UPI OTP/PIN Sharing Fraud — How to Identify & Stay Safe

INDIA — By BharatSecure Threat Intelligence Team ·

Severity: Critical | View Full Scam Details

UPI OTP and PIN Sharing Fraud in India (2026): How Scammers Are Draining Accounts in Minutes

Every day, Indians lose thousands of rupees to callers who ask for just one thing — your UPI PIN or OTP. This scam is rated critical (10/10) on BharatSecure's risk scale because a single moment of trust can empty your account before you realise what happened.

What Is the UPI OTP/PIN Sharing Fraud?

This fraud targets anyone who uses UPI-based apps — Google Pay, PhonePe, Paytm, or any bank's UPI interface. Callers or WhatsApp contacts, allegedly impersonating bank representatives or government officials, trick victims into sharing their UPI PIN or a one-time password (OTP). The moment that information is shared, money leaves the account — often within seconds.

The scale is alarming. According to figures cited by the Ministry of Home Affairs and CERT-In, digital payment frauds contributed to losses exceeding ₹1,200 crore in 2022 alone. The RBI has repeatedly updated its consumer advisories as the threat has grown alongside India's UPI adoption surge. India's cybercrime coordination body, I4C (Indian Cyber Crime Coordination Centre), continues to flag OTP-sharing fraud as one of the highest-volume complaint categories on cybercrime.gov.in.

BharatSecure's threat-intelligence database has catalogued 13 fraudulent UPI identifiers verified through NPCI data and community reports — each linked to reported cases of OTP and PIN harvesting.

Exactly How This Scam Works — Step by Step

  1. Initial contact. You receive an unsolicited call or WhatsApp message. The caller claims to be from SBI, HDFC Bank, or a government agency. Their tone is authoritative and calm.
  2. The hook. They allege an urgent problem — your account is about to be frozen, a transaction needs reversal, or you've won a refund or contest prize.
  3. Psychological pressure. Fear, urgency, or greed is dialled up: "Share the OTP within two minutes or your account will be blocked."
  4. The ask. They request your UPI PIN "for verification" or the OTP just sent to your phone. Both are entirely unnecessary for any legitimate bank process.
  5. The transfer. Armed with your OTP or PIN, the fraudster approves a transaction on their device. Money — reported cases range from ₹10,000 to ₹50,000 — moves into accounts they control.
  6. Silence. The call ends. You receive a debit SMS. By the time you react, the window for freezing the transaction has often passed.

Real Warning Signs (What to Watch For)

What Happens to Victims

Victims typically lose between ₹10,000 and ₹50,000 in a single incident, and UPI transactions are near-instantaneous — making reversal extremely difficult. The RBI's framework for disputed digital transactions requires complaints to be filed with the bank within a short window, and outcomes are not guaranteed. Beyond the financial loss, many victims report significant stress and distrust of digital banking, sometimes abandoning UPI entirely.

In some reported cases, scammers use the initial contact to fish for additional details — Aadhaar numbers, account numbers, or registered mobile numbers — which can enable further fraud, including SIM swap attacks. A successful SIM swap can lock a victim out of all linked banking services and amplify losses well beyond the first incident.

What RBI, CERT-In, and I4C Say

The Reserve Bank of India has issued multiple consumer awareness directives stating clearly: no bank will ever ask for your PIN, password, or OTP over a call or message. Sharing this information is treated as customer negligence under most bank terms, which can affect your ability to claim a refund.

CERT-In (cert-in.org.in) has published advisories flagging social engineering via phone calls and messaging apps as a persistent and growing threat vector in India's digital payments landscape.

I4C operates the 1930 cybercrime helpline specifically for financial fraud. Calling 1930 immediately after a fraud occurs is the fastest way to attempt a transaction freeze. You can also file a formal complaint at cybercrime.gov.in.

How to Protect Yourself

  1. Never share your UPI PIN or OTP with anyone — not a banker, not a government official, not a "customer care" agent. No legitimate process requires this.
  2. Hang up on urgency. Artificial time pressure is the scammer's most powerful tool. A real bank will never threaten to freeze your account in a two-minute call.
  3. Verify independently. If a caller claims to be from your bank, hang up and call the official number on the back of your debit card.
  4. Don't engage with unsolicited WhatsApp messages asking you to click links or call numbers related to your bank account.
  5. Audit your social media. Scammers acquire numbers from public profiles and leaked databases — limit what personal information is publicly visible.
  6. Enable UPI transaction limits on your app to cap exposure in case credentials are ever compromised.
  7. Check for SIM activity regularly through your telecom provider if you suspect your number is being targeted.

What to Do If You've Been Targeted

  1. Call 1930 immediately — India's national cybercrime financial fraud helpline. Speed matters; early reporting can sometimes flag the destination account.
  2. File a complaint at cybercrime.gov.in — under the "Financial Fraud" category. Keep your complaint reference number.
  3. Contact your bank's fraud helpline without delay and request a freeze or dispute on the transaction.
  4. Document everything — screenshots of messages, call logs, the time of transaction, and the amount.
  5. Visit your nearest police station to file an FIR if losses are significant; this creates an official record that supports bank escalations.
  6. Change your UPI PIN immediately across all linked apps.

Frequently Asked Questions

Can a bank really freeze my account if I don't share my OTP? No. This is a manipulation tactic. Banks have no process that requires customers to share an OTP or PIN over the phone to prevent an account freeze. If you receive such a threat, treat it as a confirmed fraud attempt and disconnect immediately.

I shared my OTP but caught it quickly — can the money be recovered? Possibly, if you act fast. Call 1930 within minutes of the incident. If the fraudulent transaction has not yet settled, there is a chance the destination account can be flagged. However, UPI transactions process in seconds, and recovery is not guaranteed. File a formal complaint regardless, as it builds your case with the bank and police.

How did the scammer know my name and partial account details? Phone numbers and partial financial data are frequently available in leaked databases circulating online, or scraped from social media profiles. Scammers use this information to appear credible and lower your guard — knowing your name does not mean the caller is legitimate.

Is Google Pay or Paytm responsible for refunding fraud losses? UPI apps act as interfaces; the transaction is processed through your bank. Responsibility for disputes lies primarily with your bank and NPCI's grievance framework. Consult the app's official grievance portal and your bank simultaneously. For case-specific legal or financial guidance, consult a qualified professional.

Received a suspicious UPI message or call? Scan it at BharatSecure.app to check it against our verified fraud database. If you've been defrauded, report it now at cybercrime.gov.in or call 1930 — every report helps protect the next potential victim.

Disclaimer: This article describes a pattern of fraud reported in public sources for public-safety awareness. It is not legal, financial, or medical advice. To request correction or removal of any content, write to hello@bharatsecure.app.

Related Scams in Our Database

Verify Any Suspicious Message

Check any suspicious message, link, or call for free at bharatsecure.app.