India has seen an extraordinary rise in digital payments, fueled by the widespread adoption of the Unified Payments Interface (UPI). However, this growth has been accompanied by a significant increase in UPI Frauds. According to the Ministry of Finance, during the fiscal year 2024 (FY24), India reported approximately 1.34 million cases of UPI Frauds, resulting in losses of ₹1,087 crore. Even more concerning, in the first half of FY25 (up to September 2024), about 6.32 lakh incidents were reported, leading to losses totalling ₹485 crore.
The post-pandemic era has seen UPI become a favored mode of transaction due to its convenience for both large and small payments. Yet, its massive user base makes it a prime target for cybercriminals. Let’s explore the common methods of UPI fraud and practical steps to safeguard yourself.
Table of Contents
Common Methods of UPI Frauds
1. Phishing Links
Fraudsters often use phishing links to trick victims into revealing sensitive information. Here’s how they operate:
- Spam Links: Fraudsters send malicious links via SMS, emails, or other communication platforms. These links often lead to fake websites that install malware, steal banking credentials, or prompt users to enter their UPI PIN.
- Impersonation: Scammers impersonate trusted entities like banks, e-commerce platforms, or service providers, convincing victims to share sensitive details or authorize transactions.
2. QR Code Manipulation
QR codes, designed for convenience, have also become tools for fraud:
- Fake QR Codes: Fraudsters send QR codes claiming they offer cashback or refunds. Scanning these codes may lead to phishing websites or install malware that steals credentials.
- Tampered QR Codes: Scammers place fake QR codes over legitimate ones, such as on parking meters or donation boxes. Payments made using these codes go directly to the fraudsters’ accounts.
- Malware Installation: Some QR codes are designed to install malware that intercepts OTPs (one-time passwords) or accesses the victim’s UPI app, enabling unauthorized transactions.
3. OTP Theft
One of the more sophisticated methods involves stealing OTPs:
- Case Example: Recently, 40-50 doctors in Gurugram fell victim to a scam. Posing as representatives of an organization sending Diwali gifts, fraudsters convinced the doctors to verify their identity online. Victims were asked to dial a number, which activated call forwarding, redirecting incoming calls to the scammers. When WhatsApp sent a voice OTP to verify login attempts, the fraudsters intercepted it, gained control of the accounts, and used them to request money from the victims’ contacts.
How to Stay Safe from UPI Frauds
With fraud tactics evolving rapidly, staying vigilant is essential. Here are practical tips to protect yourself:
- Avoid Clicking on Unknown Links – Never open links from unknown senders or unverified sources. Avoid downloading apps or files from suspicious links, as these may install malware on your device.
- Be Cautious with QR Codes – Remember, QR codes are meant for sending money, not receiving it. If someone asks you to scan a QR code to receive money, be alert—this is a common scam tactic. Double-check QR codes before scanning them, especially in public places like parking lots or donation boxes.
- Use Separate Bank Accounts for UPI – Link your UPI app to a separate bank account or wallet with limited funds. This minimizes potential losses in case of fraud. Set daily transaction limits on your UPI app for additional security.
- Keep Your UPI App Updated – Regularly update your UPI app to access the latest security features. Use only trusted apps and platforms for UPI transactions.
- Verify Requests – If you receive a request from your bank or any financial entity, verify it by contacting their official customer care number. Stay informed about the latest fraud tactics through reliable sources.
Steps to Take If You Fall Victim to UPI Fraud
Despite precautions, if you fall prey to a scam, swift action can help mitigate losses. Follow these steps:
1. Block Communication – Immediately block the fraudulent number to prevent further communication.
2. Inform Your Bank – Notify your bank to block your account and halt unauthorized transactions. Report the fraudulent transaction as soon as possible. Early reporting increases the likelihood of recovering your money.
3. Leverage NPCI’s Redressal Mechanism – File a complaint with the National Payments Corporation of India (NPCI), providing details such as the merchant’s name and QR code information. For those unfamiliar, NPCI, established in 2008 by the Reserve Bank of India (RBI) and the Indian Banks’ Association (IBA), manages payment systems like UPI, IMPS, and RuPay cards.
4. Call the Cybercrime Helpline – Dial 1930, the national cybercrime helpline number, to report the incident and request that your bank account be blocked. Alternatively, you can also lodge a complaint on cybercrime.gov.in.
5. File an FIR – Visit your local police station to file a First Information Report (FIR) and formally report the scam.
Conclusion
As India continues its journey toward becoming a cashless economy, the rise in UPI frauds is a stark reminder of the need for vigilance. While digital payments offer unparalleled convenience, they also require users to be cautious and informed. By understanding common fraud tactics, adopting best practices for online safety, and acting promptly in case of fraud, you can protect yourself and your hard-earned money.
Stay informed, stay alert, and make digital payments securely!
Check out my other article on the top 7 steps to secure your e-wallets.
Do follow me on Linkedin and Quora for more insightful posts related to personal finance, money management, investments, debt management, etc.
