Common UPI Scams in India 2026 — How to Identify & Stay Safe

INDIA — By BharatSecure Threat Intelligence Team ·

Severity: MEDIUM | View Full Scam Details

Common UPI Scams in India 2026: How Fraudsters Steal From You

UPI has transformed digital payments in India — but it has also become the #1 target for cybercriminals. This guide covers the 8 most active UPI fraud patterns in 2026, with real examples and protection tips.

1. Fake Collect Request Scam

Scammers send UPI collect requests disguised as refunds or cashbacks. Victims approve thinking they will receive money, but instead lose it instantly.

How it works: You receive a collect request saying "Refund of Rs 5,000 from Flipkart". Clicking Pay debits your account immediately.

How to stay safe: Never approve collect requests from unknown sources. Receiving money NEVER requires you to enter a PIN. BharatSecure flags collect request scam patterns by analyzing message text for refund + collect triggers.

2. Malicious QR Code Scam

Fraudsters share QR codes claiming you need to scan them to receive money. In reality, scanning a QR code always initiates a payment, never a receipt.

How it works: An OLX seller says "Scan this QR to receive advance payment". Scanning actually debits Rs 10,000 from your account.

How to stay safe: QR codes are ONLY for paying, never for receiving. If someone asks you to scan a QR to receive money, it is 100% a scam.

3. OTP Phishing via Fake Bank Calls

Scammers impersonate SBI, HDFC, or ICICI bank officials and pressure victims into sharing OTPs, claiming the account will be blocked.

How it works: A call arrives from the "SBI fraud department": "Your account is compromised. Share OTP to secure it." They use the OTP to drain your account.

How to stay safe: Banks NEVER ask for OTP over phone or SMS. Hang up immediately and call your bank's official helpline.

4. Fake UPI Apps and Screen Mirroring

Fraudsters trick victims into installing fake apps (modified GPay or PhonePe clones) or screen-sharing apps like AnyDesk to steal credentials in real time.

How it works: You are asked to install a "GPay Support Tool" which is actually a screen-mirroring app. Scammers watch you enter your PIN.

How to stay safe: Only install UPI apps from official Google Play Store or Apple App Store. Never install apps from links sent via WhatsApp or SMS.

5. Micro-Transaction Splitting Attack

A 2026 scam pattern where fraudsters make multiple tiny transactions (Rs 1-10) to test if your UPI is active, then execute a large debit.

How it works: You see 5-6 small debits of Rs 2-5. Before you react, Rs 49,999 is debited. The micro-transactions were probing your account limits.

How to stay safe: Set UPI transaction alerts for ALL amounts, even Rs 1. Report any unauthorized micro-transactions to your bank immediately.

6. Job Offer and Lottery UPI Scam

Fake job offers or lottery wins ask for registration fees or tax payments via UPI before releasing the prize or salary.

How it works: A WhatsApp message reads "You won Rs 25 lakh! Pay Rs 5,000 processing fee via UPI." Or "Amazon hiring: Pay Rs 500 for training kit."

How to stay safe: Legitimate employers never ask for fees. Lottery wins do not require advance payments. If you did not enter a lottery, you cannot win one.

7. SIM Swap and UPI Takeover

Scammers social-engineer your mobile operator into issuing a duplicate SIM. Once they control your number, they reset your UPI PIN and drain your accounts.

How it works: Your phone suddenly loses network signal. Meanwhile, the scammer has your number, resets GPay PIN, and transfers all funds within minutes.

How to stay safe: Enable SIM lock with your carrier. If your phone loses signal unexpectedly, call your carrier IMMEDIATELY from another phone.

8. Social Engineering via WhatsApp

Scammers impersonate friends or family on WhatsApp with fake profiles, claiming emergency and requesting urgent UPI transfers.

How it works: "Hi Papa, my phone broke. This is my new number. Please send Rs 20,000 urgently for laptop repair." — sent from an unknown number with your child's photo.

How to stay safe: Always verify by calling the person's original number. Ask a personal question only they would know before transferring any money.

How BharatSecure Protects You

Paste any suspicious UPI message, collect request, or QR code link into BharatSecure.app. Our AI cross-references your input against thousands of reported scam templates across India in real time.

Verify Any Suspicious Message

Check any suspicious message, link, or call for free at bharatsecure.app.