UPI fraud playbook: the 5 most common traps in India
Real patterns from recent cases — and the one rule that beats them all.
UPI moves more money in a month than most payment networks move in a year — over 18 billion transactions monthly. Scale like that attracts fraud at scale, and UPI scams have converged on a handful of repeatable scripts. Learn the five scripts and you’ve learned to recognize nearly every UPI scam in circulation, no matter what costume it wears.
Trap 1: The “request money” reversal
The script: You’re selling a sofa online. The “buyer” agrees instantly, says they’ve sent the money, and you receive a UPI notification. But it’s a collect request — approving it sends money, it doesn’t receive it. The scammer talks you through approving it “to receive the payment”, often with fake urgency: “It will expire! Approve fast!”
The tell: Receiving money on UPI never requires you to approve anything or enter your PIN. Ever. Any flow where you must act to “receive” a payment is a flow where you’re paying.
Trap 2: The fake payment screenshot
The script: Same marketplace setup, but the buyer sends a screenshot of a “successful” payment. Screenshots are free to fabricate — there are apps that generate them. The scammer collects the goods (or asks you to “refund an overpayment”) before you notice nothing arrived.
The tell: A screenshot is not a settlement. Money is only received when it appears in your app’s transaction history or your bank statement. Check your side, not theirs, and hand over nothing until you do.
Trap 3: The screen-share “helper”
The script: You post a complaint about a failed transaction. A “support agent” calls within hours — fraud rings monitor social media complaint threads. They walk you through installing a screen-sharing app “to fix the issue”, then watch you type your PIN, or guide you through a transfer while narrating it as a refund verification.
The tell: No bank, no payment app, no wallet company asks you to install AnyDesk, TeamViewer, or any screen-share app. The moment a “support” call requests one, you’re talking to the fraud department — theirs, not the bank’s.
Trap 4: The cashback / KYC phishing link
The script: An SMS or WhatsApp message: “₹4,999 cashback pending!” or “Your account will be blocked — complete KYC now.” The link opens a page that looks like your payment app or bank and asks for your UPI PIN, card details, or an OTP. Some variants deliver an APK file — a fake app that reads your SMS and drains accounts at leisure.
The tell: KYC is never completed through a link in a message, cashback never requires entering your PIN to receive it (see Trap 1), and no legitimate app arrives as an APK attachment on WhatsApp. Delete, block, report to 1930.
Trap 5: The wrong-number “accidental” transfer
The script: Money actually lands in your account — a few thousand rupees from a stranger. Then a call: “I sent it by mistake, please return it.” The catch: the incoming money is often from a stolen account or mule network, and your “refund” goes to the scammer’s own account. When the original theft is reported, the trail runs through you.
The tell: Real accidental transfers are reversed through the bank, not through you. If money appears mysteriously, don’t touch it — inform your bank and let them handle the reversal through official channels.
The one rule that beats all five
Every trap above, stripped of its costume, violates the same principle:
Entering your UPI PIN sends money. Approving a request sends money. Receiving money requires nothing from you at all.
Hold that one rule and the scripts fall apart on contact: the collect-request “payment” (Trap 1), the PIN-for-cashback page (Trap 4), the guided “refund” (Trap 3) — all of them need you to forget it for about thirty seconds.
If you do get hit: speed matters more than embarrassment. Call 1930 (the national cyber fraud helpline) or file at cybercrime.gov.in immediately — funds reported within the first hour are frozen at rates dramatically higher than funds reported the next day. Then notify your bank and your UPI app through their official support flows.
Share the rule with the people most targeted — new UPI users and older family members. One sentence, memorized, blocks the five most common financial scams in the country. Few security controls are that cheap.