UPI and Digital Payment Fraud: How to Recognise It and What to Do

Almost every payment fraud depends on two things: making you feel urgent, and getting you to either enter your PIN or share a code. The technology varies, the story varies, the caller’s claimed identity varies — and underneath, essentially all of it reduces to pressure plus one of those two actions. If you internalise that single pattern, you do not need to memorise the list of scams, because you will recognise the shape of a new one.

The most important fact to know, and the one that stops the largest number of frauds, is this: you never enter a UPI PIN to receive money. A PIN authorises money leaving your account. Any instruction that involves entering your PIN “to receive a refund” or “to confirm a credit” is a fraud without exception, regardless of who appears to be asking.

What are the recurring patterns?

Described at the level of what the victim experiences, so you can recognise them in the moment.

The collect-request pattern deserves the most attention because it exploits a genuine confusion in the interface. UPI allows someone to request money from you, and approving that request with your PIN sends money out. Fraudsters send collect requests labelled to look like incoming payments — “refund”, “cashback”, “prize” — and a person in a hurry taps approve. Read what the screen says you are authorising, not what the sender called it.

The fake customer-care pattern is the one that catches careful people. Someone with a genuine problem searches for a helpline, finds a number that fraudsters have placed in search results or on a listing site, and calls it themselves — which removes all suspicion, because they initiated the contact. Always take support numbers from inside the official app or from the bank’s own website, never from a search result.

Why does urgency work so well?

Because deliberation is the defence, and urgency removes it. Every element of a fraud call is engineered to prevent you from pausing: a deadline, a threat of an account freeze or legal action, a claim that someone is misusing your identity, a relative in trouble. The emotional state produced — alarm, embarrassment, hurry — is itself the attack.

The isolation step is worth teaching to anyone in your household, particularly older relatives. No bank, no police force and no government department asks you to keep a conversation secret from your own family. If secrecy is requested, that alone is sufficient grounds to end the call.

What are the rules that keep you safe?

1. A PIN only ever sends money. Never enter it to receive anything. This one rule prevents a large share of UPI fraud.
2. Never share an OTP with a person. OTPs are for you to type into an app or website yourself. Nobody legitimate asks you to read one out.
3. Never install an app someone on a call asks you to install. Remote-access and screen-sharing apps hand over your device.
4. Get support numbers from inside the official app. Not from a search result, a social media reply or a listing site.
5. Hang up and call back on a number you found yourself. A genuine caller will not mind. This defeats almost every impersonation.
6. Treat unexpected money as a problem, not a windfall. If an unknown amount arrives and someone asks you to return it, report it to your bank rather than transferring it on.
7. Keep a low balance in the account linked to UPI. Treat it as a wallet and keep savings in an account with no UPI linked at all.

Rule seven is the structural one and the most under-used. UPI is extremely convenient and that convenience applies equally to anyone who gets access. Keeping a modest working balance in the UPI-linked account, with savings in a separate account that has no UPI or debit card attached, caps the maximum loss from any single incident. Most banks also allow you to set a per-transaction and daily limit; lowering it from the default costs you nothing.

What should you do in the first hour?

Speed matters more than anything else, because recovery depends on freezing the funds before they are moved onward. Act in this order and do not wait to work out what happened.

On liability: the Reserve Bank of India has a framework for customer liability in unauthorised electronic transactions, under which a customer’s liability depends substantially on how quickly the incident is reported and on whether the loss resulted from a bank-side lapse, the customer’s own negligence, or neither. Prompt reporting materially improves your position, which is another reason not to spend the first hour feeling embarrassed.

If the bank’s response is unsatisfactory, there is an escalation path: the bank’s internal grievance redressal officer first, then the RBI’s integrated ombudsman scheme. Keep every acknowledgement number, because the escalation requires evidence that you reported and when.

How do you protect older relatives?

Older adults are disproportionately targeted, and the usual approach of sending them an article does not work. What does work is removing the need for judgement in the moment.

• Agree one rule, not many. “Any call about money, you hang up and call me.” One rule is remembered; seven are not.
• Lower their transaction limits to something that covers normal use and nothing more.
• Keep savings in an account with no UPI and no debit card. A separate small account for daily use.
• Make it blameless in advance. Say explicitly that these calls fool professionals and that you will never be annoyed at being called. Shame is why people delay reporting, and delay is what makes recovery impossible.
• Set up alerts on your own phone for their account where the bank allows it, so a problem is visible quickly.

That fourth point does more good than any amount of explaining how scams work. A great many frauds become unrecoverable not because the victim was slow to realise but because they spent two days hoping it would resolve itself rather than telling their family.

Five minutes of setup worth doing today

1. Lower your UPI and debit card transaction limits in your banking app.
2. Move the bulk of your savings to an account with no UPI and no debit card attached.
3. Turn on SMS and email alerts for every transaction, however small.
4. Save the official bank helpline from inside the app, and save 1930, as contacts.
5. Delete any remote-access or screen-sharing app you do not actively use.
6. Tell one family member the single rule: any call about money, hang up and call back.

None of this requires technical skill and all of it reduces the maximum damage from a bad five minutes. The uncomfortable truth about payment fraud is that competence is not much protection — people who understand these systems well still get caught when tired, distracted or alarmed. Structural limits protect you when attention fails, which is exactly when you need protecting.

Financial resilience is partly about not losing money and partly about being able to absorb it when something goes wrong. On that side, an emergency fund is the single most useful thing to have in place, and the 50/30/20 budget rule is a reasonable way to build one. If an incident has affected your borrowing, how to read and repair your credit report covers what to check. Business owners should also read account security for small teams, since the same techniques are used against companies. More in our lifestyle and money section.