UPI fraud: what it is and how it works in India

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 2 Nov 2026 · Online fraud

UPI fraud is the use of the Unified Payments Interface to take money from someone who did not intend to pay. The mechanism is always the same at the last step: a debit from your account authorised by your UPI PIN. Everything before that step is the fraud, and it works by making you believe the PIN is doing something other than sending money out. The offence is cheating under section 318 of the Bharatiya Nyaya Sanhita, 2023, and where the fraudster posed as a bank, a merchant or an official, section 66D of the Information Technology Act, 2000 applies to the personation.

Understanding the machinery is what stops the next attempt. Most victims describe what happened in the language the fraudster used, and that description is why the bank rejects the claim. A collect request is not a refund. A PIN entered on a request is not a verification. A screenshot of a payment is not a payment. Once you can name the step at which you were deceived, you can also name the record that proves it.

How a UPI payment actually works

UPI is a set of rules and a switching system operated by the National Payments Corporation of India. Your bank or payments app is a payment service provider, and it is the entity that holds your account and your registration. A payment needs three things: a virtual payment address or a linked account, a request for funds raised by one side, and your PIN entered against that request.

Two directions matter. In a pay request, you initiate the transfer to a virtual address you have chosen. In a collect request, the other side initiates and you approve. The collect request screen shows the payer's name and the amount, and approving it debits your account. A collect request is never a credit, never a refund, and never a verification step. That single fact accounts for a large share of UPI losses.

The four scripts most UPI frauds follow

The buyer who overpays

You are selling something on a classifieds site. A buyer agrees instantly, then sends a collect request or a QR code saying it is for the payment. The screen that appears asks you for your PIN. The moment you enter it, money leaves your account. The "buyer" then claims the payment failed and asks you to try again. The second request takes a second amount.

The refund that never comes

You are told a failed transaction or an order cancellation is being refunded. The caller, or a chat agent, sends a collect request described as a refund. Refunds in UPI are credits initiated by the merchant's payment service provider; they do not require the customer to approve a debit request. A "refund" that asks for your PIN is a payment to the fraudster.

The screen-share takeover

This is where TeamViewer and similar remote-access tools appear. The fraudster persuades you to install a screen-sharing app to "help" with a payment problem, then watches your screen as you log in. The PIN is entered by you, on camera. The deception is not technical, it is social, and the evidence is the call log and the installed app rather than a hacked server.

The fake collection account

A genuine-looking payment page or app collects your PIN and forwards it to a real payment request the fraudster has raised. This overlaps with phishing and with section 66C of the IT Act 2000, because the page is impersonating a bank or a payment provider.

Where the money goes, and why that decides recovery

The first receiving account is rarely the fraudster's own. Funds land in a mule account, opened with someone else's KYC or with a legitimate-looking current account, and are moved within minutes through a chain of transfers or withdrawn at an ATM. The payment network records the chain, but each hop shortens the window in which a hold can catch the balance.

This is the practical reason for the reporting clock. A call to 1930 within minutes gives the fraud registry a chance to place a hold on the first beneficiary before withdrawal. A call the next morning usually finds the account at zero, and the case then depends on the investigation identifying the account holder and on the court ordering restitution from whatever is recovered. The law does not create an insurance fund for UPI losses, and the bank's liability is governed by the Reserve Bank's framework for unauthorised electronic transactions, read with the customer protection directions.

What the law says, section by section

The criminal side is layered. Section 66 of the IT Act 2000 covers unauthorised access to a computer resource, which fits the use of a stolen PIN or a compromised device. Section 66C covers identity theft, which fits the use of another person's credentials or KYC. Section 66D covers cheating by personation using a computer resource or communication device. Section 67 and 67B become relevant where the fraud runs through an app or page hosting obscene or prohibited material, which is uncommon in payment fraud but appears in sextortion-linked cases.

On the substantive side, section 318 of the BNS 2023 covers cheating, section 316 covers criminal breach of trust where money was entrusted rather than induced, and section 308 covers extortion where a threat was used. Where the fraudster created a fake bank page or app, the trade marks and copyright provisions may also be attracted, though prosecutions usually proceed on the cheating sections because they carry the clearer sentence structure.

The procedural provisions matter as much as the penal ones. Section 173 of the Bharatiya Nagarik Suraksha Sanhita, 2023 requires registration of an FIR for a cognizable offence. Section 35 requires the police to record the information, and section 175(3) gives you the magistrate route if the station refuses. Section 187 governs the report the investigating officer files. Section 63 of the Bharatiya Sakshya Adhiniyam, 2023 governs the certificate for electronic records, and it applies to the bank statement, the chat thread and the app logs alike.

What to do after a UPI debit you did not intend

1. Call 1930 immediately with the UPI reference number from the SMS. Ask for a freeze request on the beneficiary.
2. Raise a dispute in the UPI app against the specific transaction and screenshot the complaint reference. This is separate from the bank complaint.
3. Email the bank's nodal officer stating the transaction was unauthorised, with the reference numbers and the time of detection.
4. File the portal complaint on cybercrime.gov.in and keep the acknowledgement.
5. Preserve the call log, the chat, the collect request notification and the app's transaction detail page before deleting anything.
6. Follow up in writing and keep every response, including refusals.

What the payment network already knows

You do not have to reconstruct the transaction from memory. The payment network holds a reference number for every UPI transaction, and the beneficiary bank holds the account holder's KYC, the device binding and the login history. The payer's bank holds the registration record for your virtual address, the device identifier used at the time of the payment and the notification delivery log. None of this is available to you directly, which is why the investigating officer's written request to the bank matters more than the story in your complaint. When you write your follow-up, ask which of these records have been requisitioned and on what date. An investigation that has not asked for the device binding has not really started.

What decides whether you get the money back

Three questions decide most UPI disputes. Did you approve a collect request believing it was a credit or a verification? If yes, the case is about deception, and the notification text and the call record become central. How fast did you report? The bank's liability under the RBI framework turns on whether you reported within three working days. Did the bank or the payment provider fail a control it was required to apply, such as permitting a collect request to be presented in a misleading way or onboarding a mule account with deficient KYC?

The weakest position is the one most victims are in: PIN entered voluntarily, reported a week later, no record of the call. The strongest position is a PIN entered after a documented deception, reported within hours, with the collect request notification preserved and the beneficiary account still funded. Between those two, the difference is usually two hours and a screenshot.

Mistakes that weaken a UPI fraud claim

• Describing the loss as a "wrong transfer" to the bank. A wrong transfer is a customer error; the bank's framework treats unauthorised transactions differently.
• Approving a second collect request because the first "failed". The first one usually succeeded.
• Trusting a payment screenshot. A screenshot is an image, not a bank confirmation; check your own credit balance.
• Filing only with the UPI app and not with the bank or the police. The app dispute resolves the ledger entry, not the crime.
• Signing the bank's standard declaration without reading it. Some forms contain an admission that the customer shared the PIN.
• Deleting the fraudster's chat to "clean up" the phone. That chat is the proof of inducement.

When to involve a lawyer

Small losses with a fast report are usually resolved by the bank and the app. A lawyer becomes useful when the bank has rejected the claim in writing, when the amount justifies an urgent freezing application, when the police have not registered an FIR and an application under section 175(3) of the BNSS 2023 is needed, or when you are the person whose account was used as a mule and you are facing a freeze or a notice. The same facts can make you a complainant in one file and an accused in another, and that is the point at which advice pays for itself.

Start with the cyber crime lawyer in Kolkata page for the procedure and forum, and read the cyber law articles for the evidence certificate and the bank escalation sequence in more detail.

Frequently asked questions

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Related articles

• Work From Home Scam: What It Is and How It Runs
• Trading app scam: what it is and how the fraud runs
• Stock market scam: how the fraud actually runs in India
• Sextortion: What It Is and How the Fraud Actually Runs
• Net banking fraud: what it is and how it works
• Mutual fund scam: what it is and how the fraud runs

Cyber crime lawyer in your city · Bank account freeze help · Contact