UPI fraud is the fastest-growing digital scam in India. In 2025 alone, over 95,000 UPI-related fraud cases were reported to the RBI. Scammers exploit the simplicity of UPI to trick users into sending money while believing they are receiving it.
Fraudsters use four primary methods to steal money via UPI. Understanding each one is your best defense.
The scammer sends you a UPI collect request with a deceptive message such as "Refund Rs 5,000" or "Cashback Credit." The request appears as though you are about to receive money, but a collect request is always a debit. The moment you enter your UPI PIN to "accept" the refund, the money leaves your account and goes directly to the fraudster. This is the most common UPI scam in India, accounting for nearly 40% of reported cases.
In this scheme, the fraudster shares a QR code and tells you to scan it to "receive" a payment. In reality, scanning a QR code in any UPI app always initiates a payment from your account. There is no mechanism in UPI to receive money by scanning a QR code. Scammers commonly use this on OLX, Facebook Marketplace, and similar platforms where buyers and sellers interact directly. Once you scan the code and enter your PIN, the money is gone.
The fraudster poses as a bank official or payment app support agent and convinces you to install a remote access app such as AnyDesk, TeamViewer, or QuickSupport. Once you share the access code, the scammer can see your entire screen in real time. They watch you open your UPI app, capture your PIN as you type it, and then initiate transactions from your device. Some variants install the remote app silently through a link sent via SMS or WhatsApp.
Scammers create fake customer care numbers that appear in Google search results for queries like "PhonePe helpline" or "GPay customer support." When you call, they impersonate official support staff, claim your account has been compromised, and guide you through steps that actually authorize payments from your account. They may ask you to forward an SMS, share an OTP, or download a verification app. Legitimate payment apps never ask for your PIN, OTP, or remote access.
These are realistic examples based on messages reported by victims. If you receive anything similar, do not respond or follow the instructions.
"Your Flipkart refund of Rs 2,999 is ready. Accept this UPI collect request to receive money. Request expires in 10 minutes."
Scam signal: Collect requests debit money. Genuine refunds are credited automatically without any action from you.
"I'm sending the payment for the item. Please scan this QR code to receive Rs 15,000. I've already entered the amount."
Scam signal: QR codes only send money, never receive. Scanning this would debit Rs 15,000 from your account.
"PhonePe Support: Your account has been compromised. Install AnyDesk for verification. Your access code: 123456789. Call us immediately at +91-XXXXXXXXXX."
Scam signal: No legitimate app will ever ask you to install remote access software. PhonePe support is only available in-app.
"Google Pay Helpline: We have detected suspicious activity on your account. Send Rs 1 to verify your identity via UPI ID verify.gpay@oksbi. Your account will be blocked in 24 hours if not verified."
Scam signal: Google Pay never contacts users to verify identity via UPI transactions. Any "verification payment" is a scam.
If you spot any of these warning signs, stop immediately and do not proceed.
You NEVER need to enter your UPI PIN to RECEIVE money.
Your UPI PIN is equivalent to your ATM PIN. It authorizes payments from your account. Receiving money is a passive action that happens automatically. If anyone asks you to enter your PIN, scan a QR code, or approve a collect request to "receive" money, it is a scam without exception.
If you receive a suspicious collect request or QR code, close it immediately. Do not approve, accept, or scan anything.
In your UPI app (Google Pay, PhonePe, Paytm), block the sender's VPA and report the request as spam or fraud.
File a complaint at cybercrime.gov.in or call the national helpline 1930. Include screenshots and transaction IDs if money was lost.
If money was debited, call your bank's fraud helpline within the first hour. Request an immediate freeze on the recipient's account.
Visit your local police station and file a First Information Report. This is essential for the investigation and any potential recovery.
Share the scam details with friends and family. Forward the scam card from Savdhaan AI to help others recognize similar fraud attempts.
Our AI-powered scanner analyzes suspicious messages in seconds using multiple intelligence layers.
Our AI is trained on thousands of real UPI scam messages. It recognizes common phrasing patterns like "accept collect request to receive refund" and flags them instantly.
We extract UPI IDs, phone numbers, and URLs from messages and cross-reference them against known fraud databases and reported scam VPAs.
Scam messages frequently use artificial urgency ("expires in 10 minutes", "account will be blocked"). Our classifier weights these pressure tactics as strong fraud indicators.
Extracted entities are checked against 6+ threat intelligence sources including PhishTank, Google Safe Browsing, and community-reported scam databases.
Yes. A UPI collect request is a payment demand, not a credit. When you approve a collect request and enter your UPI PIN, money is debited from your account and sent to the requester. Scammers disguise collect requests as refunds or rewards to trick you into approving them. Never approve a collect request from someone you do not know, and remember that you never need to enter your PIN to receive money.
No, absolutely not. Receiving money via UPI does not require you to enter your PIN, scan a QR code, or approve any request. Money sent to your UPI ID or linked bank account is credited automatically. If anyone asks you to enter your PIN to “receive” a payment, it is a scam. Your PIN is only needed when you send money.
Most UPI apps allow you to block specific senders. In Google Pay, tap the collect request, select the sender, and choose “Block.” In PhonePe, go to the request, tap the three-dot menu, and select “Block & Report.” In Paytm, navigate to the collect request and choose “Decline & Block.” You can also report spam requests directly to NPCI through the app’s built-in reporting feature.
Act immediately: (1) Report the fraudulent transaction in your UPI app within 24 hours. (2) Call your bank’s customer care and request a chargeback. (3) File a complaint on the National Cyber Crime Portal at cybercrime.gov.in or call 1930. (4) File an FIR at your local police station with transaction details and screenshots. The faster you report, the higher the chance of recovery—banks can freeze the recipient’s account if alerted quickly.
No. Scanning a QR code in any UPI app initiates a payment from your account, not a credit to it. There is no such thing as a “receive money” QR code. If a buyer asks you to scan their QR code to “receive” payment, they are attempting to steal money from you. Legitimate payments are sent directly to your UPI ID or phone number without any action required from you.
Fake bank messages with malicious links designed to steal your credentials.
Fraudsters posing as bank officials to extract your one-time passwords.
Fake e-commerce sites and marketplace sellers who take payment but never deliver.
Fraudulent crypto, stock tips, and Ponzi schemes promising guaranteed returns.
Impersonating police or CBI to threaten arrest and demand immediate payment.
Fake work-from-home offers requiring upfront fees or personal information.
Paste it into our free AI scanner. Get an instant risk assessment backed by 6+ threat intelligence sources.