New Wave of UPI Scams and How to Counter Them — How to Identify & Stay Safe

INDIA — By BharatSecure Threat Intelligence Team · Updated May 11, 2026

Severity: MEDIUM | View Full Scam Details

New Wave of UPI Scams in India 2026: How to Spot and Stop the Fraud

Beware: A new wave of UPI scams is targeting millions of Indians through WhatsApp, SMS, and fake apps that steal money by tricking users with fake bank and government messages.

What Is the New Wave of UPI Scams and How to Counter Them?

UPI (Unified Payments Interface) has revolutionized digital payments in India, with over 6 billion transactions every month. Unfortunately, scammers are exploiting its popularity by targeting everyday users with increasingly sophisticated fraud schemes. This latest wave of UPI scams surged in early 2026, affecting both tech-savvy urban users and rural individuals who use basic smartphones.

Fraudsters send fake messages via WhatsApp, Facebook, or SMS, pretending to be from your bank, the Reserve Bank of India (RBI), or government agencies like the UIDAI (Aadhaar authority). These messages often claim urgent account verification, rewards, or security updates, prompting users to share confidential details or click suspicious links.

The Indian Computer Emergency Response Team (CERT-In) and the Indian Cyber Crime Coordination Centre (I4C) have issued advisories warning citizens about these scams. The RBI also reminded users through helpline numbers and public notices to be vigilant against unsolicited communication related to bank accounts or UPI transactions.

How This Scam Works — Step by Step

1. Initial Contact: You receive a WhatsApp or SMS message that looks official, claiming to be from your bank or the government. It might say your UPI account needs urgent verification or you’ve won a cashback reward.

2. Creating Urgency: The message stresses urgency, pushing you to act immediately by clicking a link or calling a number.

3. Fake Websites or Apps: If you click the link, it leads to a website or app that looks almost identical to your bank’s official platform, asking you to enter your UPI PIN, OTP (One-Time Password), or personal details like your Aadhaar or PAN number.

4. Request for Access or Details: Sometimes the fraudster calls pretending to be a bank official, asking you to share OTPs you receive on your phone or confirm UPI transaction approvals.

5. Money Transfer: Using the stolen UPI PIN or OTPs, the scammer authorizes money transfers from your account to a fraud account, often in small increments to avoid detection.

6. Account Compromise: In more advanced cases, SIM swap fraud is done to gain control of your phone number and receive OTPs without you knowing.

Real Warning Signs to Watch For

• Messages demanding immediate action — “Verify now or account will be blocked.”
• Requests for your UPI PIN, OTP, or full bank details (no bank ever asks these).
• Links that don’t start with your bank’s official website domain — look for small changes or misspellings.
• Phone calls from unknown numbers claiming to be bank or government officials.
• Promises of unrealistic rewards or cashback offers requiring upfront information.
• Pressure to download unknown apps or fill forms with sensitive Aadhaar or PAN data.
• Multiple messages from the same number or social media profile, especially new or suspicious accounts.

What Happens to Victims

Victims often lose money totaling a few thousand INR to lakhs, depending on how long the scammer has access. Because UPI transactions are instant, RBI’s refund policies apply only if the customer reports the fraud promptly and there is no negligence.

The emotional toll is significant. Victims suffer anxiety over stolen identities, Aadhaar misuse, and financial loss. Many face difficulty regaining control over their phone numbers due to SIM swapping, causing further financial risks and disruption of essential services like banking and Aadhaar-based authentication.

What RBI and CERT-In Say

The RBI emphasizes never sharing your UPI PIN, OTP, or passwords with anyone, even if they claim to be bank officials. The central bank also advises users to keep their mobile device and banking apps updated.

CERT-In regularly alerts citizens about social engineering frauds and fake apps and urges reporting suspicious activity to the 1930 national cybercrime helpline. The I4C collaborates with law enforcement to dismantle scam networks and spread public awareness about evolving tactics.

If you encounter suspicious communication, the RBI helpline (1800-1200-234) and CERT-In’s 1930 cybercrime helpline are your immediate contacts.

How to Protect Yourself

1. Never Share UPI PIN or OTP: Banks and RBI officials never ask for these details over calls or messages.
2. Verify the Source: Check sender numbers, website URLs, or app publishers carefully.
3. Avoid Clicking Unknown Links: Don’t open links from unsolicited WhatsApp, SMS, or Facebook messages.
4. Use Official Apps Only: Download banking apps directly from your phone’s official app store.
5. Enable App Lock and Screen Security: Protect your UPI apps with a strong password or biometrics.
6. Check Your Bank Statements Regularly: Immediately report any unauthorized transactions.
7. Register Your Mobile Number With UIDAI: Linking Aadhaar securely can reduce SIM swap risks.

What to Do If You've Been Targeted

1. Immediately Block UPI Transactions: Use your bank app or visit your branch to temporarily disable UPI.
2. Report to Your Bank: Inform the bank’s fraud department about the transaction.
3. Call the 1930 Cybercrime Helpline: File a complaint with CERT-In and get guidance for recovery.
4. File a Police Complaint: Register FIR at your local cybercrime police station.
5. Report on cybercrime.gov.in: The Government of India’s portal allows online reporting of digital fraud.
6. Change All Passwords: Update passwords for your banking apps, email, and mobile number PINs.
7. Notify the Mobile Service Provider: If SIM swap is suspected, inform your telecom operator immediately to block your number.

Frequently Asked Questions

What should I do if I accidentally shared my UPI PIN or OTP?
Immediately block your UPI service through your bank’s app or customer care. Report the incident to your bank and file a complaint with the 1930 cybercrime helpline to increase chances of recovery.

Can RBI recover money lost in UPI scams?
RBI may intervene if the fraud is reported quickly and no negligence is proven. However, timely reporting and proof of fraud are essential for any refund claim.

Is it safe to download banking apps from third-party app stores?
No. Always download banking or payment apps from official Google Play Store or Apple App Store to avoid fake or malicious versions.

—

Stay alert. If you get a suspicious WhatsApp message or call about your UPI transactions, don’t rush. Verify every detail before you act. Visit BharatSecure.app today to check if a message or link is safe and protect yourself from falling victim to scams.