Phishing via UPI Pay Request Scam — How to Identify & Stay Safe

INDIA — By BharatSecure Threat Intelligence Team · Updated May 29, 2026

Severity: CRITICAL | View Full Scam Details

Beware the Phishing via UPI Pay Request Scam in India 2026: How Fraudsters Target Your Money on WhatsApp

UPI’s growth in India brings convenience — but also fresh risks, especially phishing via fake UPI pay requests shared on WhatsApp and other platforms.

What Is the Phishing via UPI Pay Request Scam?

This scam involves fraudsters sending fake payment requests through UPI (Unified Payments Interface), often via WhatsApp messages or SMS, tricking victims into unknowingly authorizing payments. It targets millions of Indian users who rely on UPI apps like Google Pay, PhonePe, and Paytm for daily transactions. With UPI transactions crossing thousands of crores daily, scammers exploit users’ trust and limited digital literacy to steal money.

According to complaints reported to Indian cybercrime authorities including CERT-In and the Indian Cyber Crime Coordination Centre (I4C), this scam has become widespread since 2023 and remains critical in 2026. Victims often report losing tens of thousands of rupees in a single incident. The RBI and CERT-In have issued general advisories on UPI safety but warn that scamsters continuously devise new phishing methods, such as fake pay requests mimicking contacts or legitimate brands.

This scam is particularly dangerous because it combines social engineering with technical exploitation of the UPI system, bypassing many users’ initial skepticism about online payments.

How This Scam Works — Step by Step

1. Initial Contact via WhatsApp or SMS: Victims receive a message from a known or unknown contact. The message often claims to be urgent, like a payment request for settling a bill, booking, or product purchase. Fraudsters may impersonate friends or trusted businesses.

2. Fake UPI Payment Request Link: The message contains a UPI pay request link or QR code, usually generated to look authentic. Sometimes the request appears to come from a known contact’s UPI ID but is actually a cleverly spoofed ID.

3. Victim Clicks and Authorizes Payment: When the victim clicks the link, their UPI app opens with the payment request. The requested amount may be small but can escalate quickly with additional messages pressing for payment. The victim enters their UPI PIN, unknowingly authorizing a transaction.

4. Immediate Fund Transfer to Fraudsters: Once authorized, the money moves out of the victim’s bank instantly. Unlike bank transfers, UPI payments cannot be reversed easily if not authorized, leaving victims with little recourse.

5. Cover-up and Delay in Reporting: The scammer often cuts contact or blocks the victim, making recovery or investigation harder. Many victims delay reporting due to embarrassment or confusion.

Real Warning Signs to Watch For

• Unexpected payment requests from contacts or unknown numbers via WhatsApp or SMS.
• Requests with urgent language or pressure tactics (“Pay now, else order will be cancelled”).
• Payment requests for small unusual amounts to test if you are active.
• UPI IDs that look almost like trusted contacts but contain small spelling differences.
• Links or QR codes that lead to unofficial or non-UPI URLs before redirecting to payment.
• Messages asking you to share your UPI PIN or OTP (legitimate apps will never ask for this).
• Multiple payment requests in quick succession or linked to an event/business you did not transact with.

What Happens to Victims

Victims often lose money directly from their bank account linked to UPI, and recovery is difficult because UPI transactions are real-time and generally not reversible unless bank fraud is proven. Emotional distress also runs high due to financial loss and breach of trust, especially if the scam involved impersonation of friends or family.

In some cases, the victim’s Aadhaar-linked bank details risk exposure, increasing vulnerability to identity theft or linked frauds like SIM swapping. SIM swaps can compound losses if fraudsters gain control of the victim’s phone number to bypass OTP protections on other financial platforms.

Victims may also face hurdles in getting timely assistance due to slow grievance redressal mechanisms despite RBI and CERT-In helplines.

What RBI and CERT-In Say

The Reserve Bank of India (RBI) has repeatedly warned users to verify payee information before authorising UPI payments and NOT to share UPI PINs or OTPs with anyone. RBI emphasizes using official banking apps or trusted UPI apps downloaded from secure sources.

CERT-In (Indian Computer Emergency Response Team) and I4C advise vigilance against phishing messages on WhatsApp, SMS, or email and recommend reporting suspicious activity immediately. The 1930 cybercrime helpline is available for victims to seek help in filing complaints related to such scams.

Both authorities focus on user education, urging customers to double-check payment requests and report fraudulent messages to their bank and cybercrime portals like cybercrime.gov.in.

How to Protect Yourself

1. Never approve UPI payment requests from unknown numbers or suspicious contacts without verifying independently.
2. Check the UPI ID carefully for slight spelling changes before authorising payment.
3. Do not click on payment links sent via WhatsApp or SMS; always initiate payments from your official app.
4. Never share your UPI PIN, OTP, or any banking credentials over phone, SMS, or WhatsApp.
5. Set transaction limits in your bank or UPI app to reduce risk exposure.
6. Update your device and financial apps regularly to patch security vulnerabilities.
7. Use app locks or additional biometric authentication on your UPI app to prevent unauthorized access.

What to Do If You've Been Targeted

• Immediately contact your bank’s customer service and block or freeze your UPI payment facility.
• Change your UPI PIN and mobile number’s sim card if you suspect SIM swapping.
• Report the fraud case at the nearest police station and file a complaint on the cybercrime.gov.in portal.
• Call the 1930 cybercrime helpline for assistance and guidance on next steps.
• Document all messages, payment IDs, and transaction receipts related to the scam to help investigations.
• Notify your family or trusted contacts to be alert for any scam attempts impersonating you.
• Monitor your bank account and Aadhaar linking status regularly for unauthorized activity.

Frequently Asked Questions

Q: Can I get my money back if I approve a fake UPI payment request by mistake?
A: UPI transactions are usually final and irreversible unless there is clear evidence of fraud and prompt reporting. Immediately contact your bank and file a police complaint; recovery is difficult but possible with quick action.

Q: How can I verify if a UPI pay request is genuine?
A: Always cross-check with the person or business requesting payment using known contact details. Avoid clicking on links or approving requests without confirmation.

Q: What should I do if I receive multiple suspicious payment requests in a short time?
A: Do not approve any requests. Report them to your bank and block the sender. Inform local law enforcement and cybercrime helpline 1930 for assistance.

Stay alert to suspicious payment requests and fraudulent messages by verifying with BharatSecure.app — and always report scams to the 1930 helpline to protect yourself and others.

Disclaimer: This article describes a pattern of fraud reported in public sources for public-safety awareness. It is not legal, financial, or medical advice. To request correction or removal of any content, write to hello@bharatsecure.app.