Emerging Scams · India
UPI Scams in India
UPI made payments instant — and gave scammers a fast new rail. Here are the tricks they use, the one rule that stops most of them, and what to do if you’re hit.
Updated Aug 2026 · 7 min read
UPI request · ₹49,999
“Approve with your PIN to receive your refund.”
You list something for sale online. A keen buyer agrees to pay by UPI, sends a request, and tells you: “just enter your PIN to receive the money.” It feels normal — so you do it. And instead of receiving, you’ve just paid them.
That confusion between sending and receiving is at the heart of most UPI fraud. It’s a big business: the government reported ₹805 crore lost across 10.64 lakh UPI-fraud cases so far this financial year, while banks and the NPCI put the figure even higher — over ₹1,750 crore, up about 31% on the year.
The one rule that stops most UPI scams
You never enter your UPI PIN to receive money. A PIN is only ever needed to send it.
Receiving money — including refunds — is automatic and needs no PIN, no QR scan, and no approval. So if anyone asks you to enter your PIN, scan a QR, or approve a request “to receive,” they are trying to pull money out of your account.
The Common UPI Scams
The fake “collect request”
You’re “selling” something (OLX, Facebook Marketplace) or expecting a refund. The “buyer” sends a UPI request and says “enter your PIN to receive.” A request is a pull — approving it sends money FROM you. (India has been phasing out person-to-person collect requests since October 2025, but variations persist through merchant requests and apps.)
The QR “scan to receive”
They ask you to scan a QR code to get your money. Scanning a QR only ever makes a payment — it never receives one. Scammers also paste a fake QR sticker over a shop’s real one to divert your payment.
The fake payment screenshot
A “buyer” shows a screenshot proving they paid, and pressures you to hand over the item or cash. The screenshot is edited; no money ever arrived. Always check your own bank/app, never trust a screenshot.
The “KYC / PIN expiry” call
A caller says your UPI, bank KYC, or account is about to be blocked, and walks you into installing a “verification” app — often a screen-sharing app like AnyDesk that lets them watch you type your PIN.
Bank-impersonation SMS & links
A text that looks like it’s from your bank, with a short link to “update KYC” or “claim a refund.” The link leads to a fake page that steals your login, card, or OTP.
The refund / “sent by mistake” trick
Someone sends a message (sometimes with a small real transfer) claiming they paid you by accident, and presses you to “return” it — often to a different account, turning you into a money mule.
Got a Suspicious “Bank” Link or QR?
Paste the link into our checker before you tap it. It flags fake bank pages, typo-squats, and hidden destinations — the tricks behind UPI phishing SMS.
Open the QR & link checker →Five Rules That Keep You Safe
- 1
Never enter your UPI PIN to receive money — a PIN is only ever needed to SEND. Incoming money and refunds are automatic.
- 2
Never share your UPI PIN, OTP, card number, or CVV. No bank, NPCI, or genuine company will ever ask for them.
- 3
Never install a screen-sharing or remote-access app (AnyDesk, TeamViewer) because a “support” caller told you to.
- 4
Scan a QR only to PAY, never to receive. To get money, you just share your UPI ID or phone number.
- 5
Before paying, check the recipient’s name in your UPI app — and never trust a payment screenshot; verify in your own bank app.
Can You Get Your Money Back?
Honest answer: it depends almost entirely on how you paid and how fast you act. Speed is everything — report within hours, not days.
- Credit cardOften
You can dispute the charge (a “chargeback”) through your card network. The strongest protection of any payment type.
- Bank transfer, UPI or debit cardSometimes — if you’re fast
Report within hours so the bank can try to freeze the receiving account before the money is moved on. In India, call 1930 or file at cybercrime.gov.in immediately.
- Payment apps (Zelle, Venmo, Cash App, PayPal)Varies
Often treated like cash. PayPal “Goods & Services” has buyer protection; “friends & family” and most instant transfers usually don’t. Report to the app and your bank.
- Gift cardsRare
Contact the card issuer immediately — occasionally they can freeze an unredeemed balance. After that, it’s almost always gone.
- CryptocurrencyHardest — usually not
Crypto transfers are irreversible and cross-border. Recovery is rare, but act fast: report the transaction (with the wallet address and transaction hash) to the exchange involved and to law enforcement. If the funds land in a regulated exchange, it can sometimes freeze them.
What Actually Helps
- 1Act immediately — the faster you report, the better any chance of a freeze or reversal.
- 2Contact your bank, card issuer, or payment app now and ask them to dispute, recall, or freeze the payment.
- 3Report it to the authorities — here’s who to contact wherever you live. You often need a police or report reference number to pursue a dispute.
- 4Save everything: transaction IDs, wallet addresses, screenshots, phone numbers and usernames.
!Beware “recovery” scams
After you’ve been scammed, you may be contacted by someone promising to recover your money for an upfront fee, a “tax”, or a crypto payment. That is a second scam — often run by the same people, working from lists of known victims. No legitimate agency, lawyer, or service guarantees recovery or asks you to pay up front, and real police and banks never charge you to investigate. Never pay anyone to get your money back.
Where to Report — Wherever You Are
In India, call 1930 and tell your bank and UPI app immediately to block further transactions — reporting within hours gives the best chance of freezing the money. Reporting fast gives the best chance of freezing the money before it’s gone. Then file with your national authority:
India — Helpline 1930 · cybercrime.gov.in
Report in the first hours (the “golden hour”) to freeze funds. Run by I4C, Ministry of Home Affairs.
United States — FTC · FBI IC3
reportfraud.ftc.gov and ic3.gov.
United Kingdom — Action Fraud
actionfraud.police.uk · 0300 123 2040 (in Scotland, call Police Scotland on 101).
Australia — Scamwatch (National Anti-Scam Centre)
scamwatch.gov.au.
Canada — Canadian Anti-Fraud Centre
antifraudcentre-centreantifraude.ca · 1-888-495-8501.
Anywhere else: contact your bank and local police right away, and search “report a scam” plus your country. For cross-border cases, econsumer.gov collects international complaints. Beware anyone who later offers to “recover” your money for an upfront fee — that is a second scam.
Frequently Asked Questions
Do I ever need to enter my PIN to receive money?
No — never. Incoming payments and refunds credit automatically with zero action from you. If anyone asks you to enter your UPI PIN, approve a request, or scan a QR “to receive,” it is a scam designed to take money out of your account.
A buyer paid me but asks me to approve a request to “confirm” — is that safe?
No. That’s a collect request, and approving it with your PIN sends money FROM you, not to you. Decline it. To receive, you do nothing but share your UPI ID.
Is scanning a QR code to receive money safe?
No. Scanning a QR only ever initiates a payment. To receive money, you never scan anything — you simply give your UPI ID or number.
I’ve been scammed on UPI — what do I do first?
Call 1930 immediately (the sooner, the better chance of freezing the money), tell your bank and UPI app to block further transactions, and file a complaint at cybercrime.gov.in.
Also common in India: the “digital arrest” scam and fake QR codes. Browse all our scam guides.
Sources: Ministry of Finance data tabled in Parliament; NPCI and Reserve Bank of India safety guidance; Indian Cyber Crime Coordination Centre (I4C); 2025–2026 reporting. Figures are drawn from public reporting and should be verified against primary sources.