UPI Fraud by Compromised Call Centres — How to Identify & Stay Safe

INDIA — By BharatSecure Threat Intelligence Team · Updated Jun 12, 2026

Severity: Critical | View Full Scam Details

UPI Fraud by Compromised Call Centres in India – 2026 Warning

UPI fraud involving compromised call centres, sometimes based overseas, poses a critical threat to Indian users’ digital payments in 2026.

What Is the UPI Fraud by Compromised Call Centres?

This scam involves fraudsters running compromised call centres—often set up in countries like Cambodia—to trick Indian UPI users out of their money. These call centres recruit individuals posing as bank officials or government agents, who contact victims in India using WhatsApp calls or VoIP numbers to mask their identities. The scammers target people based on data mined from past breaches or public sources, frequently victimizing older adults or those less familiar with digital security.

In India, this scam has become increasingly widespread, taking advantage of the rapid growth of UPI transactions and the high trust Indians place in banking and government communications over calls and messages. Regulators like the Reserve Bank of India (RBI), CERT-In, and the Indian Cyber Crime Coordination Centre (I4C) have repeatedly issued advisories warning about calls impersonating banks or government departments asking for sensitive data. The use of overseas call centres makes enforcement difficult, increasing the threat’s severity.

How This Scam Works — Step by Step

1. Data Collection: Fraudsters collect personal details such as phone numbers, names, and sometimes partial Aadhaar data from public records or previous breaches.

2. Initial Contact: Agents from compromised call centres initiate contact via WhatsApp calls or VoIP numbers with targeted victims, often pretending to be from the bank’s fraud department or a government body like UIDAI.

3. Creating Urgency: The caller claims the victim’s bank account or UPI transactions are “at risk” due to suspicious activity, urging immediate action to “protect funds.”

4. Request to Share OTP or UPI PIN: The caller convinces the victim to share One-Time Passwords (OTP) or UPI PINs, allegedly to “verify identity” or “block fraudulent transactions.”

5. KYC Verification Trap: Sometimes, the caller asks the victim to complete fake KYC steps via WhatsApp messages or send scanned ID proofs, further harvesting sensitive data.

6. Unauthorized Transactions: Using the obtained information, scammers initiate UPI payments or link new devices to the victim’s UPI app to authorize transactions.

7. Covering Tracks: Once money is sent, scammers may claim the victim’s account is unsafe and urge them not to disclose any information to family or police, prolonging the fraud.

Real Warning Signs to Watch For

• Calls from unknown numbers or international VoIP numbers claiming to be banks or government officials.
• Unsolicited WhatsApp calls requesting OTPs, UPI PINs, or scanned identity documents.
• Callers pressuring you to act immediately or threatening account suspension.
• Requests to install unofficial apps or approve permissions on your phone.
• Instructions to not share details with family or authorities.
• Claims that you’ll receive official warnings but need to verify details over call.
• Sudden messages or missed calls from unknown sources asking for personal verification.

What Happens to Victims

Victims often lose significant amounts of INR through unauthorized UPI transactions, with funds quickly transferred out to untraceable accounts. Since UPI transactions are instant and irrevocable, the chances of reversal are slim once the fraud occurs. Emotional distress is common as victims face the shock of losing hard-earned money, coupled with guilt or embarrassment for falling prey.

Additionally, misuse of Aadhaar details or identity documents shared during these scams can lead to further identity theft or SIM swap fraud, increasing future risk. Victims find themselves battling blocked bank accounts, complex complaints procedures, and slow law enforcement responses, especially when the scam involves foreign call centres.

What RBI and CERT-In Say

RBI has emphasized that banks will never ask for UPI PINs or OTPs over phone or WhatsApp. Official advisories urge users to report suspicious calls immediately and never share confidential banking details. CERT-In and I4C have issued alerts highlighting cross-border call centre scams targeting Indian citizens, advising enhanced vigilance for UPI users, especially the elderly.

The 1930 cybercrime helpline and RBI’s toll-free numbers are recommended contact points for reporting fraud attempts. Regulators continue to stress that authentic KYC processes never require sharing sensitive data over calls or messages, and urge users to verify any unusual requests independently.

How to Protect Yourself

1. Never share your UPI PIN, OTP, or banking passwords over phone or chat.
2. Reject calls asking for personal or KYC information, even if the caller claims to be from your bank.
3. Only use official bank apps downloaded from verified sources for UPI transactions.
4. Avoid clicking links or installing apps sent via unsolicited WhatsApp messages or SMS.
5. Regularly update your phone’s security settings and enable app permissions cautiously.
6. Register your mobile number with your bank and update contact details promptly to avoid SIM swap risks.
7. When in doubt, hang up and call your bank’s official helpline to verify any suspicious requests.

What to Do If You've Been Targeted

If you suspect UPI fraud via a compromised call centre:

• Immediately block your UPI app and linked bank accounts by contacting your bank.
• Report the incident to the 1930 cybercrime helpline and register a complaint at cybercrime.gov.in.
• File an FIR with your local police station, citing the phone numbers or WhatsApp IDs used by callers if available.
• Inform your mobile operator to secure your SIM against unauthorized access.
• Preserve all call records, messages, and transaction details to assist investigations.

Prompt action can contain losses and alert authorities to ongoing scams.

Frequently Asked Questions

Q: Can scammers really access my bank account just by calling me?
A: They cannot directly access your account, but if you share OTPs, UPI PINs, or personal information, scammers can authorize fraudulent transactions through UPI apps linked to your bank.

Q: Is it safe to share Aadhaar details for ‘KYC verification’ over WhatsApp?
A: No, legitimate banks or government agencies do not request Aadhaar or KYC documents through WhatsApp or calls. Such requests are typically part of a scam.

Q: How quickly can I report and block transactions after being scammed?
A: Contact your bank and cybercrime helpline immediately. While UPI transactions are fast, quick reporting may help in blocking further unauthorized payments and begin recovery efforts, though reversals depend on the circumstances.

Stay alert and verify suspicious messages and calls at BharatSecure.app. If you face fraud attempts, report immediately at the 1930 cybercrime helpline.

Disclaimer: This article describes a pattern of fraud reported in public sources for public-safety awareness. It is not legal, financial, or medical advice. To request correction or removal of any content, write to hello@bharatsecure.app.