UPI fraud in India: how it happens and how to reverse it

By Aditi Sharma, Editor, Consumer Fraud

UPI fraud in India runs to thousands of complaints a day. Most of it is preventable — and if you act inside the first three days, most of it is also reversible under RBI's limited-liability framework. This guide walks through the three patterns behind almost every UPI case and the exact reversal path.

Pattern 1: The "collect request" trick

You list something on OLX or a marketplace. A "buyer" says they've sent money and forwards a UPI collect request. You approve it thinking it credits you — it debits you. A collect request in UPI is always a debit; the sender is asking for money, not sending it. There is no legitimate reason a buyer needs to send you a collect request.

Fix: never enter your UPI PIN to receive money. Only to send it. Receiving money on UPI never requires a PIN, an OTP, or a scan.

Pattern 2: Fake QR / "scan to receive"

Common on OLX pickups: the buyer arrives with a "scan this QR to receive the payment". Every UPI QR encodes a payment to the QR owner. Scanning and paying sends money to them, not the other way around.

Fix: if you need to receive, share your own UPI ID or your own QR. Never scan a stranger's QR to "receive".

Pattern 3: Screen-share & remote-access

Caller impersonates bank support, walks you through installing AnyDesk / TeamViewer / Quick Support "to fix a KYC issue". Once installed they watch you enter your UPI PIN and drain the account.

Fix: banks never ask you to install remote-control software. Uninstall it the moment you notice, then follow the reversal path below.

The reversal path — do this in order

1. Freeze the transaction within 3 days. Call your bank's fraud line (printed on the back of your card) and report the exact debit. Under RBI's Limited Liability circular (July 2017), if you report an unauthorised electronic transaction within 3 working days your liability is zero — the bank must credit the amount within 10 working days.
2. File a complaint on 1930. The cybercrime helpline can freeze the beneficiary account before the money is withdrawn. The first hour matters most.
3. File on cybercrime.gov.in. Upload the UPI reference ID, the SMS debit alert, and any chat/call records with the fraudster. You'll get an acknowledgement number — keep it.
4. Escalate under BCSBI & RBI Ombudsman. If the bank refuses the reversal after 30 days, file at the RBI CMS portal. Zero-liability cases are routinely upheld at the ombudsman stage.

What kills your reversal

• Delaying past 7 working days — liability jumps from zero to the full amount for "customer negligence" cases.
• Sharing your UPI PIN with anyone — the bank will classify it as "with consent" and refuse reversal.
• Deleting the SMS or app notification — you need the reference ID to trace the beneficiary bank.

Prevention takes 60 seconds

1. Set a daily UPI limit inside your BHIM / GPay / PhonePe app to a value slightly above what you actually spend.
2. Turn on transaction alerts on both SMS and email — two channels means you catch fraud even if one is compromised.
3. Before you approve any UPI request, read the message: "Paying to" means you lose money, "Received from" is the only legitimate credit. See bank call scam red flags for the phrases that precede every UPI fraud call.

The system is on your side if you use it. Report inside 72 hours, keep every SMS, and escalate to the ombudsman if the bank stalls.