UPI Fraud by Compromised Call Centres
INDIA — By BharatSecure Threat Intelligence Team ·
Verdict Summary
UPI Fraud by Compromised Call Centres shows strong scam indicators common in fraud targeting Indian users. Do not share OTPs, passwords, or payments — verify the source independently.
Risk score: 9/10 · Severity: Critical · Verdict: Suspicious
Scam Intelligence: UPI Fraud by Compromised Call Centres
Proprietary signals from BharatSecure's scam-tracking database.
| Top affected regions | Cambodia, general, rural, elderly |
| Last reported | Jun 12, 2026 |
How UPI Fraud by Compromised Call Centres Works
Overview: A wave of UPI frauds is now traced to call centres run from abroad—often Cambodia—where Indians are forced to defraud fellow Indians. These scams convince victims to reveal OTPs or UPI PINs, or to send money under false pretences, leading to direct account drain. How It Works: Victims receive calls or messages claiming to be from banks, RBI, or well-known apps (Paytm, PhonePe, GPay) warning about KYC expiry, transaction blocks, or rewards. Scammers, impersonating customer service, ask for sensitive data, including OTPs. Some are guided step-by-step to approve UPI collect requests. Calls are very convincing, using Indian dialects and spoofed numbers. Funds are instantly siphoned off to mule accounts or crypto wallets. India Angle: Almost all bank account holders, especially new digital users in Tier 2-3 cities, are at risk. These frauds deploy locally relevant messages, referencing SBI, ICICI, or local banks. Some scam call scripts even mimic Indian regional accents to build trust. Transactions happen via UPI apps popular all over India. Real Examples: - "Sir, this is SBI helpline, your UPI will be blocked unless you update KYC. Please share the OTP on your mobile now." - A Pune teacher lost Rs 80,000 after being misled into sharing his PIN over the phone. Red Flags: - Calls requesting OTP or PIN entry for verification - UPI collect request from unknown sources - High-pressure tactics such as 'act immediately or your account will be frozen' - Claims from customer care numbers not matching official contacts - Spelling errors or bad Hindi/English in SMS Protective Measures: - Never share UPI PIN or OTP with anyone - Validate calls from bank numbers through official websites - Ignore messages urging urgent action on digital payments - Set transaction alerts on your banking apps - Educate family elders and children about such calls If Victimised: - Contact your bank instantly to freeze accounts - Report fraud on cybercrime.gov.in and call 1930 - Save screenshots and call recordings as evidence Related Scams: - UPI collect request scams - SMS phishing by international syndicates - KYC update WhatsApp frauds
How This Scam Works — Detailed Explanation
Scammers utilize compromised call centres, often set up overseas in locations like Cambodia, to facilitate UPI fraud. They recruit individuals who act as agents to make calls to targeted victims in India. These agents use popular communication tools like WhatsApp and other VoIP services to maintain anonymity and avoid detection. Victims are typically chosen based on extensive data mining, which often includes victim demographics aligned with easily exploitable characteristics—like older individuals not familiar with technology—and this personal data is frequently harvested from previous data breaches or public records.
Once scammers establish contact with their victims, they employ deceptive tactics to create a sense of urgency and duress. Callers impersonate banking representatives or government officials, leveraging familiar names like the Reserve Bank of India, large banks, and popular payment apps such as Paytm, PhonePe, or Google Pay. They might fabricate scenarios around KYC requirements, changes in banking regulations, or exciting reward schemes that prompt weak psychological states, like fear or greed. Frequently, these communications include threats of account suspension or instant transaction blocks unless immediate action is taken, which leads victims to feel pressured to comply.
As the scam unfolds, victims are enticed into revealing their sensitive information — such as OTPs and UPI PINs — under misleading pretenses. For instance, a victim may receive a call claiming that their banking services are at risk due to failure to comply with KYC norms. In their anxiety to resolve the issue, they may voluntarily provide their OTP or PIN. Once this information is in the scammers' hands, they can swiftly drain the victim's account by executing unauthorized transactions, often disappearing before the victim realizes what has transpired. According to reports from the Ministry of Home Affairs (MHA), millions have fallen victim to this campaign, with ₹1,200 crores estimated to have been lost across incidents linked to UPI fraud in recent years.
The repercussions of UPI fraud conducted through compromised call centres are staggering, not just on an individual level but also contributing to a larger systemic issue in India. Victims frequently find themselves not only losing their hard-earned money but also struggling with the emotional fallout of the scam experience. The RBI and CERT-In have issued multiple alerts over the rising incidents of such scams, stating that they directly jeopardize the financial security of millions, especially as digital payment methods like UPI are on the rise. Such reporting highlights that each successful scam not only costs individuals but also undermines trust in India’s digital economy, potentially resulting in long-standing setbacks for users hesitant to engage in UPI transactions following such incidents.
Recognizing the red flags of these scams can help individuals distinguish between genuine communications and scams. Scams often originate from unknown numbers that do not match the official helplines of banks or regulatory bodies. Additionally, legitimate messages or calls from banks will never ask for sensitive information like OTPs or UPI PINs. Messages will typically exhibit proper language and context, unlike poorly phrased messages that are often key indicators of phishing attempts. Understanding these indicators equips users to assess the authenticity of any communication they receive, potentially guarding them against becoming another victim of UPI fraud perpetrated by compromised call centres.
Visual Intelligence:
BharatSecure's AI has identified this as a used in scams targeting Indian users.
Who Does UPI Fraud by Compromised Call Centres Target?
General public across India
Red Flags — How to Identify UPI Fraud by Compromised Call Centres
- Unknown callers claiming to be from your bank
- Requests for your OTP or UPI PIN
- Threats of account suspension without warning
- Poor language or odd SMS phrasing
What To Do If You Encounter UPI Fraud by Compromised Call Centres
- Report the incident immediately by calling the cybercrime helpline at 1930 or visiting cybercrime.gov.in.
- Contact your bank's customer service to freeze your account; for SBI call 1800-11-1109, and for HDFC call 1800-202-6161.
- Change your UPI PIN and Aadhaar-linked passwords right away to prevent further unauthorized access.
- Notify your family and friends about the scam to increase awareness and prevent them from falling victim.
- Monitor your bank statements and UPI transaction history actively for any unauthorized transactions.
- Consider reporting the call to local police if you feel threatened or if the scam was particularly aggressive.
How to Report UPI Fraud by Compromised Call Centres in India
- Call 1930 — National Cyber Crime Helpline (24x7)
- File a complaint at cybercrime.gov.in
- Contact your bank immediately if money was lost
- Call RBI helpline: 14440 for banking fraud
Frequently Asked Questions
- What to do if I shared my OTP in a UPI scam?
- Immediately contact your bank using the customer service helpline. For SBI, call 1800-11-1109, and for HDFC, call 1800-202-6161. Change your UPI PIN immediately and monitor your account for unauthorized transactions.
- How can I identify this specific scam?
- Look for red flags like unknown callers claiming to be from your bank, requests for personal information such as OTP or UPI PIN, and poorly worded messages. Legitimate banks will never ask for sensitive information.
- How do I report this type of scam in India?
- You can report such scams by calling the cybercrime helpline at 1930, visiting cybercrime.gov.in, or directly contacting your bank's fraud department.
- What steps can I take to recover my money after this scam?
- Immediately notify your bank regarding the unauthorized transactions and follow their recovery process. Document all communications and consider filing a report with the police and through cybercrime.gov.in to possibly aid recovery.
How This Scam Works — BharatSecure AI
Spreading fastA plain-language breakdown based on 87 real reported scams of this type.
| How they reach you | Unsolicited contact via WhatsApp messages/calls, SMS, and phone calls (vishing) is the dominant first-touch channel, frequently delivering malicious payment links, fake QR codes, or disguised UPI coll |
| How they gain your trust | Scammers establish credibility through impersonation of trusted authorities — bank officials, payment-app customer support, government schemes (RBI, PM-Kisan, income tax), or known relatives/friends — |
| How they take your money | UPI is the universal rail across all 87 records — exploited via collect requests where entering a PIN sends rather than receives money, malicious paym |
| Who they target | Targeting is broad-spectrum but with documented concentration on the elderly (digital unfamiliarity, dependency on caregivers), rural users and farmers (government-scheme pretexts), students and young |
- Urgency/scarcity bias — account deactivation, KYC expiry, or suspicious-transaction panic forcing immediate action
- Authority bias — deference to bank, RBI, government, or army-officer personas
- Trust-by-familiarity — cloned voices, family impersonation, and recognised brand logos exploit relational trust
- Greed/reward anticipation — cashback, prizes, refunds, trading profits, and 'receive money' framing that inverts the payment direction
- A UPI PIN is requested or required to 'receive' money — entering a PIN always sends money, never receives it
- Unsolicited calls/messages claiming urgent account, KYC, or transaction issues from 'bank officials', 'customer support', or government bodies
- Requests to install remote access or screen-sharing apps (e.g., AnyDesk/TeamViewer-type tools) to 'fix' a problem or process a refund
- UPI ID or display name mismatches — slightly altered VPAs, extra characters, or misleading names like 'Verified Merchant' or 'Bank Refund Dept'
- Pressure to scan unknown QR codes or click payment links sent via WhatsApp/SMS, often paired with prize, cashback, refund, or grant offers
Related Scams in India
Verify Any Suspicious Message
Check any suspicious message, link, or call for free at bharatsecure.app. BharatSecure uses AI to detect scams in real-time and protect Indian users.