Phishing via UPI Pay Request Scam
INDIA — By BharatSecure Threat Intelligence Team ·
Verdict: Suspicious | Risk Score: 9/10 | Severity: critical
Category: UPI, WhatsApp, Phishing
How Phishing via UPI Pay Request Scam Works
Overview: With UPI being India’s favourite payment method, scammers have adapted phishing techniques to trick users into authorising UPI transactions they didn’t intend. The scam targets users on Olx, Facebook Marketplace, and WhatsApp selling groups, making it risky for anyone buying or selling products online. How It Works: The scammer poses as a genuine buyer or seller. For sellers, the scammer asks for the victim’s UPI ID, then sends a ‘payment request’ but instead of sending funds, it’s a ‘Collect’ request, expecting the victim to inadvertently approve a debit from their account. For buyers, scam links redirect to phishing sites mimicking payment gateways, stealing credentials and enabling unauthorized transactions. India Angle: Most active in cities with widespread digital payments: Mumbai, Delhi NCR, Bangalore, and Hyderabad. Largely affects urban smartphone users, students, and small entrepreneurs. WhatsApp, Facebook, and third-party marketplaces are the main platforms. Real Examples: - “I am transferring Rs 5,000 for your mobile on OLX, please check and approve the UPI request now.” - “Payment done, please click link to confirm receipt,” linking to a fake site. Red Flags: - Unknown buyer/seller insisting on instant UPI payment - UPI ‘collect’ requests instead of standard transfer - Transfer confirmation links from non-banking sources - Pressure to act immediately during conversation Protective Measures: - Never approve unknown UPI collect requests - Accept payments only after verifying the sender and amount - Use secure, platform-recommended transaction methods - Never trust unrelated payment confirmation links If Victimised: - Report the transaction to your bank and UPI provider - Lodge complaint at cybercrime.gov.in and call 1930 - Preserve communication screenshots and payment details Related Scams: - Paytm/Ola UPI refund trap - QR code reversal fraud - Remote screen sharing phishing
How This Scam Works — Detailed Explanation
Scammers targeting UPI users on platforms like OLX, Facebook Marketplace, and WhatsApp have developed a cunning strategy to exploit unsuspecting buyers and sellers. These scammers typically create fake profiles to pose as legitimate buyers or sellers. For instance, if you are selling an item on OLX, a scammer may reach out with an attractive offer, often using persuasive language that boosts trust. They may even appear to be local, making their connection feel authentic. The anonymity provided by these platforms makes it easy for scammers to reach out to potential victims without revealing their true intentions.
Once they establish communication, scammers employ psychological tricks to create a sense of urgency. They might give the impression that their offer is time-sensitive or that there are multiple other interested buyers, pushing victims to act quickly. The scammer will usually inquire about the seller's UPI ID under the pretext of needing it to make a payment. Once they have the UPI ID, they will send a ‘payment request’ that is deceptively crafted; instead of a genuine payment, the request appears as a legitimate transaction that the seller must approve. This pressure tactic, combined with the lure of a quick sale, catches many individuals off guard.
Victims of the Phishing via UPI Pay Request Scam often find themselves taken by surprise. After sharing their UPI ID, the scam unfolds rapidly. The offender sends an invite for a payment through UPI, prompting the victim to approve the transaction. What they do not realize is that the request is not for funds to be sent to them, but rather to authorize a non-existent payment. Should the victim accept this request, the funds are deducted from their account, leaving them in disbelief. Instances from previous months show individuals losing substantial sums—one recent report indicated that ₹300 crore were lost to various UPI scams in a single month. This statistic underlines the urgency for awareness and action against this rising cyber crime in India.
The impact of these scams continues to escalate nationwide, drawing the attention of authorities such as the Ministry of Home Affairs and the Reserve Bank of India. The rise in UPI adoption makes it a lucrative target for scammers. Cybersecurity advisories from CERT-In highlight the critical nature of this issue, particularly given that genuine transactions and requests are processed with similar technology. Victims often report not only financial losses but also emotional distress, as their trust is shattered along with their finances. The financial strain affects countless households, making it essential for everyone to remain vigilant and informed.
To distinguish this scam from legitimate requests, it is imperative to look for specific red flags. If you receive a UPI payment request, always question the sender's intent, especially if they are unknown to you. Be wary if they push for immediate action or if they propose a deal that seems too good to be true. Legitimate transactions typically involve well-established communication—any link prompting you to confirm payments should be verified through official apps. If you feel rushed or pressured, take a moment to reassess the situation. Remember, a delay can save you from irreversible financial harm.
Visual Intelligence:
BharatSecure's AI has identified this as a used in scams targeting Indian users.
Who Does Phishing via UPI Pay Request Scam Target?
General public across India
Red Flags — How to Identify Phishing via UPI Pay Request Scam
- Unknown party pushes for immediate UPI approval
- Unexpected UPI collect requests instead of transfer
- Links to confirm payment outside official apps
- Unusual urgency from buyer or seller
- Suspiciously generous or non-negotiated prices
What To Do If You Encounter Phishing via UPI Pay Request Scam
- Report the incident immediately by calling the cybercrime helpline 1930 or visiting cybercrime.gov.in.
- Contact your bank's customer service to freeze your account temporarily and prevent further losses (SBI: 1800-11-1109; HDFC: 1800-202-6161).
- Change your UPI PIN and any associated passwords right after you discover the scam.
- Monitor your bank statements for any unauthorized transactions post-scam.
- Gather all related communication as evidence, and consider filing a formal complaint with local law enforcement.
- Educate yourself and others about the signs of phishing scams to prevent future incidents.
How to Report Phishing via UPI Pay Request Scam in India
- Call 1930 — National Cyber Crime Helpline (24x7)
- File a complaint at cybercrime.gov.in
- Contact your bank immediately if money was lost
- Call RBI helpline: 14440 for banking fraud
Frequently Asked Questions
- What to do if I shared my UPI ID in a scam?
- Immediately report the incident to your bank and the cybercrime helpline at 1930. Changing your UPI PIN is essential.
- How can I identify a phishing UPI request?
- Look for requests pushing for quick approval, coming from unknown numbers or links outside of official apps.
- How to report a phishing scam in India?
- You can report scams to the cybercrime helpline at 1930, visit cybercrime.gov.in, and inform your bank about the incident.
- How can I recover lost money after being scammed?
- Contact your bank immediately to report the fraud, and gather any relevant evidence for a formal complaint or investigation.
Related Scams in India
Verify Any Suspicious Message
Check any suspicious message, link, or call for free at bharatsecure.app. BharatSecure uses AI to detect scams in real-time and protect Indian users.