7 UPI Fraud Requests That Look Completely Ordinary and Are Always a Scam in India

Someone sends you a UPI collect request, sometimes for an amount as small as ₹1, sometimes for exactly what you're owed by a stranger online. The request looks identical to a legitimate one. The difference is that approving a collect request sends money out of your account. Scammers rely on the confusion between "collect" and "receive." Approving is paying. If you did not initiate a transaction with a known party, decline every collect request without exception.

A stranger calls to say they accidentally sent you money via UPI and asks you to return it. You check, there is indeed a credit in your account. What has happened: they deposited the amount through a stolen card or a compromised account, then ask you to "refund" it to a different UPI ID. Your refund goes to the fraudster. The original deposit gets reversed by the bank. You lose both. The Chanakya Niti principle here is blunt: do not act on urgency manufactured by someone else. A genuine wrong transfer is resolved through the sender's bank, not through a panicked phone call to you.

Scammers posing as buyers on OLX, Quikr, or Instagram DMs send a QR code and tell you to scan it to receive payment for the item you're selling. Scanning a QR code on UPI initiates a payment from your account. It does not deposit money into it. The direction of money flow is the opposite of what the fraudster describes. If someone needs to pay you, they scan your QR code, or they type your UPI ID. You never scan anything to receive money. Ever.

A caller identifies as a bank representative, a UPI helpline agent, or a government official. They say your UPI account needs to be verified, your KYC updated, or a suspicious transaction reversed. They ask for the OTP that just arrived on your phone. No bank, no NPCI, no government agency will ever ask for your OTP over a call. The OTP is the lock. Sharing it hands over the key. Once given, it cannot be recalled, the transaction completes in seconds.

You receive an SMS or WhatsApp message with a link that appears to confirm an incoming payment: "₹5,000 has been credited. Click to accept." The link opens a page that mimics your bank or UPI app and asks for your PIN or login credentials. Legitimate UPI credits require no click, no acceptance, no login. Money that arrives in your account arrives. If a link is asking you to do something to receive money, it is phishing, the link exists to harvest your credentials, not to send you anything.

Search "Paytm customer care" or "GPay helpline" on Google and the top results sometimes include paid advertisements for fraudulent numbers. The scammer who answers sounds professional, asks for your registered mobile number, then sends an OTP to "verify your identity" and asks you to read it back. This is a phishing call using your own account's authentication against you. NPCI and all major UPI apps publish their official support contacts only within the app itself. A customer care number found through a web search should be verified against the app before you dial it.

A scammer posing as technical support asks you to install AnyDesk, TeamViewer, or a similar remote-access app so they can "fix" a UPI issue on your phone. Once you grant access, they can see your UPI PIN as you type it, open your banking app, and initiate transfers while you watch. Remote access to your phone is remote access to your money. No legitimate UPI support workflow requires you to install a third-party app or share your screen with anyone.

The pattern across all seven is the same: the fraudster creates a version of a normal digital transaction, a refund, a verification, a payment confirmation, and changes only one variable. That one variable is always the direction of money or the destination of your credentials. UPI's speed, which makes it genuinely useful, is also what makes recovery nearly impossible once a scam completes. The window between approval and loss is measured in seconds.