UPI Scam via Fake Collect Requests & QR Codes

How UPI Scam via Fake Collect Requests & QR Codes Works

Overview: With UPI payments becoming ubiquitous, scammers are exploiting fake ‘collect requests’ and tampered QR codes to steal money directly from unsuspecting Indians. This technique involves sending requests that trick you into entering your UPI PIN or scanning deceptive QR codes, instantly draining your bank account. Students, busy office-goers, shopkeepers, and small businesses are frequent victims because UPI payments are a daily habit, and a moment’s lapse can have severe consequences. How It Works: Criminals, using dark web phishing kits, send a fake UPI collect request—posing as a known contact, buyer, or business—claiming money is owed or needs to be sent. If you accept and enter your PIN, the amount is whisked away. In another version, scammers share QR codes (on WhatsApp, SMS, or pasted near cash counters) that, when scanned, prompt you to log in and enter UPI details on a counterfeit app or website. Instantly, your information is stolen. Often, these techniques are combined with social engineering: the scammer may chat with you pretending to be a friend or customer, asking for urgent help or quick payment. India Angle: This scam is rampant in urban hotspots like Mumbai, Bengaluru, Delhi NCR, and is spreading rapidly in Tier 2 and 3 cities. It often targets Kirana shop owners, delivery staff, students, and gig workers who use UPI extensively. Scammer messages are crafted in English, Hindi, and local languages. QR codes are sometimes stuck near cash registers to catch hurried customers. Real Examples: - WhatsApp: ‘Bro need 5k urgently, sending collect request. Please approve quickly–it’s for hospital bill.’ - At a local store: New QR code pasted on top of the old one—on scanning, customer is asked for UPI login details. - SMS: ‘You missed a payment. To receive refund, scan attached QR code and enter PIN.’ Red Flags: 1. Unsolicited UPI collect requests, especially from unknown contacts. 2. QR codes that look tampered with, pasted on top, or lacking official branding. 3. Requests asking for your PIN or login details after scanning. 4. Name of payee/receiver doesn’t match who you intend to transact with. Protective Measures: Never approve unknown UPI requests—even from familiar names, always call and verify. Only scan QR codes from trusted sources, and double-check the payee’s name or UPI ID before confirming. Avoid entering personal or PIN details after scanning a QR. Report suspicious collect requests or code placements to authorities or your payment provider. If Victimised: - Contact 1930 and file a fraudulent UPI transaction report immediately. - Visit cybercrime.gov.in to register your complaint. - Notify your bank and freeze related accounts or cards. - Change your UPI PIN instantly. Related Scams: - QR code swapping at petrol pumps and highways. - Social engineering scams via WhatsApp pretending to be friends/family. - Fake UPI apps mimicking popular wallets.

How This Scam Works — Detailed Explanation

As UPI transactions continue to dominate the payment landscape in India, scammers are becoming increasingly sophisticated in their methods. They often start by gathering personal data from social media platforms like Facebook, WhatsApp, and Instagram, where users openly share their contact details and financial activities. These scammers can impersonate friends, family, or legitimate businesses that the victim trusts, building a rapport before they spring the trap. They send a fake 'collect request' via UPI or share a deceptive QR code promising discounts or urgent payments, effectively targeting unsuspecting individuals, particularly students and small business owners who rely heavily on UPI transactions for their daily activities.

To execute their scams, these offenders utilize various psychological tactics. They create a false sense of urgency, suggesting that immediate action is required — for example, they might claim that an important payment needs to be confirmed right away to avoid penalties or ensure continued service. Additionally, they may craft messages that appear authentic by mimicking official communications, complete with logos and language that seem credible. During this manipulation, they trick victims into entering their UPI PIN or scanning malicious QR codes leading to fake payment pages, thereby extracting money directly from their bank accounts. The combination of familiarity and urgency is often enough to cause victims to overlook their usual caution, resulting in devastating financial loss.

Once a victim falls for the scam, the process unfolds with alarming speed. For instance, a busy office-goer receives a ‘collect request’ from what appears to be their local grocery store, only to find it’s an imposter. Upon clicking the link, they are redirected to a site where they are prompted to enter their UPI PIN – thinking they are confirming a safe transaction. In less than a minute, money is siphoned off their account, typically before they even realize anything is wrong. Similarly, there have been cases of students being lured by offers of quick cash for completing simple tasks — resulting in them losing thousands of rupees. Such incidents have become common, particularly among individuals who frequently use platforms like WhatsApp for communication and transactions.

The impact of these scams on the Indian populace is staggering. According to recent reports, thousands of crores have been lost in UPI scams, with the Ministry of Home Affairs (MHA) and the Reserve Bank of India (RBI) becoming increasingly concerned about the prevalence of these scams. CERT-In has issued multiple advisories to warn citizens about the growing threat of UPI scams, emphasizing the need for increased awareness and stronger protective measures. Data shows that thousands of cases are registered each month, with total losses running into ₹200 crores annually. This profound financial impact extends beyond direct losses, affecting mental well-being and trust in digital payment systems that many people have come to rely on.

Distinguishing between a legitimate communication and a scam request can be a matter of vigilance. Always confirm unexpected collect requests with the sender via a different communication channel. Check for inconsistencies, such as mismatched UPI IDs or payee names before approving any transaction. If the QR code has been placed over an old one, is not clearly branded, or prompts you to enter your UPI PIN after scanning, think twice before proceeding. Remember, a genuine business will never ask for sensitive information such as your UPI PIN in this manner. Be mindful that not all requests from contacts are genuine — trust but verify is key to safeguarding against this growing scam threat.

Visual Intelligence:

BharatSecure's AI has identified this as a used in scams targeting Indian users.

Who Does UPI Scam via Fake Collect Requests & QR Codes Target?

General public across India

Red Flags — How to Identify UPI Scam via Fake Collect Requests & QR Codes

• Unexpected collect requests from contacts or businesses
• QR codes pasted over old ones or without clear branding
• Requests to enter UPI PIN after scanning a code
• Payee name or UPI ID mismatch in transaction details

What To Do If You Encounter UPI Scam via Fake Collect Requests & QR Codes

1. Report any suspected fraudulent transactions immediately by calling the cybercrime helpline at 1930 or visiting cybercrime.gov.in.
2. Inform your bank about the transaction in question using helplines such as SBI at 1800-11-1109 or HDFC at 1800-202-6161.
3. Change your UPI PIN and linked bank account passwords to safeguard against further unauthorized access.
4. Monitor your bank account statements regularly to catch any discrepancies as early as possible.
5. Educate friends and family about this scam to raise awareness and prevent others from falling victim.
6. Consider freezing your bank account temporarily if you suspect any unusual activity until the matter is resolved.

How to Report UPI Scam via Fake Collect Requests & QR Codes in India

• Call 1930 — National Cyber Crime Helpline (24x7)
• File a complaint at cybercrime.gov.in
• Contact your bank immediately if money was lost
• Call RBI helpline: 14440 for banking fraud

Frequently Asked Questions

What to do if I shared my OTP in a UPI scam?

Immediately report the incident to your bank and block your UPI account. Contact the cybercrime helpline at 1930 for further support.

How can I identify if a UPI request is a scam?

Look for red flags such as unusual requests, mismatched UPI IDs, or any pressure to act quickly.

How do I report this type of scam in India?

You can report it by calling 1930, visiting cybercrime.gov.in, and contacting your bank's fraud reporting service.

What steps can I take to recover money or protect my accounts after a scam?

Immediately report the transaction to your bank, change your UPI PIN, and monitor your accounts closely for unauthorized transactions.

Verify Any Suspicious Message

Check any suspicious message, link, or call for free at bharatsecure.app. BharatSecure uses AI to detect scams in real-time and protect Indian users.