How the Cashback Scam Really Works
The heart of this deception lies in a misunderstanding of a core UPI feature: the 'Request Money' or 'Collect Request' function. Scammers don't send you a link to receive money; they send a request for you to send them money. The message, which they can
write themselves, might say "Cashback Approved" or "Refund Processed." However, the button you are prompted to press will say “Pay.” If you enter your UPI PIN, you are not authorising a credit to your account; you are authorising a debit from it. The golden rule of UPI is simple: you never need to enter your PIN to receive money. Your PIN is exclusively for sending money or checking your balance.
Spotting the Red Flags of a UPI Scam
Fraudsters rely on you acting quickly without thinking. Fortunately, their tactics have common warning signs. Be immediately suspicious of any unsolicited message promising unexpected rewards, prizes, or refunds. Scammers often create a false sense of urgency, claiming the offer will expire in minutes. Grammatical errors, strange formatting, or links from unofficial-looking URLs are other major red flags. A genuine company will not pressure you into clicking a link sent via SMS or WhatsApp to receive a cashback. Another tactic involves QR codes; they might send you one and ask you to scan it to receive money. Remember, scanning a QR code is always for paying out, never for receiving money.
More Than Just Money: The Risk of Data Theft
While the immediate goal is often financial theft, these malicious links can pose other dangers. Some links lead to phishing websites designed to harvest your personal and financial information, like your bank account number, debit card details, or even your UPI PIN. Others may trick you into downloading remote access applications. Posing as customer support, scammers guide you to install an app that gives them complete control over your phone, allowing them to view your screen, record your confidential details as you type them, and authorise transactions without your knowledge.
The Psychology of the Scam: Why We Fall For It
Cybercriminals are adept at exploiting basic human emotions. They leverage excitement and greed with promises of easy money, and they use fear and urgency to bypass your rational judgment. A message about a pending refund for an order you cancelled, for example, feels plausible. By creating a believable context, they lower your guard. The official-looking logos and transaction formats can make a fake request appear legitimate. This social engineering is often more effective than any complex technical hack, as it turns the user into an unwilling participant in the fraud.
What to Do If You've Been Scammed
If you suspect you've fallen victim to a UPI scam, time is critical. First, immediately call the National Cyber Crime Helpline at 1930 to report the financial fraud. Next, contact your bank to inform them of the unauthorised transaction and request them to block your account temporarily if necessary. You must also file a formal complaint on the National Cyber Crime Reporting Portal at cybercrime.gov.in. Provide all relevant details, including the transaction ID (UTR number), the scammer's UPI ID or phone number, and screenshots of the messages. Reporting the incident through your UPI app's support channel is also a crucial step.
