Scam awareness
Almost every UPI scam comes down to one move: getting you to scan, tap or type your PIN while you believe money is coming in, or that someone official needs it. Learn the 15 common tricks once and they stop working.
The one rule
ENTER UPI PIN
You enter your UPI PIN only to pay. There is no PIN to receive money, no QR to scan to get paid, and no “enter PIN to claim”.
Before the PIN screen, your UPI app shows the name on the payee's bank account. It's the one name nobody can type in. If it isn't who you meant to pay, stop.
Pay by scanning a code you can see or typing an ID you trust. Decline any request, link or call that starts a payment you didn't expect.
Not your bank, not police, not customer care, not a buyer. Anyone who asks for them, or wants a screen-sharing app on your phone, is the scam.
Each one starts with a line that sounds reasonable. Read what they say, what's really happening, and the one thing that gives it away.
Shops, stalls, petrol pumps — where a QR sits in the open
A QR sticker pasted neatly over the shop's own code.
What's really happening: Someone has covered the shop's QR with their own. Every customer who scans it pays the fraudster, and the shopkeeper finds out at the end of the day.
The tellYour app shows a person's name, not the shop's — or a name the shopkeeper doesn't recognise.
“Done, see — ₹2,400 sent.” The customer holds up a phone with a green tick.
What's really happening: The screen is a screenshot, an edited image, or a fake app that plays a success animation. No money has moved.
The tellNothing arrived in your own bank app or soundbox. A screen on their phone proves nothing.
“Rs 5,000 credited to your a/c XX1234 by UPI.” — from a normal mobile number.
What's really happening: Anyone can type an SMS that looks like a bank's. It is often sent just before “I paid too much, please return the extra.”
The tellReal bank messages come from a sender name like AD-HDFCBK, not a ten-digit mobile number — and the balance in your bank app hasn't changed.
OLX, Facebook Marketplace, WhatsApp groups
“I'm posted far away, army officer. I'll pay the advance now — just scan this QR and enter your PIN to receive it.”
What's really happening: The QR is a payment request from them. Scanning and entering your PIN sends your money to them. They often repeat it “because it failed”, doubling the amount each time.
The tellYou were asked to scan or enter a PIN to get money. That never happens — to receive, you only share your UPI ID or your own QR.
“Sorry, I sent ₹15,000 instead of ₹1,500 by mistake. Please return the difference.”
What's really happening: Nothing extra arrived — you were shown a fake screenshot or SMS. Or money did arrive, from a stolen account, and returning it makes you part of the trail.
The tellCheck your bank app, not their screenshot. If money really came by mistake, let your bank reverse it — never send it on to a new account.
Phone calls, SMS, WhatsApp, video calls
“This is your bank. Your account will be blocked tonight. Tell me the code we just sent to update your KYC.”
What's really happening: The code is an OTP that lets them register your UPI on their own phone, or approve a payment out of your account.
The tellUrgency plus a request for an OTP, PIN or password. No bank asks for these on a call — ever.
You search “Paytm refund helpline”, call the top number, and a polite agent asks you to install AnyDesk so they can “process the refund”.
What's really happening: Fraudsters buy ads and post fake numbers under brand names. Once a screen-sharing app is on, they watch you type your PIN and move the money themselves.
The tellA helper who needs to see your screen, or wants you to pay to get a refund. Use the number printed inside the app or on your card.
“Dear customer, your electricity will be disconnected at 9:30 pm. Call our officer or pay here.”
What's really happening: The number or link leads to a fraudster, who sends a pay request or a screen-sharing app. Collect requests between people were stopped in October 2025, so they now pose as merchants or send links.
The tellA same-night deadline from a mobile number. Pay bills only from your app's bill-payment section or the board's own website.
A video call from someone in uniform: “A parcel in your name has drugs. You're under digital arrest. Transfer your savings for verification or be jailed.”
What's really happening: There is no such thing as a digital arrest. Police and agencies do not investigate over video calls or ask you to move money to “verify” it.
The tellBeing told to stay on the call, not tell family, and move money. Hang up and call 1930 or your local police station yourself.
“It's me, I'm stuck at the hospital, send ₹8,000 to this number, will return tonight.”
What's really happening: A hacked account, a new number with a friend's photo, or a cloned voice. The money goes to a stranger.
The tellA new number or a different UPI ID than the one you know. Call them back on the number you already have before you pay.
Messages that promise money
“Congratulations! ₹10,000 cashback credited. Tap to claim and enter your UPI PIN.”
What's really happening: The page is a payment screen dressed up as a reward. Your PIN approves a payment out of your account.
The tellReal cashback appears on its own. Any page asking for your PIN to receive money is taking it.
“Earn ₹3,000 a day liking videos. Here's ₹150 for your first task. For bigger tasks, deposit ₹5,000.”
What's really happening: Small payouts build trust, then deposits get locked behind “taxes”, “upgrade fees” or a “negative balance” until you stop paying.
The tellA job that asks you to pay in. Real employers pay you; they never ask for a deposit to release your earnings.
“Join our VIP trading group — 30% a week, guaranteed. Our app shows your profits live.”
What's really happening: The app is fake and the profits are numbers on a screen. Withdrawals are always one fee away.
The tellGuaranteed returns and an app you can't find from a SEBI-registered broker.
Offers to “use” your UPI or bank account
“Just receive some payments for our business and send them on. Keep 10% commission.”
What's really happening: You become a money mule, passing on money stolen from other victims. Your account gets frozen and you can face a police case.
The tellAnyone offering to pay you for letting money pass through your account. Never share your UPI, SIM or bank login with anyone.
₹20,000 really lands in your account. A call follows: “Sent by mistake, please send it back — to this other UPI ID.”
What's really happening: The money was stolen. Sending it to a new account launders it through you, and when the victim complains, your account is the one frozen.
The tell“Return it to a different ID.” Tell your bank about a credit you don't recognise and let them reverse it.
Always
Never
Ask these in order, before the PIN. A “no” anywhere means stop and check.
You're scanning a code you can see, or paying an ID you already know. Not a link, not a request, not a caller's instructions.
If you're about to enter your PIN, yes. If you were told you'd receive money, stop here.
The bank-registered name your app shows matches the shop or person. A different name means ask first.
Check the figure before the PIN. A code can carry an amount already set.
If you've been scammed
Money moves on quickly from one account to the next. Reporting straight away gives banks the best chance to freeze it.
The National Cyber Crime Helpline. The first hours matter most: a quick report lets banks try to freeze the money before it moves on. You can also report at cybercrime.gov.in.
cybercrime.gov.inCall your bank's number from its app or your card and report the transaction. Raise a complaint in your UPI app's help section too. If money left without you sharing your PIN or OTP, reporting within three working days of the bank's alert means you shouldn't carry the loss, under RBI rules.
rbi.org.inScreenshots of the chat and the payment, the UTR or reference number, the UPI ID paid, the caller's number, and the time. Don't delete the conversation.
Report the call, SMS or WhatsApp on Chakshu on the Sanchar Saathi portal, so the number can be cut off before it reaches someone else.
sancharsaathi.gov.inSend this to one person who'd fall for it. It takes ten seconds.
Checked September 2026 against NPCI's circular on person-to-person collect requests (July 2025), RBI's rules on customer liability for unauthorised electronic transactions (July 2017), the National Cyber Crime Reporting Portal and DoT's Sanchar Saathi. This page is general guidance, not legal advice. MSRX UPI Desk is not affiliated with NPCI, RBI, any bank or any payment app.
