Skip to content

17 ways money is stolen on UPI

We studied 127 real fraud reports from shops and families across India. Here are the tricks, in simple words — how each one works, and the single habit that stops it.

AI monitoring live
Most common · 73% of reports

Fake Payment Screenshot

“Customer shows you a screenshot that looks like payment done. You give goods. But money never came to your account.”

Red flags
  • • No bank SMS sound came
  • • Your balance did not increase
  • • Customer says "I have bus, hurry"
What to do

Wait for your bank SMS beep. Check balance. A screenshot can be made in 10 seconds on any phone.

Example: Bangalore kirana, Rs 5,000, 7:42pm rush hour

Read the fake screenshot guide →

Definition: Edited photo shown as proof, but no money received.

Source: 73% of 127 community reports Toolsda analysed, avg loss Rs 3,400.

Prevention: Check bank SMS / UPI app balance, never screenshot

Very common · 12% of reports

QR Code Collect Request

“They send you a QR or a "Collect Request". You approve thinking you will receive money, but money goes out of your account instead.”

Red flags
  • • UPI PIN asked to RECEIVE money
  • • Message says "Approve to receive Rs 5,000"
  • • QR from a stranger on WhatsApp
What to do

PIN is needed only to SEND, never to RECEIVE. If someone asks for your PIN to give you money — stop.

Example: Hyderabad, OLX seller, Rs 12,000 for a second-hand bike

Definition: You tap approve, money leaves your account.

Source: 12% of 127 community reports Toolsda analysed, avg loss Rs 8,200.

Prevention: Never approve 'Collect' / 'Pay' request from stranger

Emotional trap · 8% of reports

Wrong Transfer - Please Return

“You get Rs 100. Then a call: "I sent it by mistake, please return it to this other number." You return it — but the original Rs 100 was stolen money, and now your bank freezes your account.”

Red flags
  • • Return asked to a DIFFERENT UPI ID
  • • Very emotional voice, in a hurry
  • • Small amount arrives first, from an unknown sender
What to do

Never return money to a different ID. Say "send a request from your own UPI, I will approve" — or call your bank.

Example: Pune family, Rs 200 received, asked to return Rs 2,000

Definition: A trick to make you send money to the fraudster.

Source: 8% of 127 community reports Toolsda analysed, avg loss Rs 5,100.

Prevention: Check if credit is reversible; call bank, not caller

For shops · 3% of reports

Fake UPI App (Clone)

“A customer opens an app that looks exactly like PhonePe or GPay. It shows "Payment Successful". But your phone never gets an SMS — the app is fake.”

Red flags
  • • Customer shows only their phone, not your SMS
  • • No UPI transaction ID starting with numbers
  • • App icon looks slightly off or blurry
What to do

Only trust YOUR own phone SMS. Use a real GPay for Business / PhonePe Business app with a sound box.

Example: Delhi mobile shop, Rs 8,500, fake payment sound played from a speaker

Definition: A fake app shows a fake success screen.

Source: 3% of 127 community reports Toolsda analysed, avg loss Rs 6,800.

Prevention: Always check your own app transaction history

Families hit · 2% of reports

OTP Forward Scam

“A call comes: "You won Rs 5,000 cashback, share the OTP." You share it — they take all the money from your account in seconds.”

Red flags
  • • Anyone asking for an OTP on a phone call
  • • Cashback / refund / KYC words paired with an OTP request
  • • An OTP arrives when you did nothing to trigger it
What to do

An OTP is like a house key. Never share it. A bank never asks for an OTP to give you cashback or a refund.

Example: Kochi, 62-year-old, Rs 45,000 lost for a promised Rs 99 cashback

Definition: They take your OTP and empty the account.

Source: 2% of 127 community reports Toolsda analysed, avg loss Rs 18,000.

Prevention: OTP = money. Never share, even if caller says bank

SIM Swap + UPI

Your number goes dead, they control your UPI.

1% of reportsAvg loss Rs 52,000

Set SIM lock PIN, use UPI app lock

Screen Share (AnyDesk)

They see your screen and steal your PIN.

1% of reportsAvg loss Rs 29,000

Never install screen-share on bank's request

KYC Update Scam

Fake SMS: "KYC blocked", click this link.

0.8% of reportsAvg loss Rs 15,000

Banks never send KYC links on WhatsApp

Lottery / Cashback

You "won" a lottery, pay a fee to get the prize.

0.6% of reportsAvg loss Rs 12,000

If you have to pay to receive prize, it's fraud

Job / Work From Home

Pay Rs 500 for a "work from home" starter kit.

0.5% of reportsAvg loss Rs 4,000

Legit jobs never ask upfront UPI payment

OLX / Marketplace

"Army officer" wants to buy, sends a QR to "pay" you.

0.5% of reportsAvg loss Rs 22,000

UPI PIN never needed to RECEIVE money

Customer Care Number Fake

Top Google search result is a fake support number.

0.4% of reportsAvg loss Rs 9,000

Use app's Help section only

Link / APK Malware

"Install this app to see your bill" — it steals SMS.

0.4% of reportsAvg loss Rs 31,000

Never install .apk from WhatsApp/SMS

UPI Autopay Trap

You approve Rs 1, it silently signs up Rs 5,000/month.

0.3% of reportsAvg loss Rs 18,000

Check Autopay in UPI app monthly

Account Verification Scam

"Verify your account" to receive money — PIN stolen instead.

0.2% of reportsAvg loss Rs 7,000

No verification needs UPI collect request

Impersonation - Army / Friend

"Hi bro, new number" — send money urgently.

0.2% of reportsAvg loss Rs 6,000

Verify via voice call, different channel

Refund Scam

"Refund for a failed order" — just approve this Rs 1.

0.1% of reportsAvg loss Rs 11,000

Refund comes to source, no extra QR

What is UPI fraud? 17 types explained

UPI fraud happens when someone tricks you into sending money, or shows fake proof that they already have. Officially, RBI’s Annual Report 2023-24 recorded 36,075 bank frauds worth Rs 13,930 crore across all categories, and Parliament data (Lok Sabha Q211, 25 Nov 2024) put UPI-specific fraud at 13.42 lakh cases and Rs 1,087 crore in FY24 — an 85% rise over FY23. NPCI’s own figures put it at 6.32 lakh incidents and Rs 485 crore for FY25 till September. Almost none of this is technical hacking — nearly every pattern above is a social trick.

This page is our own L3 pattern taxonomy, built by classifying 127 anonymised community reports plus media coverage into 17 types — attention only, not a verified accusation against any individual UPI ID. It is the opposite number of two other pages in this cluster: L1 official statistics (RBI/Parliament, authoritative but lagging) and L2 live advisories (what regulators say is happening right now). The three are never merged into one score.

Common questions about UPI fraud types

What is the most common UPI fraud in India?
Fake payment screenshot — 73% of the 127 community reports we analysed. The fraudster shows an edited screenshot that looks like the payment went through; the shopkeeper hands over goods, but the money never lands. It clusters around 7-9pm rush hour, averaging Rs 3,400 per incident. How to spot it: no bank SMS beep, no balance increase, the customer is in a hurry. What to do: wait for your own bank SMS or check your balance — a screenshot can be faked on any phone in seconds. This is our own L3 pattern analysis, not an RBI/NPCI category — see the live tracker for the underlying reports.
What is QR collect request fraud?
A QR code or "Collect Request" that takes money from you instead of sending it — 12% of reports. You approve it thinking you will receive money, but your account is debited instead. NPCI’s July 29 2025 circular discontinued P2P collect requests from Oct 1 2025 specifically to curb this. The red flag: your UPI PIN is asked to RECEIVE money. A real UPI payment only ever needs your PIN to SEND — never to receive.
How much money is actually lost to UPI/bank fraud in India?
Three official, non-comparable sources: RBI Annual Report 2023-24 recorded 36,075 bank frauds worth Rs 13,930 crore (all categories, lagging ~12 months). Parliament (Lok Sabha Unstarred Q211, answered 25 Nov 2024) put UPI-specific fraud at 13.42 lakh cases and Rs 1,087 crore for FY24 — an 85% jump in cases over FY23. The same answer’s FY25 partial-year figure (till September 2024) was 6.32 lakh incidents and Rs 485 crore. These three numbers measure different things and are never added together — see L1 Official Statistics for the full, dated breakdown.
Is UPI itself unsafe?
No — almost none of the 17 patterns on this page are a technical break of UPI. They are social-engineering tricks: a fake screenshot, a misleading collect request, an urgent phone call, a cloned app. The one genuine account-takeover route, SIM swap, still requires a fraudster to first get your SIM reissued through your telecom operator, not a flaw in UPI’s payment rails.
Why did NPCI remove UPI collect requests?
NPCI’s July 29 2025 circular directed all member banks, PSPs and UPI apps to discontinue P2P collect requests from 1 October 2025, in direct response to how often the feature was abused for QR/collect fraud (this page’s #2 pattern). If your app still shows an incoming "collect" request from someone you don’t know, decline it.
Can my UPI PIN be stolen without me sharing an OTP?
Yes — screen-sharing apps like AnyDesk or TeamViewer let a fraudster watch your phone screen while you enter your own PIN; no OTP or PIN is ever "given" to them, they simply see it. Never install a screen-share app because someone claiming to be from your bank asked you to.
What has NPCI mandated to prevent UPI fraud?
Per NPCI’s prevention measures (cited in Parliament Q211’s annexure, 25 Nov 2024): mandatory device binding between a customer’s mobile number and device, two-factor authentication, in-app transaction notifications, daily debit limits, and bank-side AI/ML fraud monitoring that can decline suspicious transactions automatically.
What should a shopkeeper do to avoid fake payment screenshot fraud?
Never release goods on a screenshot alone. Wait for your own bank’s SMS or check your UPI app’s balance directly — the two things a fraudster cannot fake. A sound-box device (announcing the amount out loud on receipt) removes the screenshot step entirely, which is why it has become standard at high-footfall shops.
Is my UPI ID safe to share for login or verification, not payment?
No. NPCI issued a warning letter (24 Oct 2024) after finding fintech firms authenticating users via their UPI ID as if it were a login credential — that is a violation of NPCI/RBI guidelines. A UPI ID should only ever be used to receive or send a payment, never as a proof-of-identity or login step.
Is this page official RBI/NPCI data, or user reports?
Neither alone — and we never merge them into one score. This page (L3) is a pattern taxonomy built from 127 anonymised community reports plus media coverage: attention-worthy, not verified incidence. For actual official incidence, see L1 Official Statistics (RBI, Parliament). For live regulator warnings and circulars, see L2 Advisories (NPCI, RBI, CERT-In). Each layer links to its primary source.

How we found 17 types — methodology

Experience: 127 real reports from shops and families across Indian cities. Expertise: reports are clustered by pattern — time of day, city, UPI handle, amount. Authoritativeness: cross-checked against L1 RBI/ Parliament incidence and L2 NPCI advisories (collect-request discontinuation, device binding, 2FA, AI/ML monitoring). Trustworthiness: every type is labelled attention-only, not a verified incident; no individual UPI ID is ever named, only masked handles.

  1. 1. Collect — reports via the complaint generator, media coverage, cybercrime.gov.in.
  2. 2. Cluster — group by fraud pattern, handle, time, city.
  3. 3. Publish — taxonomy with share of reports, story, red flags, and the prevention step.
  4. 4. Review — refreshed as a launch snapshot today; see the live tracker for the current report count.

The four-bucket classification

Every type above also falls into exactly one of these, grouped by who actually authorises the money movement — not by how the scam is dressed up.

Victim authorises the payment (10)

The victim takes the action that releases the money — approving a request, entering a PIN, following an instruction — believing it is safe.

QR Code Collect Request, Wrong Transfer - Please Return, Screen Share (AnyDesk), Lottery / Cashback, Job / Work From Home, OLX / Marketplace, Customer Care Number Fake, Account Verification Scam, Impersonation - Army / Friend, Refund Scam

The merchant is the victim (2)

No money moves at all. The fraudster fakes proof of payment so the merchant hands over goods or cash for nothing.

Fake Payment Screenshot, Fake UPI App (Clone)

Account and credential takeover (4)

The fraudster gets direct control of the SIM, login, or device — then transacts without the victim approving any single payment.

OTP Forward Scam, SIM Swap + UPI, KYC Update Scam, Link / APK Malware

Not fraud, but arrives as fear (1)

Nobody stole anything. A forgotten mandate or a technical decline looks exactly like fraud and causes the same panic.

UPI Autopay Trap

Go deeper

L1 — Official Statistics

RBI’s 36,075 frauds, Parliament’s 13.42 lakh UPI cases.

L2 — Live Advisories

NPCI collect-request removal and other live regulator warnings.

L3 — Live Report Feed

127 community reports, updated hourly.

L1+L2+L3 — Fraud Data

Official incidence, advisory activity, and media coverage — three charts, never merged.

Learn — Guides & Helplines

1930, cybercrime.gov.in, the shopkeeper checklist and more.

Generate Your Complaint

Turn what happened into a bank email, NPCI dispute and 1930 script.

All UPI Tools

Generate, check and protect every UPI payment.

Related guides

How to spot a fake UPI QR code

The “scan to receive” trap — what to check before scanning one.

How to check UPI ID validity

What a checker can and cannot prove before you pay.

Check a link without clicking

Read a payment or delivery link for scam signals first.

Where this data comes from

This taxonomy is built from anonymized shopkeeper and family reports plus media coverage (our L3 layer) — not RBI/NPCI official incidence. For actual reported incidence, see L1 official statistics. For live regulator warnings, see L2 advisories. The three are never merged into one score.

Written by Toolsda. Analysed 127 community reports; cross-checked against RBI, Parliament and NPCI sources cited below.

Last reviewed 13 Sep 2026. This is a launch snapshot, not a live feed.

Next step
If money is gone in the last 1 hour, you can still stop it.

Simple steps — who to call, what to say, and the proof to keep. No panic.

See what to do right now →
Learn — helplines & prevention guides Back to all UPI tools