Small Payment Authorization Scam — How to Identify & Stay Safe

INDIA — By BharatSecure Threat Intelligence Team · Updated May 28, 2026

Severity: HIGH | View Full Scam Details

Small Payment Authorization Scam India 2026: A Rising UPI Fraud Threat

In 2026, India is witnessing a surge in a clever new cybercrime called the Small Payment Authorization Scam which targets UPI users and mobile banking customers.

What Is the Small Payment Authorization Scam?

The Small Payment Authorization Scam is a growing digital fraud pattern in India exploiting people's trust in small-value UPI transactions. As over 70 crore Indians use UPI daily for payments, scammers take advantage of this familiarity to trick victims into approving minimal payments of Rs. 1 or Rs. 2. These seemingly harmless authorizations then give fraudsters a hidden gateway to withdraw much larger amounts later without the victim’s clear consent.

Typically, victims receive a WhatsApp message, SMS, or phone call claiming to be from their bank, payment app, or a popular e-commerce platform. The scammers say they need the victim to authorize a tiny payment as a "verification" before unlocking refunds, discounts, or account benefits. Since the amount is negligible, many approve the payment without suspicion.

According to public reports and advisories from India’s CERT-In and the Ministry of Electronics and Information Technology (MeitY), this scam has spread across metro and tier-2 cities alike in the last year, prompting official warnings to UPI users to remain vigilant. The scam particularly targets everyday users who may not be tech-savvy or aware of UPI payment mandates under RBI guidelines.

How This Scam Works — Step by Step

Here is the typical sequence scammers follow to dupe victims in the Small Payment Authorization Scam:

1. Initial Contact: The victim receives a WhatsApp message or an SMS claiming to be from their bank, a government agency, or an online seller. Sometimes, the contact may be a phone call impersonating customer support.

2. The Request: The message or caller asks the victim to approve a small payment of Rs. 1 or Rs. 2 on their UPI app. They claim this is needed to verify the bank account or to release a larger payment refund, cashback, or prize.

3. Approval: Thinking this is routine, the victim opens their UPI app and consents to the requested small payment authorization.

4. Silent Auto-Debit Setup: Unbeknownst to the victim, the small authorization activates an auto-debit permission or recurring payment option with certain fraud apps or merchant IDs that can later withdraw much larger sums.

5. Unauthorized Transactions: After some delay, the victim notices unexplained debits from their bank account or UPI-linked wallets for amounts far exceeding the initial Rs. 1 or Rs. 2.

6. Loss Realization and Confusion: Victims often delay reporting because the initial small transaction seemed harmless and the subsequent debits look like legitimate payments to merchants they may not recognize.

7. Difficulty With Reversals: Due to the authorization given, banks sometimes refuse immediate UPI payment reversal or rule the transactions as valid recurring payments under RBI's UPI framework.

Real Warning Signs to Watch For

• Requests to approve unusual small payments via UPI or mobile wallets without prior notice.
• Phone calls or messages pressuring you to act immediately or face account blocking.
• Communications claiming verification of refunds or unlocking funds needing tiny payment approval.
• Spelling, grammar mistakes, or unofficial sender IDs in WhatsApp or SMS messages.
• Asked to share sensitive information like UPI PIN under the pretext of verifying the transaction.
• Notifications of authorization requests for apps or merchants you have never interacted with.
• Lack of official links to bank websites or verified social media accounts in the messages.

What Happens to Victims

Victims of this scam often face immediate financial loss as fraudsters withdraw amounts far exceeding the initial authorization. The challenge is compounded by the difficulty in proving that these higher debits were unauthorized because of the accepted small approval, recognized by UPI rules as valid consent for recurring payments.

Besides monetary loss, victims endure stress and helplessness dealing with banks, filing complaints with cybercrime cells, and resetting multiple accounts. Cases of Aadhaar misuse and SIM swapping have intertwined with these scams, increasing the risk of identity theft and longer-term financial damage.

Recovery can be slow since UPI transactions are final according to the NPCI guidelines, and banks refer customers to file complaints with cybercrime.gov.in or approach police for further redress.

What RBI and CERT-In Say

The Reserve Bank of India (RBI) and the Indian Computer Emergency Response Team (CERT-In) have issued warnings urging users to exercise caution when approving small-value transactions on UPI apps. RBI clarifies that auto-debit or mandate-based payments require explicit ongoing consent and users should regularly review linked payment mandates.

CERT-In advisories highlight that fraudsters exploit legitimate UPI features to bypass traditional fraud detection. The Ministry’s 1930 Cybercrime Helpline encourages victims to report suspicious payment requests immediately.

UPI users are reminded to only approve payments on official apps downloaded from trusted sources and never share UPI PINs or OTPs. Regularly checking bank statements and blocking unknown auto-debits at the earliest can prevent bigger losses.

How to Protect Yourself

1. Never approve small-value UPI payments unless you have initiated the transaction.
2. Always verify the caller or message sender by contacting your bank’s official helpline.
3. Do not share your UPI PIN, OTP, or bank details over phone or WhatsApp.
4. Avoid clicking on links sent via SMS or WhatsApp purportedly from banks or e-commerce companies.
5. Review your monthly bank/UPI statements carefully for any unauthorized auto-debits or mandates.
6. Remove or block unknown third-party apps linked to your UPI or mobile wallets.
7. Enable transaction alerts and immediately report any unauthorized payment to your bank.

What to Do If You've Been Targeted

If you suspect you are a victim of the Small Payment Authorization Scam:

• Contact your bank’s customer support immediately to block further transactions and freeze your account if possible.
• Lodge a complaint with the nearest cybercrime police station or file a report online at cybercrime.gov.in.
• Call the 1930 cybercrime helpline for guidance and assistance.
• Change your UPI PIN and passwords for linked apps and bank accounts.
• Monitor all financial transactions closely and request the bank to initiate a fraud investigation.
• Avoid responding to further suspicious messages or calls.

Frequently Asked Questions

Q: Can approving a small UPI payment really lead to large unauthorized debits?
Yes, under UPI’s mandate and recurring payment features, a small initial authorization can permit larger future debits by linked merchants or apps unless you explicitly revoke the permission.

Q: What should I do if I accidentally authorized a small payment in this scam?
Contact your bank immediately to report the incident, block any linked mandates, and file a cybercrime complaint. Revoke permissions on your UPI app to stop any recurring debits.

Q: Does the RBI guarantee a refund for losses due to this scam?
UPI transactions are considered final. RBI encourages banks to have grievance redressal mechanisms but refunds depend on investigation outcomes. Quick reporting increases chances of recovery.

For any suspicious message or payment request, always verify at BharatSecure.app and report fraud promptly via the 1930 helpline.

Disclaimer: This article describes a pattern of fraud reported in public sources for public-safety awareness. It is not legal, financial, or medical advice. To request correction or removal of any content, write to hello@bharatsecure.app.