FRAUD ALERT

The unified payments interface, or UPI, has changed the way Indians pay for things — splitting a restaurant bill, paying the vegetable vendor, booking a train ticket and sending money to family. What used to involve queues, cheques or, at the very least, a bit of faff now happens in seconds, almost without thinking.

 

The system launched for customers with 21 banks on 25 August 2016. In the decade since, UPI has grown at a pace that is genuinely hard to get your head around. Transaction value has climbed from a modest ₹7,000 crore in FY16-17 to around ₹314,000 crore in FY25-26 — more than 4,000 times over. 

 

To put the current scale in perspective, National Payments Corporation of India (NPCI)'s own figures show that in May 2026 alone, over 23.2bn (billion) transactions worth close to ₹299,000 crore took place on the UPI ecosystem.

 

But here is the catch: the very things that make UPI so convenient — its speed, its simplicity, the fact that almost everyone accepts it now — are exactly what fraudsters have learned to exploit.

 

It is worth being clear about one thing from the outset: UPI itself is not the scam. What is actually happening, in nearly every case, is that cybercriminals are manipulating the person on the other end — tricking them into authorising a payment, convincing them a fake transaction has gone through, coaxing out sensitive details or getting malicious software onto their phone.

 

A recent case out of Delhi shows just how simple this deception can be. A 22-year-old man, named by police as Nikhil Yadav, was arrested after allegedly using doctored UPI payment screenshots to cheat shopkeepers.

 

According to police, his method was almost embarrassingly simple: he would make a small purchase, show the shopkeeper a screenshot suggesting the payment had gone through and walk out with the goods before anyone thought to checking.

 

It did not stop there, either. Police say he also stole phones from some of the shopkeepers he had targeted and went on to carry out further unauthorised transactions using them.

 

The lesson for anyone running a shop or stall is a simple one: a screenshot is not proof of payment. Full stop.

 

However convincing it looks, a screenshot doesn't tell you whether the money has actually landed in your account. The only way to know is to check the transaction notification yourself, or check your UPI app or bank account, before you hand over the goods.

 

This matters especially for smaller retailers, where things are busy and a customer pressing "I paid the money, just check your phone" can feel like reason enough to wave them through.

 

Take those few extra seconds. Check carefully whether you have actually received the same amount. It costs you nothing and it might save you a great deal.

 

Quick response (QR) codes have practically become shorthand for UPI itself — scan, pay, done, no need to type out a UPI ID or account number.

 

The trouble is, fraudsters can easily tamper with them.

 

A criminal might simply paste a fake QR code directly over a genuine one — at a shop counter, a car park, a restaurant table, even the noticeboard of a housing society. The payer scans it without a second thought, doesn't properly check the recipient's name and the money goes somewhere it was never meant to go.

 

There is another version of this trick, too: someone sends you a QR code over WhatsApp, insisting that scanning it will trigger a refund, a cashback, or some payment owed to you.

 

Here is the rule worth committing to memory: you never need your UPI PIN (personal identification number) to receive money.

 

Your PIN exists for one purpose only — to authorise money leaving your account. So, if anyone ever tells you to ‘scan this code and enter your PIN to get your refund’, stop right there. 

 

What is actually about to happen is money moving out of your account, not into it. NPCI is unambiguous on this point: your UPI PIN should never be shared with anyone and its sole function is authorising outgoing transactions.

 

There is a quieter, sneakier risk too and it starts with something as innocent as a Google search.

 

Say a UPI payment goes wrong and you search online for your bank's or payment app's customer-care number. Fraudsters know people do this in a hurry, often while anxious about their money and they have built fake websites, adverts and phone numbers designed to catch exactly that moment.

 

You call the number. Someone answers, sounding entirely professional and politely requests you to install a ‘remote access’ app, or asks for an OTP, your card details, or approval for a UPI request. Unsettlingly, they may already know your name, your mobile number, even details of your recent transaction which only makes the whole thing feel more legitimate than it is.

 

Don't ever assume a number that turns up in a search result is genuine. Go instead to the customer-care details listed inside your actual banking or payment app, or on the institution's verified website — nowhere else.

 

UPI's payment request or collection feature is another avenue fraudsters have learned to exploit. You might get a message saying a payment is pending, or that money is ‘waiting to be collected’. You are told to approve the request and enter your PIN.

 

Except approving that request can just as easily authorise a payment out of your account, not into it.

 

This is exactly why it pays to actually read the transaction screen before entering your PIN — who is receiving the money, how much is being taken and why are you being asked to authorise it at all. 

 

Don't approve anything simply because a caller insists it is needed to release a refund, salary payment, prize, loan, or cashback. You never need to enter your PIN to receive genuine payments in your account.

 

Unfortunately, losing money to a UPI scam is only the beginning of the story. Investigations into cyber fraud routinely uncover elaborate money trails — funds passed through newly-opened or dormant accounts, so-called mule accounts, payment gateways, cash withdrawals and transfers scattered across dozens of different beneficiaries.

 

In one investigation by the directorate of enforcement (ED), funds were found to have moved within hours through a first layer of dormant and freshly opened accounts, before being split across more than 400 separate beneficiary accounts — via bank transfers, cash withdrawals, self-cheques and payment gateways. That trail eventually led investigators to a network of interconnected business entities engaged in transactions exceeding ₹27,850 crore and cash deposits totalling around ₹2,904 crore.

 

It is a stark illustration of why speed matters so much when reporting fraud. Within minutes, money can be moved several times over, sometimes before a victim has even understood or realised what has happened.

 

Worth noting, too: the Rajasthan High Court (HC) recently made an important distinction between a genuine mule account and an entirely innocent one that a disputed transaction happens to have passed through. The HC held that freezing an account needs a direct link to the alleged crime and that freezing more than the disputed amount can be disproportionate.

 

There is a wider lesson here for ordinary bank account-holders: your account can end up caught up in a fraud investigation even if you are not the one who was scammed. Never let anyone use your bank account or UPI ID to receive or move money on their behalf — however small a favour it seems at the time.

 

The first rule, above all else: don't sit on it or seek and wait for someone’s help to resolve it for you.

 

Contact your bank immediately and report the unauthorised transaction. Report it too through the national cybercrime reporting portal (NCRP), or by calling the cyber fraud helpline on 1930 — the government's own guidance is clear that victims of financial cyber fraud should report immediately through this number.

 

Hold on to everything — the transaction ID, screenshots, phone numbers, UPI IDs, any messages or emails. Whatever you do, don't delete your conversation with the fraudster; you will likely need it.

 

The customer-protection framework from Reserve Bank of India (RBI) also stresses reporting unauthorised transactions without delay. In cases the rules cover, reporting within three working days can make a real difference to how the customer liability is decided.

 

First, never share your UPI PIN, OTP or banking credentials with anyone. No genuine bank employee will ever ask you for your PIN.

 

Second, always verify before you pay — check the recipient's name and the amount shown on screen before you authorise anything. Many small vendors use someone else’s UPI account (mainly the ‘owner’ of the stall). So, when you scan the code, ask the vendor for the recipient's name (no need for you to say it out loud). If he confirms what you see on your screen, then only pay. 

 

Third, remember that receiving money never requires your PIN. If someone asks you to enter it to ‘receive’ a refund or payment, treat that as a major red flag.

 

Fourth, if you are a merchant, verify payments independently. A screenshot, a forwarded SMS, or someone's word is not proof that the money has actually reached you. Many shopkeepers are using speaker devices that give instant voice payment alerts. If you are not using one, consider ordering it. 

 

Fifth, act the moment something goes wrong. Call your bank, dial 1930, don't delay. The faster you report it, the better the odds of tracing or even stopping the money before it disappears further.

 

No doubt, UPI has made payments in India faster and more inclusive than most of us could have imagined a decade ago. But convenience, especially the use of newer tech solutions, is never meant to replace caution.

 

The safest UPI transaction is not the one completed in the blink of an eye — it is the one where you pause, just for a moment, check who you are paying, confirm the amount and understand exactly what you are about to authorise.

 

For a fraudster, those few seconds of hesitation are often the only thing standing between a scam that works and one that doesn't.