Fake Link-based UPI Payment Scam — How to Identify & Stay Safe

INDIA — By BharatSecure Threat Intelligence Team · Updated May 25, 2026

Severity: CRITICAL | View Full Scam Details

Beware the Fake Link-based UPI Payment Scam in India 2026: How to Stay Safe from WhatsApp Phishing Frauds

Scammers are using fake UPI payment links on WhatsApp and SMS to steal money from unsuspecting Indians — learn how this critical threat works and protect your digital wallet.

What Is the Fake Link-based UPI Payment Scam?

The Fake Link-based UPI Payment Scam is a rapidly growing cybercrime in India where fraudsters send deceptive messages via WhatsApp, SMS, or other social platforms. These messages often appear to be from well-known companies, e-commerce apps, or even trusted friends and family. But the key tactic is the inclusion of a link directing victims to fake UPI payment pages designed to steal their bank credentials or authorize unauthorized payments.

This scam targets everyday UPI users, especially those who often transact through popular platforms like Google Pay, PhonePe, Paytm, and BHIM UPI. It preys on the trust Indians place in digital payments and messaging apps due to their convenience and ubiquity. The scam’s reach is widespread — from metro cities like Delhi, Mumbai, and Bengaluru to smaller towns — reflecting the deep penetration of UPI in daily life.

Authorities such as the Reserve Bank of India (RBI), the Indian Computer Emergency Response Team (CERT-In), and the government’s Indian Cyber Crime Coordination Centre (I4C) have issued warnings about this scam type, classifying it as a critical fraud risk with a risk severity of 9/10. They emphasize increased user awareness as a front-line defense against such attacks.

How This Scam Works — Step by Step

1. Initial Contact
   You receive a WhatsApp message or SMS that looks official or comes from a known contact. The message might claim you’ve won a cashback, a gift voucher, or an exclusive deal. Sometimes, it might say your UPI transaction failed and needs reauthorization via a provided link.

2. Fake Link Click
   The message contains a link that, at first glance, looks similar to Google Pay, PhonePe, or Paytm payment pages. When you click this link, it takes you to a fraudulent site. The site may request you to enter your UPI PIN or bank details.

3. Request for Payment or Authorization
   The fake portal asks you to approve a payment or request your UPI PIN to "confirm your identity" or "claim your reward." This is the critical moment when your data is compromised.

4. Stealing Money or Data
   Using the PIN, the scammer initiates real UPI transactions from your bank account without your knowledge. Alternatively, the scam may capture your personal data, including your Aadhaar-linked information, to perform further fraud.

5. Victim Realizes Too Late
   By the time you realize money has been deducted, the scammer has already moved your funds. Reversing UPI payments is difficult as they are instant and authenticated via your UPI PIN.

Real Warning Signs to Watch For

• Messages urging immediate action with phrases like “Claim now” or “Limited time offer”
• Links with suspicious URLs that don’t match official payment app domains (e.g., misspelled or strange domain endings)
• Unexpected messages from unknown numbers or profiles claiming to be company representatives
• Requests for UPI PIN, OTP (One-Time Password), or personal financial information
• Messages claiming failed transactions requiring reauthorization via a link
• Offers that seem too good to be true, like large cashback or free gifts
• Use of poor grammar, incorrect spelling, or unusual formatting in official-sounding messages

What Happens to Victims

Victims of this scam face immediate financial loss as money is drained directly from their bank accounts linked to UPI apps. Unlike credit card fraud, where disputes and chargebacks are possible, UPI transactions are final and irreversible once authorized.

Beyond the financial hit, victims face emotional stress and anxiety. Many fear sharing the incident with family due to stigma or embarrassment. In some cases, fraudsters misuse Aadhaar-related data gathered via fake links to open fraudulent accounts or perform identity theft. Victims who fall prey to SIM swap attacks – where the culprit duplicates their mobile number – lose access to OTPs and face compounded risks.

Often, victims must spend weeks reporting frauds to their banks, filing FIRs at local police stations, and contacting CERT-In or I4C, leading to prolonged distress.

What RBI and CERT-In Say

The RBI has explicitly warned UPI users to never share their UPI PIN, OTP, or bank credentials with anyone, including through links in WhatsApp messages or emails. In its advisory, RBI stresses that UPI apps do not send links requesting personal information or PIN confirmation.

CERT-In advises users to verify message authenticity by directly visiting official apps or websites rather than clicking on unknown links. It recommends reporting suspicious messages immediately through the 1930 cybercrime helpline or filing complaints on the cybercrime.gov.in portal.

The Indian Cyber Crime Coordination Centre (I4C) urges users to exercise caution on social apps and avoid interacting with unverified contacts offering deals or gifts. The 24x7 helpline number 1930 is emphasized as a critical reporting channel for victims.

How to Protect Yourself

1. Ignore and Delete Suspicious Messages that ask for UPI PIN or click links promising gifts or cashback.
2. Never Share Your UPI PIN or OTP with anyone, under any pretense.
3. Verify Messages by Contacting Companies Directly through official customer support numbers or apps without clicking on links.
4. Use Official UPI Apps Only downloaded from Google Play Store or Apple App Store.
5. Enable App Lock and Biometric Security on your UPI apps for an extra layer of protection.
6. Regularly Check Bank Statements and UPI transaction histories for unauthorized payments.
7. Report Suspicious Links or Messages promptly to the 1930 helpline or CERT-In.

What to Do If You've Been Targeted

• Immediately block or freeze your bank or UPI app to prevent further transactions by contacting your bank’s customer care.
• Change your UPI PIN and app passwords without delay.
• File a complaint on cybercrime.gov.in and report your case with the 1930 cybercrime helpline.
• Inform your mobile network provider if you suspect SIM swapping to secure your mobile number.
• Lodge an FIR at your local police station describing the scam and provide all evidence, including screenshots.
• Monitor your bank and Aadhaar-linked services for unusual activity and alert the UIDAI helpline if you suspect Aadhaar misuse.

Frequently Asked Questions

Q1: Can I get my money back if I fall for the fake UPI payment link scam?
Unfortunately, UPI payments are generally irreversible once authorized with your PIN. However, approach your bank immediately for dispute resolution. RBI guidelines require banks to assist promptly but recovery is not guaranteed.

Q2: How can I confirm if a WhatsApp message about UPI payment is legitimate?
Always cross-check by opening your UPI app directly instead of clicking any links. Verify offers or alerts by contacting the company’s official customer care. Official messages usually do not ask for your PIN or OTP via links.

Q3: Is it safe to share any bank or personal data over WhatsApp during such transactions?
No. Never share your UPI PIN, OTP, Aadhaar number, or other sensitive financial information over WhatsApp or any messaging apps, even if it seems to be from a known contact.

Your safety is BharatSecure.app’s priority. Always verify suspicious messages, links, and offers before taking action. If in doubt, visit BharatSecure.app to check for the latest scam alerts and protect your hard-earned money. Stay alert, stay safe!