RBI's Measures to Protect UPI Payments — How to Identify & Stay Safe

INDIA — By BharatSecure Threat Intelligence Team · Updated May 26, 2026

Severity: MEDIUM | View Full Scam Details

RBI’s Measures to Protect UPI Payments Scam in India 2026: Stay Alert to Secure Your Money

Beware of fake messages claiming to be RBI’s official steps to secure your UPI payments — scammers are using this tactic to steal your money.

What Is the RBI’s Measures to Protect UPI Payments Scam?

This scam revolves around fraudsters impersonating the Reserve Bank of India (RBI) or related authorities, claiming they have launched new “measures” to further protect UPI transactions. Scammers send messages or create posts on WhatsApp, Facebook, and through SMS, promising enhanced security features or exclusive cashback offers linked to RBI’s new UPI safety protocols. These messages often include links to fake websites that mimic legitimate banking portals or UPI apps, attempting to trick users into entering sensitive details like UPI PIN, bank account information, or Aadhaar numbers.

The scam primarily targets everyday Indian banking customers who frequently use UPI apps—such as Google Pay, PhonePe, Paytm, or BHIM—for transactions. Given that UPI transactions in India in 2023 had crossed 7 billion a month, fraudsters find a large pool of potential victims. Awareness campaigns by RBI, CERT-In (Indian Computer Emergency Response Team), and the Indian govt’s I4C (Indian Cyber Crime Coordination Centre) have increased, but new variants of this scam continue appearing in 2026, often piggybacking on real RBI advisories or announcements to appear credible.

Victims come from all income groups, but especially middle-class urban and semi-urban users who stay connected on WhatsApp groups and Facebook pages sharing financial tips and deals. CERT-In recently issued advisories reminding users to verify all financial messages, especially those claiming to be from RBI, before clicking links or sharing banking information.

How This Scam Works — Step by Step

1. Initial Contact via Social Media or SMS: You receive a message on WhatsApp, Facebook, or SMS claiming that RBI has introduced new “emergency” security measures for UPI payments. The message may promise cashback offers or instant refund benefits once you verify your account.

2. Link or Contact Information Provided: The message includes a link to a website that looks very similar to your bank’s official page or the BHIM app login screen, or it may ask you to call a phone number that claims to be an RBI helpline.

3. Fake Website or Call to Action: On this site or call, you are asked to enter your UPI ID, bank account number, Aadhaar number, or even UPI PIN to "verify" your account or "activate" security features.

4. Phishing Your Credentials: The moment you enter these details, scammers capture them. Sometimes, they may also ask you to enter OTPs (One-Time Passwords) sent by your bank, under the false pretense of verification.

5. Money Transfer Without Consent: Using your UPI PIN and OTPs, the fraudsters initiate unauthorized transactions draining money from your bank account. Since UPI transactions are instant and irreversible, victims lose money before realizing what has happened.

6. Psychological Pressure: Scammers often insist on urgency — “Verify immediately or your account will be blocked” — to rush victims and avoid second thoughts.

Real Warning Signs to Watch For

• Unexpected messages claiming to be from RBI with urgent security alerts.
• Promises of cashback, rewards, or instant refunds linked to “new RBI measures.”
• Links directing you to non-official websites that look like your bank or UPI app.
• Requests to share UPI PIN, OTP, Aadhaar details, or bank passwords.
• Phone numbers claiming to be RBI helplines but not matching official contacts.
• Messages from unknown contacts or random WhatsApp groups pushing the same offer.
• Poor spelling, grammatical mistakes, or unusual formatting that official RBI communications wouldn’t have.

What Happens to Victims

Victims often face immediate financial losses as money is transferred via UPI out of their accounts. Unlike credit cards, UPI transactions cannot be easily reversed once done. Victims may find it difficult to get refunds as the payments are authorized using their own UPI PIN and OTPs, albeit shared under false pretenses.

Emotionally, victims report high stress, anxiety, and loss of trust in digital payments. Many find it hard to report the loss because banks and payment apps require proof of fraud — but most times victims are tricked into giving their PIN themselves. Additionally, misuse of Aadhaar and SIM swap frauds linked to this scam can allow criminals to deepen the breach into victims’ digital lives, including accessing other accounts and identity theft.

What RBI and CERT-In Say

RBI has issued multiple warnings to the public that it never communicates via SMS, email, or phone calls asking for UPI PIN, OTP, or bank passwords. Similarly, CERT-In emphasizes users to remain vigilant and not click on links from unknown sources, especially those promising financial benefits related to official banking services.

For assistance, RBI advises users to immediately contact their bank’s official helpline. The national cybercrime helpline, 1930, is available 24/7 to report such frauds. Complaints can also be registered on cybercrime.gov.in under the category “financial frauds.”

How to Protect Yourself

1. Never share your UPI PIN or OTP with anyone — not even if they claim to be from RBI or your bank.
2. Do not click on links in unsolicited WhatsApp, SMS, or Facebook messages regarding RBI offers or UPI upgrades.
3. Verify any official communication by visiting your bank’s official website or trusted apps only.
4. Use app-based two-factor authentication and biometric locks on your UPI apps for extra safety.
5. Regularly monitor your bank and UPI transaction history for any unauthorized payments.
6. Register your mobile number with your Aadhaar card securely to prevent SIM swap frauds.
7. Install updates and security patches on your smartphone and apps promptly.

What to Do If You’ve Been Targeted

• Immediately block your UPI-enabled bank account via your bank’s official app or customer care.
• Contact your bank's fraud grievance cell and inform them of the unauthorized transactions.
• Call the national cybercrime helpline at 1930 to report the fraud.
• File a complaint on the government’s cybercrime portal: cybercrime.gov.in, choosing the “financial fraud” category.
• If your Aadhaar number or mobile SIM was misused, contact the UIDAI helpline and your telecom provider to block SIM services.
• Change all related passwords, UPI PINs, and enable additional app security features.
• Inform close family or friends to watch out for suspicious messages appearing to come from you (in case of identity misuse).

Frequently Asked Questions

Q: Can RBI ask for my UPI PIN or Aadhaar details via SMS or WhatsApp?
No. RBI strictly does not ask for sensitive credentials such as UPI PIN, OTPs, or Aadhaar details through SMS, WhatsApp, calls, or emails.

Q: What if I clicked the fake link but didn’t enter any details?
If you have only clicked and not entered any sensitive data, the risk is lower. Still, clear your browser cache, do a security scan on your phone, and monitor your bank account closely.

Q: How long do I have to report a UPI fraud for a chance of refund?
It’s best to report fraud immediately to your bank and cybercrime authorities. Though RBI recommends prompt reporting, time limits vary; delays reduce chances of recovery.

Suspicious messages about RBI’s new UPI security measures are often traps — verify every message carefully before acting. Stay safe and always check with BharatSecure.app to confirm if a message is a scam before clicking or sharing your details.