Compromised App UPI Credential Harvesting Scam
Verdict: Suspicious | Risk Score: 8/10 | Severity: high
Category: UPI, WhatsApp, Phishing
How Compromised App UPI Credential Harvesting Scam Works
Overview: Increasing numbers of Indian smartphone users are falling victim to scams where popular apps (games, shopping, even utilities) are either malicious or have been compromised to harvest UPI credentials. Scammers embed hidden malware that quietly sends sensitive information back to criminal servers, often without the user’s knowledge for days or weeks. How It Works: Step 1: Victim is prompted to download an app from unofficial or suspicious sources (unverified app stores, forwarded APK files via WhatsApp). Step 2: Once installed, the app requests unnecessary permissions or overlays fake login screens during UPI transactions. Step 3: User enters UPI details, believing they are inside their usual payments app; the credentials are stolen and transmitted to remote servers. Step 4: Scammers use or resell the data on dark web forums. India Angle: Tier 2 and 3 city users with lower digital literacy, college students seeking free games, and professionals looking for productivity apps on a budget are most affected. Such scams gain momentum during festival sales when new apps are widely downloaded. App promotions frequently circulate via WhatsApp and Telegram. Real Examples: "Get 50% cashback on groceries with our new app. Download now (APK link)!" or "Unlock premium games—download official update here! (suspicious link)." Red Flags: 1. Apps requiring UPI logins or unusual permissions 2. Downloads from unofficial links or forwarded APKs 3. Sudden drop in phone performance after app install 4. Mysterious UPI alerts/transactions not initiated by user Protective Measures: Install apps only from Google Play Store or Apple App Store. Check app reviews and developer names. Avoid granting unnecessary permissions. Enable device antivirus and regularly review installed apps. If Victimised: Immediately uninstall any suspicious apps, change UPI PIN, and notify your bank. Report credentials theft at cybercrime.gov.in and 1930. Related Scams: Fake rewards app fraud, malicious OTT streaming apps, and app-based loan phishing.
How This Scam Works — Detailed Explanation
Scammers are increasingly targeting Indian smartphone users by exploiting the popularity of various apps. They leverage unofficial channels, such as unverified app stores or links shared through WhatsApp, to distribute apps that may appear legitimate but are either malicious or have been compromised. Users are lured into downloading apps for games, shopping, or utilities that claim to offer some advantage or novelty, unwittingly granting these apps access to sensitive UPI credentials and personal information.
Once the victim downloads a compromised app, they are subtly prompted to enter UPI login credentials or additional sensitive information. Scammers often employ psychological tricks to create a sense of urgency or fear. For example, a user might receive a notification that their UPI services will be interrupted unless they promptly input their credentials into the app. This manipulation exploits the user's trust in popular apps and their urgency to resolve issues quickly, leading them to act without proper caution.
After entering their information, victims may not immediately notice anything amiss. However, within days, unauthorized transactions start reflecting in their UPI bank alerts. A real-life case involved a Mumbai-based user who downloaded a seemingly harmless game app, only to later receive notifications of ₹1.5 lakh being siphoned off in unauthorized transactions days after entering his UPI information. The app had been designed to look convincing, even featuring user reviews that were likely fabricated. This pattern shows how traders and scammers can operate with relative impunity, given the digital landscape.
The impact of this scam is staggering, with reports indicating that Indians lost approximately ₹20 crore in UPI-related scams in just six months of last year. As noted by CERT-In and the Ministry of Home Affairs (MHA), these scams are not only financially crippling for individuals but also erode trust in UPI, which is a crucial part of India's digital payment ecosystem. Additionally, the ease of using Aadhaar numbers for UPI transactions makes it even easier for criminals to exploit victims, thereby magnifying the risk as sensitive data becomes increasingly vulnerable.
To differentiate between legitimate communications and such scams, users should be vigilant about unexpected requests for UPI logins, especially from newly downloaded apps. Legitimate apps will never directly ask for sensitive information via pop-ups or links. Moreover, users should scrutinize the permissions required by the app; if an app requests access to SMS or creates overlay screens that obscure other app content, it should raise immediate red flags. By remaining informed and cautious, users can protect themselves from falling victim to these crafty scams.
Visual Intelligence:
BharatSecure's AI has identified this as a used in scams targeting Indian users.
Who Does Compromised App UPI Credential Harvesting Scam Target?
General public across India
Red Flags — How to Identify Compromised App UPI Credential Harvesting Scam
- Apps asking for UPI login/screens unexpectedly
- Download links from WhatsApp or non-official stores
- Unnecessary permission requests (SMS, overlay)
- Unknown UPI transactions in bank alerts
What To Do If You Encounter Compromised App UPI Credential Harvesting Scam
- Report any suspicious transactions to your bank immediately; call SBI at 1800-11-1109 or HDFC at 1800-202-6161.
- If you've accidentally shared your UPI credentials, contact your bank's customer service to block your account.
- Visit cybercrime.gov.in to file a complaint regarding the compromised app.
- Change your UPI PIN and any associated passwords immediately after suspecting foul play.
- Call the National Cyber Crime Helpline at 1930 for assistance on how to further secure your accounts.
- Regularly monitor your bank statements and UPI transaction history for any unusual activities.
How to Report Compromised App UPI Credential Harvesting Scam in India
- Call 1930 — National Cyber Crime Helpline (24x7)
- File a complaint at cybercrime.gov.in
- Contact your bank immediately if money was lost
- Call RBI helpline: 14440 for banking fraud
Frequently Asked Questions
- What to do if I shared my OTP in a UPI scam?
- Immediately contact your bank and ask them to block your UPI services. Also, report the incident at cybercrime.gov.in or call the cybercrime helpline at 1930.
- How can I identify a compromised app?
- Signs of a compromised app include asking for unnecessary permissions, requesting UPI credentials unexpectedly, or originating from unofficial download channels.
- How do I report this type of scam in India?
- You can report the scam at cybercrime.gov.in or by calling the national cybercrime helpline at 1930. Additionally, inform your bank about any fraud.
- What are the steps for recovering money or protecting my account after this scam?
- Contact your bank immediately to dispute any unauthorized transactions and secure your account. Consider filing a complaint with the cybercrime helpline for further support.
Related Scams in India
Verify Any Suspicious Message
Check any suspicious message, link, or call for free at bharatsecure.app. BharatSecure uses AI to detect scams in real-time and protect Indian users.