How to outsmart the new wave of UPI Scams — How to Identify & Stay Safe

INDIA — By BharatSecure Threat Intelligence Team · Updated Apr 30, 2026

Severity: MEDIUM | View Full Scam Details

Outsmarting the New Wave of UPI Scams in India 2026: Stay Ahead of Digital Fraud

UPI scams continue to evolve, targeting millions of Indians with clever tricks that can drain your bank account in minutes.

What Is the How to Outsmart the New Wave of UPI Scams?

UPI (Unified Payments Interface) has become the backbone of digital payments in India, enabling instant money transfers between bank accounts via apps like Google Pay, PhonePe, and Paytm. However, with over 8 billion UPI transactions recorded monthly, fraudsters have increasingly targeted users through sophisticated scam tactics dubbed as the “new wave of UPI scams.”

These scams mainly target everyday internet users who may not be fully aware of the latest fraud methods or who act quickly on payment requests without verification. Victims range from young professionals and small business owners to older adults who use UPI for grocery and utility payments. The India Cybercrime Coordination Centre (I4C), under the Ministry of Home Affairs, has noted a steady rise in these cases, especially involving WhatsApp and SMS phishing attempts.

The Reserve Bank of India (RBI), CERT-In (Indian Computer Emergency Response Team), and I4C have issued advisories highlighting the risks and advising users to stay alert. Despite awareness campaigns, such scams remain a medium-level risk with a 5/10 severity score because of their widespread impact combined with moderately complex fraud techniques.

How This Scam Works — Step by Step

1. Initial Contact via WhatsApp or SMS: The scam begins with a message pretending to be from a trusted source — often a friend, relative, or bank official. They send a link or a UPI payment request claiming urgency (e.g., “Please pay immediately for a delivery,” or “Your Aadhaar verification failed, resolve now”).

2. Link or QR Code Sharing: The message contains a fraudulent UPI payment link or a QR code. Victims are asked to scan or click to verify details or “approve” a transaction.

3. Fake UPI Interface: Clicking the link opens a fake UPI interface resembling Google Pay or PhonePe. The victim is asked to enter their UPI PIN or OTP under the guise of confirming identity or payment.

4. Stealing UPI PIN/OTP: The fraudsters capture this sensitive information instantly. They do not require your full bank details, just the UPI PIN and OTP.

5. Unauthorised Transactions: Using the stolen credentials, they initiate multiple transfers, often in small amounts (₹100-₹500) to avoid immediate detection but sometimes cumulatively draining the account.

6. Blocking Victim Communication: Fraudsters may block the victim on WhatsApp or stop responding to calls once transactions begin.

Real Warning Signs to Watch For

• Unexpected UPI payment requests or links from unknown or rarely contacted numbers.
• Messages that pressure you to act immediately or threaten consequences, like account freezing.
• Requests to share OTPs or enter UPI PINs on websites or apps — banks never ask this.
• Poor grammar or spelling mistakes in WhatsApp/SMS messages suggesting fraud.
• Sender pretending to be a bank official but using personal phone numbers instead of official channels.
• Messages asking you to “verify Aadhaar” or “link your bank to a new app” urgently.
• Requests for UPI payments via QR codes received directly in messages or calls.

What Happens to Victims

Victims often notice money disappearing from their bank accounts without their consent. In India’s UPI system, once a transaction is authorised using the UPI PIN and OTP, it cannot be reversed by the user. RBI guidelines allow limited banks to investigate cases of fraud, but many victims lose money permanently.

Besides financial loss, victims suffer emotional distress — trust issues around digital payments, anxiety over personal financial data compromise, and sometimes social stigma if scammers impersonate them to defraud others. Also, SIM swap fraud linked with UPI scams can lead to Aadhaar misuse or even loan fraud under the victim’s name, escalating the consequences.

What RBI and CERT-In Say

The RBI has repeatedly warned customers not to share UPI PIN or OTP with anyone under any circumstances. An official RBI circular in 2023 stressed that banks are not liable for losses if customers share their PIN or OTP willingly.

CERT-In recommends installing official apps only and updating them regularly. The 1930 cybercrime helpline has been set up by the Government of India to report UPI fraud cases immediately. RBI’s banking ombudsman and customer service portals are also avenues for reporting such frauds.

Together, these bodies urge vigilance and timely reporting to minimize losses and catch cybercriminals.

How to Protect Yourself

1. Never share your UPI PIN or OTP with anyone, even if the caller claims to be from your bank.
2. Verify payment requests directly with the sender before transferring any money, especially if it’s urgent.
3. Do not click on links or scan QR codes sent through WhatsApp or SMS unless you personally trust the source.
4. Use only official UPI apps from Google Play Store or Apple App Store and keep them updated.
5. Enable app lock or biometric authentication on your UPI apps to add extra security.
6. Check your bank account transactions regularly for any unauthorized payments and report immediately.
7. Register for mobile number porting blocking services with your telecom provider to avoid SIM swap fraud.

What to Do If You've Been Targeted

1. Immediately contact your bank’s customer helpline and request transaction blocking or account freezing.
2. Raise a complaint on cybercrime.gov.in — India’s national cybercrime reporting portal.
3. Call the 1930 cybercrime helpline to report the scam and seek guidance.
4. Inform the RBI banking ombudsman for grievance redressal if your complaint is not resolved.
5. Change all related passwords, UPI PINs, and enable two-factor authentication wherever available.
6. File a police complaint (FIR) at your local cybercrime police station; mention the incident details and any fraudulent messages.

Frequently Asked Questions

Q1: Can UPI transactions be reversed if I fall victim to a scam?
UPI transactions authorised with PIN and OTP typically cannot be reversed. However, you should report to your bank immediately; some banks may investigate and refund money in genuine fraud cases.

Q2: How does SIM swap impact UPI security?
SIM swap fraud allows criminals to receive your OTPs and calls, giving them access to UPI transactions. Register for mobile number porting blocking and alert your telecom operator to prevent this.

Q3: How to verify if a UPI payment request is genuine?
Always contact the requester through known phone numbers or in person before transferring money. Be cautious if the request comes with urgency or unusual payment instructions.

UPI is a powerful tool but only if used wisely. To stay safe from scams like this new wave targeting Indian users in 2026, verify every suspicious message or payment request at BharatSecure.app before you act. Protect your money and peace of mind today!