Phishing to QR code scam: Key steps to avoid some common UPI-related frauds

As UPI transactions rise, so do frauds. From phishing to fake QR codes, here's how scammers operate and key steps to protect yourself from financial fraud

UPI (Unified Payments Interface) has become an integral part of daily transactions in India, yet with its increasing popularity, so have UPI frauds. According to the latest NPCI data, UPI reached a new milestone in January 2025, recording 16.99 billion transactions with a total value of Rs 23.48 trillion.

 

According to RBI data in FY 2023-24, banking sector-related fraud cases surged by nearly 300 per cent, reaching 36,075 cases.

 

Understanding the common types of UPI fraud is crucial to protect yourself from financial losses.

 

Common types of UPI frauds

 

Phishing scams: Fraudsters deceive users into revealing their UPI PIN or OTP (One-Time Password) through fake emails, SMS, or phone calls, often impersonating bank representatives.

 

 

Fake UPI apps: Scammers create counterfeit UPI apps that closely resemble legitimate ones, tricking users into downloading them and compromising their personal and financial data.

 

QR code scams: Fraudsters may ask users to scan a QR code to receive money, but the QR code actually generates a payment request that deducts money from the user's account.

 

Request money scams: Scammers send 'request money' links disguised as payment links. When users click the link and enter their UPI PIN, they unknowingly authorise a payment to the fraudster.

 

Reward scams: Scammers contact users via phone calls, messages, or social media, offering rewards or job opportunities to lure them into sharing their UPI details.

 

Fake payment screenshots: Fraudsters create fake UPI payment confirmation screenshots and send them to users, making them believe they have received a payment.

 

UPI ID fraud: Scammers create fake UPI IDs resembling genuine ones to deceive users into sending money to the wrong account.

 

Impersonating genuine sellers: Scammers pose as shopkeepers or online sellers and request prepayment via UPI, but they never deliver the product or service.

 

Unauthorised access via screen mirroring apps: Fraudsters impersonate bank employees or customer care representatives and ask users to download screen mirroring apps. These apps give scammers full access to the user’s phone, enabling them to conduct unauthorised financial transactions.

 

Key steps to avoid UPI frauds

  “I believe prevention is the best protection. Never share your UPI PIN, OTP, or banking details with anyone, even if they claim to be from your bank or a payment service provider. Fraudsters often create a sense of urgency, pressuring victims into making quick decisions. One golden rule is that banks or payment platforms never call customers asking for sensitive details. Another common scam is where fraudsters send a UPI ‘payment request,’ making victims believe they are receiving money, but in reality, they are authorising a debit. One should always verify before approving any transaction. Additionally, people should avoid clicking on unknown links or downloading third-party apps for customer support, as these can lead to remote access scams,” said Vishal Gehrana, principal associate at Karanjawala & Co. & Advocate-on-Record, Supreme Court of India.

 

If someone does fall into a UPI fraud trap, immediate action is the key. The first step is to report the fraud within 24 hours to the National Cyber Crime Helpline (1930) or through the official portal www.cybercrime.gov.in. The sooner a complaint is filed, the higher the chances of recovering the lost amount. Simultaneously, the victim should inform their bank and NPCI under RBI’s liability guidelines. In some cases, if the fraud is reported promptly, the bank may be liable to compensate the victim. For stronger legal action, filing an FIR with the local police or cybercrime cell is essential. UPI fraud falls under the provisions of the Information Technology Act, 2000 and Indian Penal Code (now Bhartiya Nyaya Sanhita) on cheating and identity theft, allowing agencies to investigate and take appropriate criminal action against the fraudsters.