UPI Payment Scams in India, How to Stay Safe in 2026

Here is the scam that catches more people than any other, and it takes about ninety seconds. You list something on a marketplace app. A buyer says they are sending the money and asks you to "accept the payment" by scanning a QR code they send you. You scan it, enter your UPI PIN to confirm you have received the money, and the money leaves your account instead. Software engineers fall for this one. It has nothing to do with how technical you are.

That is the thing about UPI scams: they don't need to be technically sophisticated. They just need you to be distracted for a minute. UPI now handles a very large share of everyday payments in India, and both the RBI and CERT-In have issued repeated advisories about payment fraud as that volume has grown. The creativity of these scams is honestly impressive, in the worst possible way.

Why UPI Fraud Is Exploding in India

UPI was a game-changer. Genuinely. The ability to send money instantly from any bank, SBI, HDFC, ICICI, Axis, Kotak, using just a phone number or VPA is remarkable infrastructure. But that same instant, irreversible nature is exactly what scammers exploit. Once money is sent, it's gone. There's no "cancel" button.

India runs a dedicated national cyber crime helpline on 1930 and a reporting portal at cybercrime.gov.in specifically because payment fraud has become common enough to need them. PhonePe, Google Pay and Paytm have all added in-app fraud warnings, but the scams keep evolving faster than the warnings do.

Here's what makes UPI fraud uniquely dangerous compared to credit card fraud: there's no chargeback. With a credit card, your bank can reverse a fraudulent charge. With UPI, the money moves instantly between bank accounts. Getting it back requires filing a police complaint, an investigation, and frankly, a lot of luck.

The Most Common UPI Scam Patterns Right Now

These are the patterns documented in public advisories from CERT-In, the RBI and NPCI, and in bank fraud warnings. They are grouped below by how they actually work.

1. The Fake Collect Request ("Refund" Scam)

This is the single most common UPI scam in India and it works because people don't fully understand how collect requests function. The scammer sends you a collect request through GPay, PhonePe, or Paytm, but labels it as a "refund" or "cashback." You see a notification that looks like money coming in, you enter your PIN thinking you're accepting a refund, and you've just authorised a payment going out.

The rule is simple: you never need to enter your UPI PIN to receive money. Ever. If someone asks you to enter your PIN to get money, it's a scam. Full stop.

2. The QR Code Scam

This one catches a lot of people on marketplace platforms. You're selling something on OLX or Facebook Marketplace. The "buyer" says they want to pay via UPI and sends you a QR code to scan to "receive payment." But scanning that QR code actually opens a payment screen, and if you enter your PIN, you're sending money to them.

There is no such "feature." You never scan a QR code to receive money. The buyer should scan your QR code or send to your UPI ID. That's it.

3. Fake Customer Support Calls

You complain about PhonePe or GPay on Twitter. Within minutes, you get a reply from an account that looks official, "PhonePe Support" or "Google Pay Help", asking you to DM your details. Or they call you claiming to be from your bank's UPI department. They'll ask for your UPI PIN, OTP, or ask you to install a screen-sharing app like AnyDesk or TeamViewer.

This one escalates fast. Complain publicly about a failed transaction on social media and a fake "customer care" account may reply within minutes, sounding helpful and official. The goal is to get you onto a call and then onto a remote-access app such as AnyDesk, at which point they can watch your screen while you enter your PIN. Genuine payment apps never ask you to install remote-access software.

No bank, no UPI app, no customer support agent will ever ask for your UPI PIN or OTP. If they do, hang up immediately.

4. The IRCTC / Electricity Bill Scam

You receive an SMS saying your IRCTC account will be deactivated, your electricity is about to be disconnected, or your KYC for GPay/PhonePe needs updating. The message includes a link to a fake website that looks exactly like the real one. You enter your bank details or UPI credentials, and that's all they needed.

5. The "Wrong Transfer" Scam

Someone sends you a small amount, ₹500 or ₹1,000, via UPI. Then they call you saying it was a mistake and ask you to send it back to a different UPI ID. Sometimes they claim to be a poor autorickshaw driver or a small shopkeeper. The original payment came from a stolen account or a fraud ring. By "returning" the money to a different account, you become part of a money laundering chain, and when the police trace the money, it leads to you.

If you receive an unexpected transfer, don't send money back. Tell the person to contact their bank for a reversal through proper channels.

Red Flags That Scream "UPI Scam"

Across the publicly documented cases, the same handful of signals turn up almost every time:

Urgency. "Do it now or your account will be blocked." "Offer expires in 10 minutes." "Your electricity will be cut off today." Scammers need you to act before you think. The moment someone pressures you to do something immediately with your UPI app, stop.

Requests for your PIN or OTP. Your UPI PIN is like your ATM PIN. Would you give your ATM PIN to a stranger who calls you? No. Same logic applies. No legitimate entity will ever ask for it.

QR codes or collect requests to "receive" money. This defies basic logic once you think about it, but in the moment, people fall for it. You do not need to authorise anything to receive a UPI payment. The money simply arrives.

Screen sharing requests. If anyone, claiming to be from your bank, Paytm, or GPay, asks you to install AnyDesk, TeamViewer, or QuickSupport, it's a scam. They want to watch your screen and capture your credentials.

Too-good-to-be-true offers. "Send ₹500 and get ₹5,000 cashback." "Win an iPhone, just pay ₹99 processing fee via UPI." These are as old as the internet, and they still work because people want to believe.

How to Protect Yourself, Practical Steps

Never enter your UPI PIN to receive money. I know I keep saying this. That's because it's the single thing that would prevent 80% of UPI scams if everyone understood it. Receiving money through UPI requires zero action from you. The money arrives. That's it.

Enable transaction notifications from your bank. SBI, HDFC, ICICI, and every major bank offer SMS and email alerts for every debit. Enable them. If money leaves your account without your knowledge, you'll know instantly.

Set UPI transaction limits. Most UPI apps let you set per-transaction and daily limits. If you typically don't transfer more than ₹10,000 at a time, set that as your limit. It won't stop fraud entirely, but it limits the damage.

Verify before you transact. If someone sends you a link via SMS or WhatsApp claiming to be from your bank, don't click it. Open your bank's official app directly. If you get a call from "customer support," hang up and call the number printed on the back of your debit card.

Check suspicious links before clicking. Got a link that claims to be from SBI, IRCTC, or your UPI app? Paste it into a URL checker first. Phishing sites look identical to real ones, the URL is the only giveaway.

Report spam collect requests. GPay, PhonePe, and Paytm all have options to block and report spam collect requests. Use them. It helps the platforms identify and block scam accounts faster.

What to Do If You've Been Scammed

Speed matters. The faster you act, the higher the chance of getting your money back. Here's the exact sequence:

Step 1: Call 1930 immediately. This is India's national cyber crime helpline, operational 24/7. Reporting quickly gives the best chance of a hold being placed on the recipient account before the money is moved on, which is why speed matters more than having all the details ready.

Step 2: File a complaint on cybercrime.gov.in. This creates an official record with the National Cyber Crime Reporting Portal. You'll get a complaint number, save it. You'll need it for everything that follows.

Step 3: Contact your bank. Call your bank's customer care (SBI: 1800-11-2211, HDFC: 1800-120-1243, ICICI: 1800-1080) and report the fraudulent transaction. The RBI's circular on limiting the liability of customers in unauthorised electronic banking transactions sets out when a customer bears no loss, and reporting promptly is central to it. How it applies depends on the circumstances, in particular whether the transaction was unauthorised or whether you were induced to authorise it yourself, which are treated differently. Ask your bank to confirm your position in writing and escalate to the RBI Ombudsman if you are not satisfied.

Step 4: Report within your UPI app. Open the transaction in GPay, PhonePe, or Paytm and use the "Report" or "Raise dispute" option. This flags the recipient's account for investigation.

Step 5: File an FIR at your local police station. Some police stations are still resistant to taking cybercrime FIRs. If that happens, you can file through cybercrime.gov.in and the complaint will be routed to the relevant jurisdiction.

Keep screenshots of everything, the transaction, the chat with the scammer, any SMS or emails received. This evidence is critical for investigation.

Frequently Asked Questions

The Bottom Line

UPI is incredible infrastructure, India genuinely leads the world here, and I don't say that lightly. But the speed and convenience that makes UPI brilliant is the same thing that makes fraud devastating. The money moves faster than your ability to reconsider. Every scam I've described above works not by hacking your phone, but by hacking your attention for sixty seconds. The single best defence isn't an app or a setting, it's the habit of pausing before you act. If someone's rushing you, that's your signal to slow down.