR code usually begins a payment flow. Do not scan an unknown code or enter a UPI PIN because someone says it is required for a refund or incoming payment.

5. How can I check whether a UPI ID is fraudulent?

Enter the UPI ID in your trusted payment app, review the beneficiary name it resolves, and confirm the identifier with the recipient through an independent official or known channel. You can also check the UPI ID in I4C’s suspect repository, but no match does not prove that it is safe. Do not enter a UPI PIN simply to verify an ID.

6. How can I check a UPI transaction ID or status?

Open the transaction history in the UPI app, select the payment and review its status, amount, beneficiary and reference number. Cross-check the debit or credit in the linked bank account. Use official in-app support or NPCI UPI Help if a legitimate transaction remains unresolved.

7. How do I complain about a fraudulent UPI transaction?

Immediately contact the bank and UPI app through official channels, call the national cybercrime helpline at 1930, and file a complaint at cybercrime.gov.in with the transaction details and evidence.

8. Is a payment screenshot proof that money was sent?

No. Screenshots and messages can be edited or fabricated. Confirm the credit in your own UPI app and bank account before releasing goods, issuing a refund or treating the payment as complete.

9. Can I get my money back after the UPI fraud?

Recovery is possible in some cases but is not guaranteed. The bank will assess the facts, authorisation, reporting time and applicable rules. Report the transaction immediately, retain the acknowledgement and follow the formal complaint process.

10. Can the National Cyber Crime Reporting Portal verify a UPI ID?

The portal’s suspect repository allows users to check identifiers reported in earlier cybercrime complaints, including UPI IDs. A match is a warning signal, but no match does not guarantee that the identifier is safe.

Conclusion

UPI fraud often succeeds by making a normal payment screen appear to serve another purpose. A fraudster may call a debit a refund, describe a collect request as an incoming payment, or use a screenshot as false proof of credit. The safest response is to pause, read the transaction details and verify the recipient independently.

Never share a UPI PIN or OTP, and do not enter a PIN to receive money. If a fraudulent or unauthorised UPI transaction occurs, contact the bank and payment app, call 1930 and report it at cybercrime.gov.in immediately.