Archive · 15 Sep 2026
Seven UPI Scams Target Phones, SIMs and User Trust
UPI makes it easy to send money, but scammers use that convenience against people.
They may pretend to be bank workers, delivery agents or police officers.
Some ask victims to install an app or share their phone screen.
Others use fake QR codes, customer-care numbers or duplicate SIM cards.
These tricks can expose passwords, messages and one-time codes.
A scammer may frighten someone into sending money to keep an account safe.
Never share a UPI PIN or OTP with a stranger.
Do not install an APK or remote-access app because someone told you to.
If a scam may have happened, contact the bank and call 1930 quickly.
Cybercriminals increasingly target users’ phones, SIM cards, apps and behaviour instead of directly hacking UPI systems.
Frozen screens, screen-sharing requests and malicious APKs can expose banking apps, OTPs, notifications and sensitive device permissions.
Fake customer-care numbers, QR-code traps and duplicate SIMs exploit trust and authentication systems to access money.
Digital-arrest scams impersonate authorities and pressure victims to transfer funds to supposedly verify or protect their accounts.
Victims should stop interacting with scammers, contact banks through official channels and report financial cyber fraud immediately by calling 1930.
- Who
- Cybercriminals targeting Indian UPI users, along with banks, telecom providers, payment services and authorities responding to the fraud.
- What
- Seven UPI fraud tactics involving frozen phones, screen sharing, fake customer care, malicious APKs, SIM swaps, QR codes and digital arrests.
- When
- The article describes emerging and ongoing tactics; it cites a government statement from September 8 and a Financial Fraud Risk Indicator launched in May 2025.
- Where
- India, including a reported SIM-swap case from Pune.
- Why
- Scammers exploit trust, fear, phone access, SIM authentication and user actions to obtain sensitive information or induce authorised payments.
- Reported Pune loss
- A company reportedly lost about Rs 79 lakh after fraudsters obtained a duplicate SIM.
- Compensation ordered
- An adjudicating authority ordered a PSU bank to pay Rs 1.5 crore, including interest, according to the report.
- Fraud helpline
- Financial cyber fraud should be reported immediately by calling 1930.
- QR-code warning
- Scanning a QR code and entering a UPI PIN generally authorises a payment, rather than receiving money.
- Government fraud prevention
- The government said its Financial Fraud Risk Indicator helped prevent suspected cyber-fraud transactions worth more than Rs 5,000 crore since its May 2025 launch.
- High-risk permissions
- Accessibility, notification, SMS and device-control permissions can expose sensitive information when granted to malicious apps.
- Official support
- Users should access customer care through their bank or payment app, or a verified institutional website.