UPI Fraud in 2026: The 10 Active Scams and the 5-Step Safety Setup

The electrician who services my building sold an old inverter on OLX last year. The "buyer" was enthusiastic, agreed to full price, and said he had sent the money on PhonePe, just approve the request and enter your PIN to receive it. He approved. He entered his PIN. Rs.18,000 left his account in the time it takes to read this sentence, most of what he had in it. He did everything the scammer said because it sounded exactly like how he imagined receiving money worked.

That misunderstanding, repeated across millions of phones, is why India lost Rs.805 crore to UPI fraud in just the first eight months of FY26, across 10.64 lakh reported incidents. A LocalCircles survey found 1 in 5 UPI users has faced a fraud attempt, and 51% of victims never report it, so the real numbers run higher still.

Here is what makes UPI fraud beatable: almost every active scam exploits the same two or three misunderstandings about how UPI works. Fix those, add a 20-minute safety setup, and you become a hard target. This final article of the Cyber Kavach opening season gives you all ten active scams and the five-step setup, plus the family-sized safety card to forward to your WhatsApp groups.

How big is UPI fraud, and why does it keep growing?

UPI is a victim of its own success. NPCI's own statistics show UPI processing over 16 billion transactions a month, which makes India's payment rails the busiest on the planet. The fraud percentage is tiny; the absolute numbers are not. UPI frauds jumped 85% in FY24 and the trend has held: Rs.805 crore lost between April and November 2025 alone, per data presented in Parliament.

The growth engine is not technical weakness. UPI's cryptography is fine. The engine is social: hundreds of millions of newer users whose mental model of "how receiving money works" was formed by scammers rather than by their bank. Every scam below is social engineering wearing a payments costume, the same species of manipulation I covered in the digital arrest article and the suspicious links guide.

What are the 10 active UPI scams in 2026?

Every one of these is running right now. Each entry: how it works, and the tell that gives it away.

The 5-step UPI safety setup (20 minutes, once)

Prevention beats refunds. These five steps turn a successful scam from a catastrophe into a small loss, and most people never do any of them.

What are your rights when fraud happens? RBI's rules, plainly

RBI's framework on customer liability for unauthorised electronic transactions is clearer than most people think:

• Zero liability when the fraud came from a third-party breach (not your negligence) and you report within 3 working days of learning about it.
• Capped liability (Rs.10,000 for basic accounts, Rs.25,000 for most savings accounts) when you report within 4 to 7 working days.
• Beyond 7 days, the bank's own board-approved policy decides.

The honest caveat: when a victim was tricked into entering the PIN themselves, banks frequently classify the transaction as authorised, which weakens the refund claim. That legal grey zone is exactly why the iron rule and the safety setup above matter more than any after-the-fact remedy, and why the golden hour matters most of all.

The golden hour: what to do the moment fraud happens

1. Call 1930 immediately. The freeze system works best while the money is still hopping between mule accounts. Minutes matter.
2. File at cybercrime.gov.in with transaction IDs, screenshots, and the fraudster's UPI ID or number. Keep the acknowledgement number.
3. Report inside your UPI app and to your bank's fraud line the same day, and put the report in writing (email works) to start the RBI liability clock in your favour.
4. Report even if it feels too small or too late. Your report burns their mule account for the next victim, and late freezes still sometimes catch a hop.

The Cyber Kavach series: the complete season

This article closes the opening season of Cyber Kavach. All five, in reading order:

• Article 1: How to check if your email has been hacked, a free 5-minute self-check
• Article 2: How to check if your WordPress website is hacked, the DIY malware scan guide
• Article 3: Digital arrest scams in India, how to spot the fraud in 30 seconds
• Article 4: Is this link safe? How to check any suspicious link before you click
• Article 5: UPI fraud in 2026 (you are here)

Every article pairs with a free printable resource on the Free Resources page. For this one, download the UPI Safety Card, a single phone-sized card with the iron rule, the 5-step setup, and the 1930 emergency flow, built to be forwarded to every family WhatsApp group you are in.

Frequently asked questions

How common is UPI fraud in India?
Rs.805 crore lost across 10.64 lakh incidents in the first eight months of FY26, after an 85% jump in FY24. LocalCircles found 1 in 5 UPI users has faced an attempt and 51% of victims never report. UPI itself is safe by percentage; the absolute victim count is huge.

What is the single most important UPI safety rule?
You never enter a PIN or scan a QR code to RECEIVE money. Receiving requires nothing. The PIN only sends. Every claim otherwise is theft in progress.

What is the collect request scam?
Scammers send a money request dressed as an incoming payment ("approve to receive"). Approving plus PIN sends your money out. Read notifications slowly: "request FROM" means money leaves if you approve.

Why are screen-share apps dangerous with UPI?
AnyDesk or TeamViewer lets a "support agent" watch your PIN and OTPs live and direct transfers. No genuine support process ever needs your screen. Uninstall them.

Can I get my money back after UPI fraud?
Often, if you call 1930 within the first hour and file at cybercrime.gov.in, freezes catch money mid-hop. RBI gives zero liability for unauthorised transactions reported within 3 working days, capped within 7.

What are RBI's liability rules?
Zero liability reporting within 3 working days (third-party fraud), capped at Rs.10,000-25,000 within 4-7 days, bank policy after that. If you entered the PIN yourself, banks may treat it as authorised, so prevention beats remedy.

Is UPI AutoPay safe?
Yes for genuine subscriptions, but audit your mandates today and revoke unknowns. At approval time, check whether the screen says one-time payment or recurring mandate before entering your PIN.

Should my main account be linked to UPI?
Ideally no. Link a separate limited-balance account and top it up weekly. It is the highest-impact protection available and costs nothing.