UPI Fraud via Remote Access Apps
INDIA — By BharatSecure Threat Intelligence Team ·
Verdict Summary
UPI Fraud via Remote Access Apps shows strong scam indicators common in fraud targeting Indian users. Do not share OTPs, passwords, or payments — verify the source independently.
Risk score: 9/10 · Severity: Critical · Verdict: Suspicious
Scam Intelligence: UPI Fraud via Remote Access Apps
Proprietary signals from BharatSecure's scam-tracking database.
| Top affected regions | India, urban, elderly, small_business |
| Last reported | May 07, 2026 |
How UPI Fraud via Remote Access Apps Works
Overview: With UPI adoption skyrocketing across India, fraudsters increasingly trick users into installing remote access or screen-sharing apps. Once victims install these under the guise of 'customer support' or 'refund help', scammers gain control, siphoning funds or transferring money to their UPI handles without consent. Elderly users and small business operators are heavily targeted. How It Works: A scammer posing as a bank or service provider asks you to install an app like AnyDesk or TeamViewer, often under urgent pretense (e.g., failed UPI refund). Once you share the code or give access, the fraudster can see and operate your phone, opening UPI apps and making instant transfers to themselves. India Angle: This is highly prevalent in metro cities (Delhi, Mumbai, Bengaluru) and has started spreading to tier-2 towns with high digital transaction rates. Both English and Hindi pitches are common, but regional variants are growing, especially for businesses in southern and western India. Real Examples: - An elderly Pune couple receives a call: “This is Paytm Refund Desk, please install QuickSupport for fastest service.” Minutes after sharing access, Rs 43,000 vanishes from their UPI wallet. - WhatsApp: “Download AnyDesk from Google Play now for KYC issue.” Red Flags: - Requests to install remote access or screen sharing apps on your phone. - Caller or message claims urgent action for refunds or KYC. - Requests for UPI PIN entry while they are connected. - App download links sent over WhatsApp/SMS without prior request. Protective Measures: - Never install apps on strangers’ instructions. - No legitimate bank or company ever asks for remote control of your device. - Immediately terminate any unknown remote session. - Use two-factor authentication and monitor UPI account notifications. If Victimised: - Disconnect the internet and restart the device. - Inform your bank, UPI provider, and call 1930 immediately. - File an FI(R)/cybercrime complaint with all transaction details. Related Scams: - Google Pay or PhonePe customer care impersonation. - QR code scams for 'receiving' money but actually debiting. - Fake refund calls using screen sharing tactics.
How This Scam Works — Detailed Explanation
Scammers are becoming increasingly sophisticated in their methods to exploit UPI users in India. With the rapid adoption of UPI, which has seen transactions hit billions of rupees each month, fraudsters cleverly target vulnerable demographics, particularly the elderly and small business owners. They often initiate contact through phone calls or messages on platforms like WhatsApp, posing as representatives from banks or digital payment services. These scammers meticulously prepare their setup to create a façade of legitimacy, often using caller ID spoofing to make it appear as though they are calling from a government or banking institution. Upon establishing contact, they quickly identify personal information to initiate a false sense of trust.
To manipulate victims psychologically, scammers evoke feelings of urgency and fear. They might indicate that there is an urgent requirement for a refund, inform the victim of a suspicious transaction, or claim there are KYC (Know Your Customer) compliance issues that need to be resolved immediately. The psychological pressure they apply is designed to prevent victims from thinking critically about the situation. They will insist that the only way to resolve their issues is through installing a screen-sharing application such as AnyDesk or TeamViewer, which gives the scammer full control over the victim's device, including access to sensitive information like UPI PINs.
Once the victim complies and shares their screen, the scammer begins the execution of the fraud. For instance, the scammer may ask for the victim's UPI PIN under the guise of needing it for verification while they 'assist' in recovering funds. At this point, the scammer has free reign over the victim's financial applications and can instantly siphon off money to their own accounts. In a disturbing case earlier this year, an elderly couple from Uttar Pradesh lost ₹12 lakh when they were tricked into giving control of their phone over a supposed UPI refund process. Such schemes are not isolated incidents; statistics from CERT-In reveal that in 2022 alone, scammers made away with over ₹900 crore from UPI frauds.
The impact of UPI fraud via remote access applications in India is staggering. Reports indicate that in 2023, over 500 complaints were logged weekly, translating to significant financial losses across the country. The Ministry of Home Affairs and the Reserve Bank of India have heightened their awareness programs, urging citizens to be cautious. They emphasize that banks will never ask for your UPI PIN or ask you to download any third-party app for assistance. Always verify communications directly with your bank using recognized numbers. Despite these warnings, many Indian users remain unaware of the red flags and end up victims.
To confidently identify legitimate bank communications versus scams, one must be aware of certain telltale signs. Bank representatives will never request you to download remote access apps for assistance. If someone claims to be from the bank and begins the conversation mentioning refunds or requests for your UPI PIN while guiding you remotely, seek to verify that claim directly with your bank's official helpline. Never rush to act based on urgency; genuine bank personnel will not pressure you to provide sensitive information without first authenticating their request. When in doubt, it is always safer to end the call and follow up through official channels.
Visual Intelligence:
BharatSecure's AI has identified this as a used in scams targeting Indian users.
Who Does UPI Fraud via Remote Access Apps Target?
General public across India
Red Flags — How to Identify UPI Fraud via Remote Access Apps
- Asked to install AnyDesk/TeamViewer for bank refunds or KYC
- Remote access requested over phone/WhatsApp
- Urgent refund or security concern as pretext
- UPI PIN request during remote session
What To Do If You Encounter UPI Fraud via Remote Access Apps
- Report the incident immediately at the cybercrime helpline 1930 or through cybercrime.gov.in.
- Call your bank's helpline (SBI 1800-11-1109, HDFC 1800-202-6161) to block your UPI services.
- Change your UPI PIN and online banking credentials right away.
- Inform family members or colleagues about the incident to prevent them from falling victim.
- Monitor your bank statements for any unauthorized transactions regularly.
- Consider enabling app and transaction notifications for real-time alerts on your account activities.
How to Report UPI Fraud via Remote Access Apps in India
- Call 1930 — National Cyber Crime Helpline (24x7)
- File a complaint at cybercrime.gov.in
- Contact your bank immediately if money was lost
- Call RBI helpline: 14440 for banking fraud
Frequently Asked Questions
- What to do if I shared my OTP in a UPI scam?
- Immediately inform your bank using their helpline (SBI 1800-11-1109, HDFC 1800-202-6161) and request to block your account. Further, report the incident at cybercrime.gov.in and consider filing a police complaint.
- How can I identify if someone is trying to scam me with remote access apps?
- If a caller requests you to download apps like AnyDesk or TeamViewer under the pretext of offering financial help or refunds, it is a scam. Legitimate financial institutions will never require remote access to your device.
- How do I report a UPI fraud attempt in India?
- You can report UPI fraud by calling the cybercrime helpline at 1930, visiting cybercrime.gov.in, or informing your bank's fraud department directly.
- What steps should I take to recover money lost from this scam?
- Contact your bank immediately to report the fraud and request freezing of transactions. Follow up with the cybercrime helpdesk for further instructions, and provide all necessary details about the transaction.
How This Scam Works — BharatSecure AI
Spreading fastA plain-language breakdown based on 100 real reported scams of this type.
| How they reach you | Observed primary contact occurs via unsolicited phone calls, WhatsApp/SMS messages, and social media/dating platforms, where fraudsters impersonate bank officials, customer support, government agents, |
| How they gain your trust | Trust is reportedly established through impersonation of authority (banks, RBI, PM-Kisan, army officers) or emotional bonding (love-bombing, family/friend impersonation), often reinforced by AI deepfa |
| How they take your money | UPI is the dominant rail across all records, primarily via disguised 'collect/request money' notifications tricking victims into entering their PIN, d |
| Who they target | Documented targets span the general population but concentrate on the elderly and digitally inexperienced (often via caregiver dependency), urban professionals, students, homemakers, small business ow |
- authority bias (impersonating banks/government/officials)
- urgency and scarcity (account frozen, limited-time offer, emergency)
- trust/reciprocity exploitation (familiar voices, love-bombing, small initial payouts)
- Receiving a UPI 'collect/request money' notification and being asked to enter your PIN to 'receive' funds (PIN is never needed to receive money)
- Unsolicited calls/messages claiming account freeze, KYC expiry, or suspicious transaction, pressuring you to share OTP, UPI PIN, or click a link
- Requests to install remote-access/screen-sharing apps (AnyDesk, TeamViewer) for 'support' or 'refund' assistance
- Mismatched or misleading recipient names/VPAs (e.g., 'Verified Merchant', 'Bank Refund Dept') or slightly altered UPI IDs
- Pressure via emotional urgency, deepfake voice/video of familiar people, forged payment screenshots, or too-good-to-be-true offers (free recharge, prizes, grants, loans, high-return investments)
Related Scams in India
Verify Any Suspicious Message
Check any suspicious message, link, or call for free at bharatsecure.app. BharatSecure uses AI to detect scams in real-time and protect Indian users.