UPI and Online Payment Scams: Festive season in India is the busiest shopping stretch of the year. Big sales start, families buy gold and gadgets, relatives send digital gifts, and millions of people tap their phones to pay for everything from sweets to sofas. It is also when scammers do some of their best work, because they know people are distracted, in a hurry, and expecting a lot of messages about deliveries, refunds and offers.
Diwali falls on November 8 this year, and the sale events tend to begin well before that. That makes now a good time to get your habits in order. Here are the scams that show up most often, how they work, and the simple rules that block most of them.
The Golden Rule: Money Comes In Without a PIN
If you remember only one thing from this article, make it this. You never need to enter your UPI PIN to receive money. A PIN is only for sending money out or approving a payment request.
A huge share of UPI fraud depends on getting you to break that rule. Someone says they are sending you money, then asks you to scan a code or approve a request and enter your PIN “to receive it.” The moment you do, the money leaves your account instead. If you are asked for a PIN when you are supposed to be receiving, stop right there.
Scam 1: The “Collect Request” Trick
You sell a sofa online, or a stranger contacts you about something you listed, and they say they will pay right away. Instead of sending money, they send a collect request, which is really a request for you to pay them. A rushed or distracted seller taps approve and enters the PIN.
How to protect yourself: read every notification carefully. The wording will say you are being asked to pay, even if the sender’s message says otherwise. If you did not make a purchase and are not expecting to pay, decline the request.
Scam 2: Fake QR Codes
Scanning a QR code feels harmless, but a QR code is just a way of encoding a payment instruction. A scammer may send you a code and say it is for receiving a refund or an advance payment. Scanning it and entering your PIN actually sends money out.
Another version involves stickers pasted over a legitimate shop’s QR code, so payments go to the wrong account. Before paying at a small shop, check that the name displayed on your payment screen matches the shop you are standing in.
Also read: AI Actress Tilly Norwood Leaves Piers Morgan Speechless After Unexpected Chinese Glitch
Scam 3: Fake Customer Care Numbers
This one catches people who are already frustrated. Your order is delayed, a refund has not come through, or a payment failed. You search online for the company’s helpline, and the top result is a number posted by a fraudster. The person who picks up sounds helpful and professional, then asks you to install a screen-sharing app, read out an OTP, or “verify” your card details.
How to protect yourself: get support numbers from the company’s official app or website, not from search result snippets, social media comments or messages. And never share an OTP, PIN, CVV or full card number with anyone, including someone claiming to be from the bank.
Scam 4: Screen-Sharing and Remote Access Apps
Fraudsters often ask victims to install apps that let them see or control the phone’s screen. Once that is running, they can watch you type your PIN or read OTPs as they arrive. Genuine customer support almost never needs this, and banks certainly do not ask customers to install such tools.
If someone asks you to download an app so they can help you fix a payment problem, hang up. If you already installed one, uninstall it immediately and contact your bank.
Scam 5: Fake Sale Offers and Phishing Links
Around big sale events, WhatsApp forwards, SMS messages and social media ads promise unbelievable discounts, free gifts or festive vouchers. The links often lead to lookalike websites designed to steal card details or login information, or to download malicious files onto your phone.
Warning signs include a shortened or strange-looking web address, spelling mistakes, pressure to act in the next few minutes, and requests to forward the message to multiple contacts. Open shopping apps directly or type the official address yourself rather than tapping links from messages.
Scam 6: “Diwali Gift” App Files
Some scam messages include an APK file, which is an app installation file, disguised as a festive greeting card, gift or offer. Installing one from outside the official app store can give attackers access to your messages, OTPs and even payment apps.
Do not install apps from links or files sent through chat. Stick to official app stores, and keep your phone’s setting that blocks installs from unknown sources turned on.
Scam 7: Fake Refunds and KYC Calls
You get a call or message saying your bank account, wallet or SIM will be blocked unless you update your KYC details today. Or a caller says you are owed a refund and asks you to confirm some information to receive it. The urgency is the giveaway. Real banks and payment apps do not ask you to share PINs or OTPs over the phone, and they do not threaten to shut down accounts within hours over a call.
If you get a message like this, do not click the link or call the number. Log into your bank app directly, or visit a branch, to check whether anything actually needs updating.
Everyday Habits That Make You Harder to Scam
Small routines block most fraud attempts.
Verify before paying. When you enter a UPI ID or scan a code, check the name shown before you confirm. If the recipient name does not match who you expect, cancel the payment.
Use app locks and strong screen locks. Add a separate lock on your payment apps if your phone allows it, and use a solid PIN or biometric on the phone itself.
Set transaction limits. Many banks and payment apps let you lower daily limits. If you rarely send large amounts, a lower cap limits the damage if something goes wrong.
Keep your phone updated. Software updates fix security holes that attackers rely on.
Use separate cards or accounts for online shopping. If you can, keep a lower balance in the account linked to everyday online payments and move money in only when you need it.
Be careful on public Wi-Fi. Avoid logging into banking apps on open networks at malls, cafes or railway stations. Mobile data is safer.
Slow down. Almost every scam depends on urgency. If something feels rushed, it is worth a pause and a second opinion from someone you trust.
What to Do If You Get Scammed
Speed matters. The faster you report a fraudulent transaction, the better the chance of stopping or tracing the money.
First, contact your bank or payment app immediately and ask them to block your card, freeze the account or flag the transaction. Use the official support number from the app or the back of your card.
Second, call the National Cyber Crime Helpline at 1930, which is meant for reporting financial cyber fraud quickly. You can also file a complaint on the government’s cybercrime reporting portal, cybercrime.gov.in.
Third, keep evidence. Take screenshots of chats, transaction details, phone numbers, links and any messages the scammer sent. Note the time of the transaction and the reference number.
Fourth, change your passwords and PINs, and remove any suspicious apps from your phone.
Finally, do not feel embarrassed. These scams are designed by professionals, and they catch smart, careful people every day. Reporting quickly helps you, and it helps others too.
Talk to Your Family
The people most at risk are often not the ones who use their phones all day. Parents, grandparents and relatives who are new to digital payments are frequent targets, especially during the festive rush. Take ten minutes this week to walk through the basics with them. Explain that you never enter a PIN to receive money, that they should never share OTPs, and that they should call you before acting on any message about a refund, prize or blocked account.
The Bottom Line
You do not need to become a cybersecurity expert to stay safe. A handful of rules cover most situations: no PIN to receive money, no OTPs to anyone, no support numbers from search results, no apps from random links, and no decisions made under pressure.
Enjoy the sales, buy the sweets, send the gifts. Just keep one hand on your phone’s PIN and treat every “urgent” message with polite suspicion. A few seconds of caution now can save you weeks of stress later.
