The 8 most common UPI scams in India, the warning signs for each, and exactly what to do, and in what order, if you’ve been cheated

UPI has made paying for anything, from vegetables to rent, as easy as scanning a QR code. But that convenience has also made UPI scams a growing problem. According to the Finance Ministry, Indians reported 10.64 lakh UPI fraud incidents worth ₹805 crore in just the first eight months of 2025-26. The good news is that most UPI scams follow a handful of patterns, and once you know them, they’re easy to spot. Here’s how the most common UPI scams work, the red flags to watch for, and what to do immediately if you lose money.

Quick Answer

Most UPI scams rely on one trick: getting you to enter your UPI PIN, share an OTP or install a screen-sharing app. Remember the golden rule: you never need your UPI PIN to receive money. Common UPI scams include fake refunds, AutoPay mandate traps, swapped QR codes, fake KYC calls and messages from “relatives” asking for urgent money. If you lose money, call the national cybercrime helpline 1930 immediately, report on the National Cyber Crime Reporting Portal (cybercrime.gov.in), and inform your bank. Reporting within the first few hours gives you the best chance of getting money frozen and returned.

The Golden Rule of UPI

Before looking at specific UPI scams, remember this:

Your UPI PIN is only for sending money. You never need it to receive money.

If anyone asks you to enter your PIN to “receive” a payment, refund, prize or cashback, it’s a scam. Every time.

8 Common UPI Scams and How to Spot Them

1. The “Enter PIN to Receive Money” Scam

This is one of the oldest UPI scams. A “buyer” on OLX or a “company” offering a refund sends you a payment request and asks you to enter your PIN to receive the money. Entering the PIN actually sends money from your account.

Good news: since October 1, 2025, NPCI has stopped person-to-person collect requests on UPI, which removed the most common version of this scam, according to The Week. But scammers still use merchant payment requests and fake payment links, so the golden rule still applies.

Red flag: any request to enter your PIN to receive money.

2. The AutoPay Mandate Trap

You’re asked to “verify” your account, claim a prize or confirm a delivery with a small ₹1 payment. In reality, you’re approving a recurring AutoPay mandate that lets the scammer debit your account daily, weekly or monthly.

Red flag: like many UPI scams, it hides the real action. The approval screen shows a frequency such as Daily, Weekly or Monthly. Check now: open your UPI app, go to AutoPay / Mandates, and cancel anything you don’t recognise.

3. The Swapped QR Code

In one of the simplest UPI scams, fraudsters stick their own QR code over a shop’s real one at petrol pumps, parking lots or small stores, so your payment goes to them.

Red flag: the name shown before you pay doesn’t match the shop. Always check the name before entering your PIN.

4. The “KYC Expired” Call

This is one of the most damaging UPI scams. A caller claims to be from your bank and says your account or SIM will be blocked unless you update your KYC. They ask you to install an app like AnyDesk or TeamViewer QuickSupport, which lets them see your screen and steal your OTPs.

Red flag: any request to install a screen-sharing app. Banks never ask you to do this, and they never ask for your PIN or OTP.

5. The Fake Bank SMS Link

You get an SMS saying your account will be blocked “within 2 hours” unless you click a link. The link opens a fake banking page that captures your details.

Red flag: short links (like bit.ly), spelling mistakes and urgent deadlines.

6. The “Sent You Extra Money” Refund Scam

Someone sends you a small amount, or just a fake payment screenshot or SMS, then says they sent too much by mistake and asks you to return the difference.

Red flag: pressure to refund based on a screenshot. Check your bank balance or statement, not a message, before sending anything back.

7. The “New Number” Family Scam

A WhatsApp message from an unknown number uses a relative’s or friend’s photo and says: “This is my new number, I need money urgently.”

Red flag: an urgent money request from a new number. Always call the person on their old number first.

8. The Fake Investment or Task Scam

These are among the costliest UPI scams. Strangers on WhatsApp, Telegram or social media promise high returns from trading, “liking videos” or online tasks. You see fake profits, but must keep paying “fees” or “taxes” to withdraw.

Red flag: guaranteed high returns, or paying money to get your own money out.

What to Do If You Fall for a UPI Scam

With UPI scams, speed matters. Follow these steps in this order:

1. Call 1930 immediately. This is the National Cybercrime Helpline. Reporting within the first few hours, often called the “golden hour”, gives authorities the best chance to freeze the money before it’s withdrawn.
2. File a complaint on cybercrime.gov.in, the National Cyber Crime Reporting Portal. Note down your complaint number.
3. Inform your bank and UPI app (PhonePe, Google Pay, Paytm and so on) through their official app or helpline. Ask them to block your UPI and report the transaction as fraud.
4. Change your UPI PIN and passwords, and uninstall any screen-sharing app you installed.
5. Keep evidence: screenshots of messages, the UPI transaction ID, the scammer’s number and UPI ID.

Report quickly to protect your money: under RBI’s rules on unauthorised electronic transactions, reporting fraud to your bank within three working days gives you the strongest protection. If the fraud happened because of a security breach on the bank’s or system’s side, and not because you shared your PIN or OTP, you may not have to bear the loss.

Got a Suspicious Call or SMS? Report It on Chakshu

If you receive a suspicious call, SMS or WhatsApp message but haven’t lost money, report it on Chakshu, a facility on the Department of Telecommunications’ Sanchar Saathi portal. According to Outlook Money, DoT verifies these reports and can disconnect fraudulent numbers.

• Chakshu: for suspected fraud calls and messages, before any loss
• 1930 / cybercrime.gov.in: for fraud where money has already been lost

7 Settings to Protect Yourself From UPI Scams

1. Set an app lock (fingerprint or PIN) on every UPI app
2. Lower your daily UPI limit in your app or bank settings if you don’t need a high limit
3. Check AutoPay / Mandates every month and cancel unknown ones
4. Turn on SMS and app alerts for every transaction
5. Use only one or two UPI apps you trust, from the official app store
6. Never share your UPI PIN, OTP or screen with anyone
7. Link a separate bank account with a smaller balance for daily UPI spending
8. Also lock your private chats. See: How to Lock WhatsApp Chats.

Also read: CERT-In Warns of API Attacks

Frequently Asked Questions

What are the most common UPI scams in India?
The most common UPI scams are fake “enter PIN to receive money” requests, AutoPay mandate traps, swapped QR codes, fake KYC calls with screen-sharing apps, fake bank SMS links, refund scams, “new number” family scams and fake investment schemes.

Do I need my UPI PIN to receive money?
No. Your UPI PIN is only needed to send money. Anyone asking for your PIN to receive money is trying to scam you.

What should I do immediately after a UPI fraud?
Call 1930, the National Cybercrime Helpline, as soon as possible, then file a complaint on cybercrime.gov.in and inform your bank.

Can I get my money back after a UPI scam?
Sometimes. If you report quickly, authorities may be able to freeze the money in the scammer’s account. Reporting to your bank within three working days also gives you the strongest protection under RBI rules.

Where can I report a suspicious call or SMS?
Report it on Chakshu, on the Sanchar Saathi portal of the Department of Telecommunications.

Conclusion

UPI scams cost Indians hundreds of crores every year, but almost all of them depend on one mistake: entering your PIN, sharing an OTP or giving someone access to your screen. Remember that you never need your PIN to receive money, always check the payee name before paying, and never install apps at a stranger’s request. If something does go wrong, call 1930 immediately, report on cybercrime.gov.in and inform your bank. Spotting UPI scams early, and reporting them fast, is the best way to keep your money safe.

My take: In my view, the most dangerous UPI scams are the ones that exploit fear, urgency and trust, because they can deceive even the most careful people. I would urge every family to adopt one simple habit: always verify any unexpected payment request before acting on it. Never share your UPI PIN or OTP, never install a screen-sharing app because a stranger asks you to, and never trust a payment screenshot without checking your own bank account. If fraud does happen, report it immediately by calling 1930, contacting your bank and filing a complaint on the official cybercrime portal.

One more important tip: whenever you pay with an OTP, read the OTP message carefully and check that the amount matches what you intend to pay. This once happened to me. I was buying something online through a link and was supposed to pay ₹200. I received the OTP and completed the payment as usual, but almost immediately I saw that ₹20,000 had been deducted from my bank account. When I checked the OTP message again, it was for ₹20,000. That’s why we need to stay alert even when paying with an OTP.

Digital safety begins with awareness, but acting quickly can greatly reduce your losses. I would conclude by saying: “In the digital world, a moment of verification can protect years of savings. Pause, verify, and then pay.”

Over to You

Have you or someone you know ever received a UPI scam call or message? Share how you spotted it in the comments below, and help others stay safe.