WhatsApp Impersonation for UPI Fraud — How to Identify & Stay Safe

INDIA — By BharatSecure Threat Intelligence Team · Updated May 29, 2026

Severity: CRITICAL | View Full Scam Details

WhatsApp Impersonation for UPI Fraud in India 2026: How to Stay Safe from This Critical Scam

WhatsApp impersonation to steal money via UPI is a rising cybercrime threat causing major losses to Indian internet users in 2026.

What Is the WhatsApp Impersonation for UPI Fraud?

WhatsApp impersonation for UPI fraud is a dangerous scam where fraudsters pose as someone you know on WhatsApp — such as family, friends, or colleagues — to trick you into sending money using UPI apps like BHIM, Google Pay, or PhonePe. This scam preys on the trusted relationships Indians maintain on WhatsApp, combined with the widespread use of UPI for instant digital payments.

This scam primarily targets active UPI users across India from urban centres to smaller towns, where people regularly rely on UPI for daily expenses, bills, or loans. According to reports received by cybercrime authorities such as the Indian Computer Emergency Response Team (CERT-In) and the Ministry of Home Affairs’ Integrated Cyber Crime Coordination Centre (I4C), hundreds of complaints involving WhatsApp impersonation have been filed every month. The Reserve Bank of India (RBI) has issued advisories warning citizens to be cautious about UPI-based frauds involving social media.

The scam’s reach is amplified by scammers’ use of social engineering and contact spoofing techniques, making it difficult for users to distinguish genuine messages from fraudulent ones. This has led to significant financial damage, often running into several thousands of rupees per victim.

How This Scam Works — Step by Step

1. Gathering Information and Contacts: Scammers either hack or use spoofed phone numbers to access or imitate your WhatsApp contacts. Alternatively, they extract your phone number and try to learn your relationships via social media or previous scams.

2. Initial Contact by Impersonation: The fraudster sends a WhatsApp message pretending to be a trusted contact (e.g., "Uncle," "Colleague," or "Sister") using either a cloned account or a new number with a similar profile picture and name.

3. Creating a Sense of Urgency or Need: The scammer claims an emergency or urgent need — often a financial crisis, medical expense, or urgent bill payment. They may say they want to borrow money via UPI or get you to pay on their behalf.

4. Requesting UPI Payment: They share a UPI ID (e.g., us**@bank) or suggest an app-based transfer, encouraging quick action to avoid delays.

5. Payment and Confirmation: If the victim sends money, the fraudster may fake a confirmation message or block the victim to avoid being traced.

6. Loss Detection: Victims realize their money is lost when they do not hear back or when they find the real contact unreachable or unaware of any requests.

This scam often bypasses bank-level OTP and transaction security because the victim authorizes the payment themselves, tricked by the impersonator’s convincing story.

Real Warning Signs to Watch For

• Messages asking for urgent money transfers via UPI without prior verbal confirmation.
• Unknown or slightly altered WhatsApp numbers pretending to be your contacts.
• Pressure tactics like “Send immediately” or stories about emergencies.
• Requests to share OTPs, UPI PINs, or bank details (Note: Never share these).
• Unusual grammar, spelling errors, or awkward language not typical of your contact.
• Verification calls pretending to be from a bank or payment app immediately after the request.
• Links or QR codes sent without explanation asking you to pay or install apps.

What Happens to Victims

Victims can suffer both financial and emotional consequences. Financially, the fraudulent UPI transactions are difficult to reverse because the victim themselves authorized the payment. The RBI allows limited reversal of genuine fraud cases, but many victims struggle to recover their lost INR amounts completely. If Aadhaar or mobile SIMs are compromised during the scam, further risks include identity theft and unauthorized loans or withdrawals.

Emotionally, victims experience loss of trust in digital payments and often suffer stress and embarrassment. The emotional toll is worsened by delays and difficulty reporting the matter to banks and cybercrime authorities.

What RBI and CERT-In Say

The RBI has released multiple warnings about digital payment frauds, urging users to verify all requests for UPI payments, avoid sharing OTPs or UPI PINs, and promptly report suspicious transactions to their banks. In 2024, RBI mandated stronger customer authentication for UPI transactions to reduce fraud risk.

CERT-In, India’s national cybersecurity agency, runs the cybercrime.gov.in portal where victims can file complaints and seek help. The agency regularly coordinates efforts to alert citizens about scams involving social media and digital payments.

The Ministry of Home Affairs’ I4C centre supports these initiatives and facilitates investigations. Citizens are encouraged to use the 1930 cybercrime helpline for prompt guidance on reporting fraud.

How to Protect Yourself

1. Verify All Money Requests Verbally: Always call back on a known number before making UPI payments to any WhatsApp contact requesting money.
2. Never Share UPI PIN or OTPs: Banks and payment apps never ask you to share these; sharing means instant loss.
3. Look Closely at WhatsApp Numbers: Beware of new or slightly different phone numbers pretending to be your contacts.
4. Enable Two-Step Verification on WhatsApp: This reduces the risk of your WhatsApp account being cloned or hacked.
5. Use Official UPI apps Downloaded from Trusted Stores: Avoid suspicious links or unofficial apps.
6. Be Wary of Urgency and Emotional Appeals: Scammers use pressure tactics to prevent victims from thinking clearly.
7. Regularly Check Bank and UPI Transaction Statements: Early detection helps you report fraud faster.

What to Do If You've Been Targeted

• Immediately notify your bank or UPI app support to freeze or block transactions.
• File a police complaint at your local cybercrime cell or register at cybercrime.gov.in for a digital complaint.
• Call the 1930 national cybercrime helpline for guidance and to report the incident.
• Inform WhatsApp support about impersonation and consider deleting suspicious contacts.
• Change your WhatsApp two-step verification and bank app credentials promptly.
• Monitor your linked bank accounts and UPI ID for unauthorised activity.
• Avoid further communication with the suspected fraudster.

Frequently Asked Questions

Q: Can I get my money back if I fell victim to WhatsApp impersonation UPI fraud?
A: Recovery depends on your bank’s fraud policy and RBI guidelines. While some banks may offer refunds if you report quickly, many losses are not reversed because the transaction was authorised by the victim.

Q: How do scammers get my WhatsApp contacts to impersonate someone I know?
A: They may hack your phone, clone your WhatsApp account, or spoof phone numbers. Sometimes they collect your contacts from social media or previous data breaches.

Q: What is the difference between WhatsApp impersonation and account hacking in this scam?
A: In impersonation, scammers create a fake or cloned profile pretending to be your contact. In hacking, they gain access to your real WhatsApp account directly.

Verify unfamiliar UPI payment requests and WhatsApp messages at BharatSecure.app — and report fraud promptly via the 1930 cybercrime helpline.

Disclaimer: This article describes a pattern of fraud reported in public sources for public-safety awareness. It is not legal, financial, or medical advice. To request correction or removal of any content, write to hello@bharatsecure.app.