A frozen phone screen, a fake customer-care call, a screen-sharing request or even a duplicate SIM can allow cybercriminals to enter your bank account.
Here are the new UPI fraud tactics Indian users need to watch out for.
For millions of Indians, UPI has become almost invisible aspect of everyday life.
Key points
- Cybercriminals are increasingly targeting the phone, SIM, apps and user behaviour rather than directly 'hacking' UPI.
- Frozen-screen, screen-sharing and malicious APK scams can trick victims into giving fraudsters access to their devices, banking apps, OTPs and sensitive data.
- Fake customer-care calls, QR-code traps and SIM-swap fraud exploit trust or authentication systems to gain access to victims' money.
- Digital arrest scams use fear and impersonation, pressuring victims to transfer money to supposedly 'verify' or 'protect' their bank accounts.
- Never share your UPI PIN or OTP, install apps from unknown sources or give strangers remote access; use official customer care channels and report financial cyber fraud immediately by calling 1930.
A QR code at a neighbourhood shop, a phone number sent on WhatsApp or a few taps on a smartphone can move money within seconds.
That convenience, however, has also changed the way cybercriminals attack.
The newest UPI scams are increasingly not about stealing a UPI PIN outright. Instead, fraudsters are trying to compromise the phone, the SIM card, the banking app, the authentication process or the victim's judgement.
Recent incidents and cybersecurity warnings point to a disturbing shift -- scammers are increasingly using apparently harmless technical problems, fake customer support and malicious applications to get users to do the work themselves.
Here are seven UPI fraud tactics that deserve particular attention.
1. UPI Scam: Your Phone Freezes And Someone Offers To Fix It
A phone suddenly freezing after clicking an advertisement, message or unfamiliar link may look like an ordinary technical problem. But cybersecurity experts have warned that the apparent 'glitch' can sometimes be used as a psychological distraction.
In one emerging pattern, a user encounters a frozen or malfunctioning screen and subsequently receives a call from somebody claiming to be from technical support, a bank or another service provider.
The caller may claim that the phone or UPI account has been compromised and that an app needs to be installed to fix it.
That app can be the real danger.
Recent reporting has highlighted how malicious Android applications can request access to SMS, notifications and accessibility functions. Such permissions can potentially allow criminals to monitor sensitive information and interfere with what happens on the device.
The important point is this -- the frozen screen may be the distraction, not the fraud itself.
2. Screen-Sharing Scam: The Fraudster Watches You Make the Payment
Screen-sharing scams are another growing threat to UPI users.
The fraudster may pose as a customer-care executive, delivery agent, bank employee or technical expert and persuade the victim to install a remote-access or screen-sharing application.
Once the screen is visible to the scammer, information displayed on it -- including financial details, OTPs or transaction screens -- may become exposed.
More importantly, the victim may be manipulated into opening a banking application and authorising a payment while the fraudster watches.
That is why these scams can be particularly deceptive.
The criminal does not necessarily need to 'break' UPI security. Instead, the victim is manipulated into performing an action that the payment system recognises as authorised.
3. Fake UPI Customer Care: The Search Result Trap
Another common route begins when someone searches online for a bank, wallet or UPI app's customer-care number.
Fraudsters can exploit the fact that users often trust phone numbers appearing in search results, social media posts or unofficial websites.
The caller then claims to be a customer support representative and asks the victim to follow instructions, share information or install an application.
The safest approach is to access customer support from inside the official banking or payment application or the institution's verified website rather than relying on a number supplied by a stranger.
Google Pay itself warns users against calling untrusted numbers found online and recommends reaching customer care through the app.
4. Malicious APK Scam: The 'Verification' App That Steals Your Data
Cybercriminals are also disguising malicious applications as legitimate tools.
The pitch can sound convincing -- download an APK for KYC verification, cashback, a refund, a reward, a delivery update or technical support.
Once installed, however, the application may request permissions that have little connection with the service it claims to provide.
The danger is particularly serious when users grant accessibility, notification, SMS or device-control permissions without understanding what those permissions allow.
Cybersecurity experts quoted in recent reporting have specifically warned about fake utility and service applications being used to harvest sensitive information.
A simple rule can prevent many such attacks: If somebody unexpectedly asks you to install an APK, don't.
5. SIM Swap Scam: Your OTP May Go to Someone Else
UPI fraud is not restricted to smartphones and apps.
In a recent case reported from Pune, a company lost about Rs 79 lakh after fraudsters obtained a duplicate SIM connected to its registered mobile number. The duplicate SIM allowed the attackers to intercept banking OTPs. An adjudicating authority subsequently ordered a PSU bank to pay compensation of Rs 1.5 crore, including interest, according to the report.
The episode highlights an important vulnerability in digital banking -- the mobile number itself is part of the security chain.
If your phone suddenly loses network connectivity for no obvious reason, particularly when you have not changed location or settings, do not automatically assume it is a temporary network problem.
Contact your telecom provider and bank through official channels.
6. QR Code Scam: You Don't Need a UPI PIN to Receive Money
One of the oldest UPI fraud tricks remains surprisingly effective.
A fraudster may claim that a QR code must be scanned to receive money, a refund or cashback.
But scanning a QR code and entering a UPI PIN is generally an authorisation mechanism for making a payment -- not receiving one.
The National Payments Corporation of India specifically warns users about fake cashback links and QR-code scams and says users should be cautious about entering their UPI PIN.
The rule is simple: If you are receiving money, you should not have to enter your UPI PIN to receive it.
7. Digital Arrest And Fear-Based Scams Are Still Evolving
Not every UPI scam begins with technology.
Some begin with fear.
Fraudsters impersonate police officers, investigators, government officials or other authorities and tell victims that their bank account, Aadhaar, SIM card or identity has been linked to a crime.
The victim is then pressured into transferring money or following instructions supposedly intended to 'verify' or 'protect' the account.
The Supreme Court has been dealing with the broader problem of digital-arrest scams and institutional responses involving cybercrime investigations, mule accounts, SIM cards and recovery of defrauded money.
The lesson is broader than any single scam -- urgency is one of the fraudster's most powerful weapons.
What To Do If You Suspect A UPI Scam
The first few minutes after a suspected fraud can matter enormously.
Do not continue following instructions from the caller. If a suspicious application has been installed, disconnect the phone from mobile data and Wi-Fi where appropriate and avoid opening banking applications on the potentially compromised device.
Contact your bank using its official channel, check recent transactions and change relevant credentials using a clean device if necessary.
If money has been lost through a financial cyber fraud, report it immediately by calling 1930 and through the National Cybercrime Reporting Portal.
The government said on September 8 that its Financial Fraud Risk Indicator system had helped prevent suspected cyber-fraud transactions worth more than Rs 5,000 crore since its launch in May 2025. It also stressed that citizens should report suspicious calls and messages because individual reports can contribute to the broader fraud-intelligence system.
The most important change in mindset is this: Don't think of a UPI scam as someone 'hacking your bank account'.
Increasingly, the criminal may be trying to hack the moment of trust between you and your phone.
The screen freezes.
The 'bank executive' calls.
The app is installed.
The permission is granted.
The OTP appears.
And the victim, believing they are fixing a problem, may unknowingly help the fraudster complete the fraud.
That is why the safest response to an unexpected UPI problem is often the least dramatic one: Stop, disconnect, verify independently and never allow a stranger to control your phone.
