UPI Payment Scams in India, How to Stay Safe in 2026

A friend of mine in Pune lost ₹47,000 last month. Not to a hacker. Not to some zero-day exploit. A guy on OLX told him he was sending money for a second-hand laptop and asked my friend to "accept the payment" by scanning a QR code. My friend scanned it, entered his UPI PIN to "confirm the receipt," and the money went straight out of his HDFC account. The whole thing took ninety seconds. He's a software engineer.

That's the thing about UPI scams: they don't need to be technically sophisticated. They just need you to be distracted for a minute. India processed over 130 billion UPI transactions in 2025, and the RBI has been flagging a sharp rise in fraud complaints. I've been tracking the patterns coming through our scanner, and the creativity of these scams is honestly impressive, in the worst possible way.

Why UPI Fraud Is Exploding in India

UPI was a game-changer. Genuinely. The ability to send money instantly from any bank, SBI, HDFC, ICICI, Axis, Kotak, using just a phone number or VPA is remarkable infrastructure. But that same instant, irreversible nature is exactly what scammers exploit. Once money is sent, it's gone. There's no "cancel" button.

The numbers tell the story. CERT-In reported a 300% increase in UPI-related fraud complaints between 2023 and 2025. The national cyber crime helpline, 1930, receives thousands of UPI fraud calls daily. PhonePe, GPay, and Paytm have all added fraud warnings, but the scams keep evolving faster than the warnings.

Here's what makes UPI fraud uniquely dangerous compared to credit card fraud: there's no chargeback. With a credit card, your bank can reverse a fraudulent charge. With UPI, the money moves instantly between bank accounts. Getting it back requires filing a police complaint, an investigation, and frankly, a lot of luck.

The Most Common UPI Scam Patterns Right Now

These aren't hypothetical scenarios. These are patterns we see repeatedly, reported by users, flagged by banks, and documented in CERT-In advisories. I've grouped them by how they actually work.

1. The Fake Collect Request ("Refund" Scam)

This is the single most common UPI scam in India and it works because people don't fully understand how collect requests function. The scammer sends you a collect request through GPay, PhonePe, or Paytm, but labels it as a "refund" or "cashback." You see a notification that looks like money coming in, you enter your PIN thinking you're accepting a refund, and you've just authorised a payment going out.

The rule is simple: you never need to enter your UPI PIN to receive money. Ever. If someone asks you to enter your PIN to get money, it's a scam. Full stop.

2. The QR Code Scam

This one catches a lot of people on marketplace platforms. You're selling something on OLX or Facebook Marketplace. The "buyer" says they want to pay via UPI and sends you a QR code to scan to "receive payment." But scanning that QR code actually opens a payment screen, and if you enter your PIN, you're sending money to them.

There is no such "feature." You never scan a QR code to receive money. The buyer should scan your QR code or send to your UPI ID. That's it.

3. Fake Customer Support Calls

You complain about PhonePe or GPay on Twitter. Within minutes, you get a reply from an account that looks official, "PhonePe Support" or "Google Pay Help", asking you to DM your details. Or they call you claiming to be from your bank's UPI department. They'll ask for your UPI PIN, OTP, or ask you to install a screen-sharing app like AnyDesk or TeamViewer.

I've seen this one escalate dramatically. One user in Chennai posted about a failed transaction on Twitter. A fake "Paytm Care" account responded within four minutes, got him to install AnyDesk, and drained ₹1.8 lakh from his SBI account while watching his screen.

No bank, no UPI app, no customer support agent will ever ask for your UPI PIN or OTP. If they do, hang up immediately.

4. The IRCTC / Electricity Bill Scam

You receive an SMS saying your IRCTC account will be deactivated, your electricity is about to be disconnected, or your KYC for GPay/PhonePe needs updating. The message includes a link to a fake website that looks exactly like the real one. You enter your bank details or UPI credentials, and that's all they needed.

5. The "Wrong Transfer" Scam

Someone sends you a small amount, ₹500 or ₹1,000, via UPI. Then they call you saying it was a mistake and ask you to send it back to a different UPI ID. Sometimes they claim to be a poor autorickshaw driver or a small shopkeeper. The original payment came from a stolen account or a fraud ring. By "returning" the money to a different account, you become part of a money laundering chain, and when the police trace the money, it leads to you.

If you receive an unexpected transfer, don't send money back. Tell the person to contact their bank for a reversal through proper channels.

Red Flags That Scream "UPI Scam"

After analysing thousands of reported scams, these are the patterns I see every single time:

Urgency. "Do it now or your account will be blocked." "Offer expires in 10 minutes." "Your electricity will be cut off today." Scammers need you to act before you think. The moment someone pressures you to do something immediately with your UPI app, stop.

Requests for your PIN or OTP. Your UPI PIN is like your ATM PIN. Would you give your ATM PIN to a stranger who calls you? No. Same logic applies. No legitimate entity will ever ask for it.

QR codes or collect requests to "receive" money. This defies basic logic once you think about it, but in the moment, people fall for it. You do not need to authorise anything to receive a UPI payment. The money simply arrives.

Screen sharing requests. If anyone, claiming to be from your bank, Paytm, or GPay, asks you to install AnyDesk, TeamViewer, or QuickSupport, it's a scam. They want to watch your screen and capture your credentials.

Too-good-to-be-true offers. "Send ₹500 and get ₹5,000 cashback." "Win an iPhone, just pay ₹99 processing fee via UPI." These are as old as the internet, and they still work because people want to believe.

How to Protect Yourself, Practical Steps

Never enter your UPI PIN to receive money. I know I keep saying this. That's because it's the single thing that would prevent 80% of UPI scams if everyone understood it. Receiving money through UPI requires zero action from you. The money arrives. That's it.

Enable transaction notifications from your bank. SBI, HDFC, ICICI, and every major bank offer SMS and email alerts for every debit. Enable them. If money leaves your account without your knowledge, you'll know instantly.

Set UPI transaction limits. Most UPI apps let you set per-transaction and daily limits. If you typically don't transfer more than ₹10,000 at a time, set that as your limit. It won't stop fraud entirely, but it limits the damage.

Verify before you transact. If someone sends you a link via SMS or WhatsApp claiming to be from your bank, don't click it. Open your bank's official app directly. If you get a call from "customer support," hang up and call the number printed on the back of your debit card.

Check suspicious links before clicking. Got a link that claims to be from SBI, IRCTC, or your UPI app? Paste it into a URL checker first. Phishing sites look identical to real ones, the URL is the only giveaway.

Report spam collect requests. GPay, PhonePe, and Paytm all have options to block and report spam collect requests. Use them. It helps the platforms identify and block scam accounts faster.

What to Do If You've Been Scammed

Speed matters. The faster you act, the higher the chance of getting your money back. Here's the exact sequence:

Step 1: Call 1930 immediately. This is India's national cyber crime helpline, operational 24/7. They can initiate a hold on the recipient's account if you report fast enough. I've seen cases where money was recovered because the victim called within 15 minutes.

Step 2: File a complaint on cybercrime.gov.in. This creates an official record with the National Cyber Crime Reporting Portal. You'll get a complaint number, save it. You'll need it for everything that follows.

Step 3: Contact your bank. Call your bank's customer care (SBI: 1800-11-2211, HDFC: 1800-120-1243, ICICI: 1800-1080) and report the fraudulent transaction. Under RBI's circular on limiting liability, if you report within 3 working days, the bank is liable to credit the amount back if the fraud is confirmed.

Step 4: Report within your UPI app. Open the transaction in GPay, PhonePe, or Paytm and use the "Report" or "Raise dispute" option. This flags the recipient's account for investigation.

Step 5: File an FIR at your local police station. Some police stations are still resistant to taking cybercrime FIRs. If that happens, you can file through cybercrime.gov.in and the complaint will be routed to the relevant jurisdiction.

Keep screenshots of everything, the transaction, the chat with the scammer, any SMS or emails received. This evidence is critical for investigation.

Frequently Asked Questions

The Bottom Line

UPI is incredible infrastructure, India genuinely leads the world here, and I don't say that lightly. But the speed and convenience that makes UPI brilliant is the same thing that makes fraud devastating. The money moves faster than your ability to reconsider. Every scam I've described above works not by hacking your phone, but by hacking your attention for sixty seconds. The single best defence isn't an app or a setting, it's the habit of pausing before you act. If someone's rushing you, that's your signal to slow down.