How to Spot a Phishing or UPI Scam (Before You Lose Money)

UPI fraud reports crossed Rs 2,000 crore in 2024. The scams are not sophisticated — they rely on one moment of panic or trust. Knowing the four or five patterns is almost enough to stop being a victim.

Pattern 1: The urgency call

Someone calls claiming to be from your bank, the income tax department, a courier company, or the police. They have a story that requires immediate action — your card is blocked, your parcel is stuck, a case is filed against you.

Reality check: no legitimate bank or government body calls and asks for an OTP, a PIN, a password, or for you to install a screen-sharing app. Ever. The correct response is to hang up and call the official number listed on the bank website.

Pattern 2: The collect request

Someone sends you a UPI *collect request* disguised as a refund, a cashback, or a payment incoming. You hit 'Accept' and instead of receiving money, you send it.

Reality check: you never enter your UPI PIN to *receive* money. Only to send it. If a screen is asking you for your PIN, you are paying, not receiving. Cancel.

Pattern 3: The fake OTP

Someone books a cab, an Airbnb, or a purchase using your OTP. They call, pretend to be customer support, and 'just need the OTP to confirm'.

Reality check: an OTP is a password you just received. Never say it out loud, never type it into a chat, never forward it.

Pattern 4: The fake app / APK

A WhatsApp message includes an APK (Android install file) — often disguised as a banking, courier, or 'IRCTC ticket' app. Installing it grants full phone access.

Reality check: never install an app from a WhatsApp attachment. Install only from Google Play Store or the App Store. Enable Play Protect.

Pattern 5: The fake job / investment offer

You get a WhatsApp or Telegram message about a part-time job, a stock tip, or a 'rate this 5 stars on Google Maps' task. It pays a small amount. Then it asks you to deposit money for a 'bigger task'. The deposit never comes back.

Reality check: no real job ever asks you to deposit money. If money flows from you before it flows to you, it is a scam.

What to do if you already paid

1. Call your bank's fraud hotline immediately — freezing the beneficiary within the first hour can reverse it.
2. File a complaint on the National Cybercrime Portal or call 1930.
3. File an FIR at the local cyber cell — most cities have a dedicated cyber police station.
4. Notify UPI / your bank in writing within 3 days — liability rules under RBI's 'zero liability' circular kick in only if reported on time.