If you have watched any Hindi comedy film about money going missing, you know the drill. Someone counts cash, someone else pockets it, confusion erupts, and the audience laughs because none of it is real. Here is the less funny version: UPI fraud works on the exact same confusion, except the money is yours and nobody yells cut.
India’s love affair with instant payments is genuine. UPI made sending money as easy as sending a text, and that simplicity is precisely what scammers exploit. The tricks are not sophisticated hacking. They are confidence games dressed up in familiar screens, and they work because they hijack the exact moments when you are trying to be helpful, polite, or quick.
So let us walk through the five most common UPI fraud patterns in India. We will keep it light, because the comedy films got one thing right: money confusion is inherently absurd. But the UPI fraud protection advice at the end is dead serious.
1. The “Approve to Receive” Collect Request
This is the all-time classic of UPI fraud, and it works on one beautifully simple misunderstanding.
You get a UPI collect request on PhonePe, Google Pay, or Paytm. The message says something like “You have received Rs 10,000, approve to collect.” Your brain reads “receive” and your thumb moves toward approve. But here is the thing: a collect request is someone asking YOU for money. Approving it sends money out of your account, not into it.
The scammer’s script usually involves selling something on OLX or Facebook Marketplace. They pose as a buyer, say they will pay in advance, and send a collect request instead of a payment. “Just enter your UPI PIN to receive the money,” they say cheerfully. The moment you enter that PIN, the money leaves.
The rule: You never need a PIN to RECEIVE money on UPI. PIN means pay. No exceptions. If someone asks you to enter your PIN to get money, you are being robbed in real time.
2. The Screen-Share Trap
This one starts with a phone call, and the caller is always very polite and very worried about your problem.
Maybe you searched for a bank’s customer care number and called a fake one. Maybe you got an SMS about your account being blocked. Either way, the “support executive” asks you to install AnyDesk, TeamViewer, or another screen-sharing app so they can “help you.” What they are actually doing is watching your screen while you open your banking app.
Once they can see your screen, they watch you enter OTPs, or worse, they guide you to make a “test transaction” or “verification payment.” Some victims have watched their own money leave while a stranger narrated it as a security procedure.
The rule: No legitimate bank or UPI app will ever ask you to install a screen-sharing app. If someone does, hang up. The comedy version of this scene has the hero outsmarting the villain. In real life, the hero hangs up the phone.
3. The Fake Customer Care Number
Type any bank’s customer care number into a search engine and you might find scammers gaming the results. They buy ads or manipulate listings so their number appears at the top. You call thinking you are reaching your bank, and a professional-sounding person answers.
From there it follows a familiar script: they need to “verify” you, which means sharing OTPs, card details, or UPI PINs. Sometimes they send a link to a fake “verification” page. The whole performance is designed to feel official.
The rule: Never trust a customer care number from a search result. Get it from your bank’s official app, the back of your debit card, or the bank’s own website that you typed in yourself. For cyber fraud, the government’s own helpline is 1930, and the reporting portal is cybercrime.gov.in. Save those two; they are the only numbers in this article worth memorising.
4. The QR Code That Steals
QR codes are supposed to make payments easier. Scammers made them into a trap with one clever inversion.
The pitch goes like this: “I will send you money, just scan this QR code.” You scan it, your UPI app opens, and it asks for your PIN. Wait, why would receiving money need a PIN? It would not. That QR code is a payment request in disguise. The moment you authenticate, you have paid the scammer.
This works terrifyingly well on small sellers, freelancers, and anyone doing a first-time UPI transaction with a stranger. The scammer creates urgency (“scan fast, the offer expires!”) so you do not stop to think about why receiving money needs a PIN.
The rule: Same as scam number one. PIN means pay. Scanning a QR and entering a PIN always sends money FROM you. If you are supposed to be receiving, there is no PIN involved. Ever.
If you enjoyed untangling this kind of logic puzzle, you might also like our breakdown of the viral stolen money puzzle, which plays the same trick with riddle logic instead of real rupees.
5. The “Wrong Transfer, Please Refund” Guilt Trip
This is the most emotionally manipulative entry on the list, and it preys on basic decency.
You receive a genuine UPI transfer, maybe Rs 5,000, from a stranger. Moments later comes the call: “Sorry, I sent it to the wrong number, my mother is in the hospital, please send it back urgently.” Most decent people would want to help. So you send Rs 5,000 back.
Here is the catch: the original transfer was made from a stolen account or via a reversible method. When the real owner reports it, that Rs 5,000 gets clawed back from YOUR account. You have now paid Rs 5,000 to the scammer out of your own pocket, and the “wrong transfer” vanishes.
The hospital story, the crying, the urgency: all theatre. The comedy films use the same device, a frantic misunderstanding that snowballs. The difference is that in the film, nobody loses real money.
The rule: If you receive an unexpected transfer, do NOT send it back directly. Ask the sender to raise a reversal through their own bank or UPI app. Legitimate wrong transfers are reversed through banking channels, not through your goodwill and a fresh transaction.
Why UPI Fraud Works So Well
Strip away the comedy and these five scams share a blueprint. They exploit speed (UPI is instant, so there is no cooling-off period), politeness (Indians are culturally primed to help a stranger in distress), and interface confusion (the apps are simple, which means the difference between paying and receiving can be one misread screen).
Scammers are not hackers. They are social engineers running a numbers game. They do not need to fool everyone, just enough people at exactly the wrong moment.
Your UPI Fraud Protection Playbook
Enough about the villains. Here is how you stay out of their stories:
Guard your PIN like cash. Your UPI PIN is the key to your account. Nobody legitimate will ever ask for it, not your bank, not the UPI app company, not a government officer. Anyone who asks is a scammer, full stop.
Verify before you trust. Got a collect request from an unknown person? Decline it. Got a call from “customer care”? Hang up and call the number on your card. Got an unexpected credit? Let the bank reverse it.
Slow down. Every one of these scams relies on urgency. The scammer needs you to act before you think. The single most effective anti-fraud tool you own is a ten-second pause.
Report fast if it happens. Call the cyber fraud helpline at 1930 immediately, and file a report at cybercrime.gov.in. Quick reporting dramatically improves the chances of freezing the fraudulent transaction. There is no shame in it; these scams are designed by professionals.
For a broader look at moving money safely, our complete guide to sending money to India covers the legitimate channels and how to vet them.
The Punchline
The comedy films about money chaos work because confusion is funny when the stakes are fictional. UPI fraud is the same confusion with real stakes, which is why the only appropriate response is to learn the patterns, share them with your family (especially elderly parents who are prime targets), and keep your PIN to yourself.
Stay sharp, pause before you pay, and let the only money confusion in your life be the kind on screen.
Where to Report UPI Fraud
If you suspect UPI fraud, act fast. Call the national cybercrime helpline at 1930 or file a complaint on the National Cyber Crime Reporting Portal. The NPCI also publishes regular safety advisories on UPI fraud patterns — worth a read before your next big transfer.