Fake UPI payment scams

The one rule that defeats all of these

Money has arrived only when your own bank says it has.

Not when the customer shows you a success screen. Not when they show you an SMS. Not when they show you a transaction ID. Your bank’s own SMS alert, your banking app balance, or your passbook — nothing else.

Every scam below is a variation on getting you to accept some other form of evidence.

How the common scams work

1. The forged screenshot at the counter

The customer scans your QR, appears to pay, and shows you a payment-success screen. You hand over the goods. Nothing ever arrives. The screen was an image, a mock-up app, or a real payment they cancelled.

Defence: check your own bank SMS or app before releasing anything. In a busy shop, a UPI “soundbox” from your bank or PSP announces genuine credits aloud, which removes the judgement call entirely.

2. The “I sent extra by mistake, please refund” call

Someone claims to have accidentally sent you money and asks you to send some back. Often they show a doctored screenshot. Sometimes real money does arrive — from a third party’s hacked account, making you an unwitting money-laundering hop.

Defence: never refund on request. Tell them to raise it with their bank, which has a proper reversal process. If money genuinely arrived unexpectedly, tell your own bank and let them handle it.

3. The “scan this QR to receive money” trick

The most common one, and the most misunderstood. A “buyer” on OLX, Facebook Marketplace or a rental listing sends a QR code or a collect request and says scanning it will credit you.

This is impossible. Scanning a QR and entering your UPI PIN always sends money. There is no such thing as a QR code that pulls money into your account. If you are asked to enter your PIN to receive something, you are being robbed.

4. Spoofed PhonePe / GPay / Paytm links

A link that looks like a payment page but is a look-alike site collecting your UPI PIN, card details or an OTP. Often paired with an urgent story: a blocked account, a pending refund, a delivery on hold, a KYC deadline.

Defence: check the domain before you type anything. Real UPI payments never need your PIN entered into a web page — the PIN is entered in your UPI app, on the NPCI-secured screen, and nowhere else.

5. Fake customer-care numbers

You search for a support number, land on a scam listing, and the “agent” walks you through installing AnyDesk or TeamViewer to “fix” your issue — then watches you type your PIN.

Defence: get support numbers only from inside the official app. No genuine support agent ever needs remote access to your phone.

Verifying a payment properly

1. Your bank’s SMS or app notification. Sent by your bank, not by the payer.
2. Your account balance, refreshed in your own banking app.
3. Your statement or passbook, for anything of real value.

Not proof: the payer’s screenshot, the payer’s app screen, an SMS forwarded by the payer, a transaction ID typed into a chat, or an email claiming a payment was made.

For anything above a few thousand rupees, wait for the credit to appear in your own app before handing anything over. A genuine payer will not object to thirty seconds.

If you have been scammed

1. Call 1930 — the national cyber crime helpline — immediately. Speed matters enormously; funds are sometimes frozen mid-transfer within the first hours.
2. File at cybercrime.gov.in.
3. Tell your bank and ask them to raise a dispute. Under RBI rules, prompt reporting of unauthorised electronic transactions limits your liability.
4. Escalate to NPCI dispute redressal if the bank does not resolve it.
5. Keep everything — screenshots, numbers, UPI IDs, chat logs.

What UPIPE does and does not do

UPIPE generates real UPI QR codes and payment links from a UPI ID or bank account, so that money can be sent to you. Everything happens in your browser; nothing is stored; UPIPE never touches the payment, which moves bank-to-bank through NPCI.

It does not and will not generate fake payment confirmations, spoofed receipts, forged screenshots or anything designed to make an unpaid transaction look paid. If you find UPIPE being used to mislead someone, report it here.