Understanding the Core Deception
UPI scams, whether through phishing or fake QR codes, rely on one core principle: tricking you into authorising a payment you didn't intend to make. Phishing involves scammers sending deceptive messages with malicious links to steal your UPI PIN or other
credentials. These messages often create a false sense of urgency, like a pending KYC update or a blocked account, to rush you into acting without thinking. Fake QR code scams exploit a common misunderstanding. Scammers will ask you to scan a code under the pretence of receiving money, a refund, or a prize. However, scanning a QR code and entering your PIN is exclusively for sending money. The moment you enter your PIN, you are authorising a debit from your account, not a credit into it.
How Scammers Execute Their Plans
Fraudsters have developed several reliable methods. In phishing attacks, they often impersonate bank officials, customer service agents, or government bodies. They might send an SMS with a link that leads to a fake website designed to look exactly like your bank's portal, where any information you enter is stolen. Another popular tactic involves convincing you to download a remote access application like AnyDesk or TeamViewer. Posing as support staff, they gain control of your phone, see what you type, and capture your PIN to carry out fraudulent transactions. With QR scams, fraudsters get creative. They might place a sticker with a malicious QR code over a legitimate one at a shop or parking meter. When you scan it to pay, the money is redirected to their account. They also circulate fake QR codes online for bogus prize winnings or refunds, counting on users to scan first and think later.
Five Red Flags You Cannot Ignore
Vigilance is your best defence. Scammers leave clues, and recognising them can stop fraud before it happens. First, be wary of any sense of urgency or fear. Threats of account closure or limited-time offers are designed to make you panic and act rashly. Second, remember that no legitimate entity—not your bank, not NPCI, not a UPI app—will ever call or text you to ask for your UPI PIN or OTP. Third, be highly suspicious if you are asked to scan a QR code or approve a "collect request" to receive money. You never need to enter your PIN for incoming payments. Fourth, always check the recipient's name displayed on your UPI app before confirming a payment. If it doesn't match who you think you're paying, cancel the transaction. Finally, reject any request to install third-party apps to “fix” a problem.
Proactive Steps to Secure Your Account
Beyond spotting red flags, you can take concrete steps to fortify your defences. First and foremost, never share your UPI PIN with anyone, under any circumstances. Treat it with the same secrecy as your ATM PIN. Second, only download UPI and banking apps from official sources like the Google Play Store or Apple App Store. Avoid clicking on links sent via SMS or email to download apps. Third, use a secure lock on your phone and within your UPI app, preferably a biometric one like a fingerprint or face ID. Fourth, regularly review your transaction history. If you see any activity you don't recognise, report it immediately. Finally, if a link or QR code seems suspicious, do not engage. Instead, navigate to the official website or app of the service provider directly to verify any claims.
What to Do If You've Been Scammed
If you suspect you have fallen victim to a UPI scam, you must act quickly to maximise your chances of recovering the funds. The first and most crucial step is to call the National Cyber Crime Helpline at 1930 immediately. Next, report the fraudulent transaction to your bank and request them to block the transaction or freeze your account. You should also file a formal complaint on the National Cyber Crime Reporting Portal at cybercrime.gov.in. Concurrently, report the transaction within the UPI app you used, whether it's Google Pay, PhonePe, or another service, using their help or support section. Finally, you can escalate the issue by filing a complaint on the NPCI portal. Providing all transaction details, like the UTR number and amount, is critical for all these reports. The faster you report the fraud through these channels, the higher the chance of your bank being able to reverse the charge.
