UPI payment fraud in India 2026: collect requests, PIN misuse, fake QR codes, the Rs 22,800 crore fraud figure, and what banks must do by 2027.
UPI fraud in India is not a technical break, it is a social engineering of the approval step, and the control being defeated is the one-time PIN on the phone. The dominant pattern is a collect request: the fraudster sends a request rather than receiving money, the customer enters the UPI PIN, and the amount is debited to the fraudster's account. The NCTAU flagged in October 2026 that deepfake welfare-scheme advertisements push victims into approving collect requests under pretexts of tax and processing fees. The rule to repeat: a UPI PIN authorises a payment, it does not receive money.
Five, in ascending order of sophistication. Fake collect requests, where the fraudster sends a request that looks like a refund and the customer approves it in their app. Fake QR codes on a shop counter or a poster, which route the payment to the fraudster's account. Fake customer-service numbers on a fraudulent website, which then talk the customer into approving a collect request or sharing a PIN. Overpayment and refund scams, where a small genuine amount builds trust before a larger fraudulent one. And deepfake-driven schemes, where the NCTAU flagged in October 2026 that advertisements impersonating the Prime Minister and ministers announce fake welfare schemes and then coerce repeated payments under pretexts of taxes, processing fees and registration charges. In every case the mechanism is the same, and the customer is the one who approves it.
One rule, applied without exception: a UPI PIN authorises a payment and never receives money. No legitimate merchant, bank, government department or support agent asks for it. Second rule: a customer never accepts a collect request they did not initiate in the course of a transaction they were making, because the request is the fraud, not the money. Third rule: the number to call for support is the one on the bank card or the official app, never the one in an SMS, an ad or a search result. Fourth rule: check the payee name in the app before approving, because UPI displays it, and a mismatch is visible if you look. These four rules would have stopped the overwhelming majority of the 2026 cases, including the deepfake welfare-scheme cases the NCTAU described.
RBI's June 2026 instructions, effective 1 January 2027, allow compensation of 85% of net loss or Rs 25,000, whichever is less, for a genuine individual victim with gross loss up to Rs 50,000, provided the customer reports to the bank and to the National Cyber Crime Reporting Portal or the 1930 helpline within 5 calendar days. For a customer, the practical consequence is that speed is now worth money. For a bank, it means the fraud desk's internal clock and the customer's complaint clock now matter to the outcome, so banks need a documented, fast dispute process and the evidence to defend a genuine-claim assessment. The scale of the problem is what prompted the change: over Rs 22,800 crore lost to telecom fraud and impersonation scams, and 21,900 digital-arrest complaints involving over Rs 647 crore in the first eight months of 2026.
Six things. Display a static QR code with the merchant's own UPI ID and never issue collect requests to customers. Verify every out-of-band payment instruction, such as a changed account, by a callback to a number already on file. Publish a refund and cancellation policy that states refunds are always credited back to the source account rather than sent to a new UPI ID, because that substitution is the core of many frauds. Train the counter staff on the one rule about PINs, and give them a script. Keep the transaction log with the payee name, the reference and the timestamp, because a dispute decided on evidence succeeds. And monitor for a pattern of many small credits followed by a large one, which is a standard layering pattern. AAVETech runs fixed-price UPI and payment fraud readiness reviews at roughly Rs 12,000 to Rs 30,000 per tester-day plus 18% GST.
| Pattern | How it works | Response |
|---|---|---|
| Collect request | Customer approves a request they did not initiate | Never approve an unexpected request |
| Fake QR code | Payment routed to the fraudster's account | Check the payee name before approving |
| Fake support number | Fraudster talks the customer into approving or sharing a PIN | Call the number on the card or in the app |
| Refund substitution | Refund sent to a new UPI ID instead of the source | Refund only to the original account |
| Deepfake scheme ad | Fake welfare scheme leading to a collect request | Verify the scheme on the department website |
UPI fraud in India is not a technical break, it is a social engineering of the approval step, and the control being defeated is the one-time PIN on the phone. The dominant pattern is a collect request: the fraudster sends a request rather than receiving money, the customer enters the UPI PIN, and the amount is debited to the fraudster's account. The NCTAU flagged in October 2026 that deepfake welfare-scheme advertisements push victims into approving collect requests under pretexts of tax and processing fees. The rule to repeat: a UPI PIN authorises a payment, it does not receive money.
A collect request you did not expect, and did not initiate, is the fraud mechanism rather than a transaction. Legitimate collect requests occur in specific business flows, and the safest rule for a customer is to decline any request that is not part of a payment they are making at that moment, and to check the payee name before approving anything.
Under RBI's June 2026 instructions, effective 1 January 2027, a genuine individual victim with gross loss up to Rs 50,000 can be compensated at 85% of net loss or Rs 25,000, whichever is lower, provided the loss is reported to the bank and to the National Cyber Crime Reporting Portal or the 1930 helpline within 5 calendar days.
Because they supply the trust that a bare collect request lacks. The NCTAU flagged in October 2026 that advertisements impersonating the Prime Minister, finance ministers and chief ministers announce fake welfare schemes and then coerce payments under pretexts of taxes, processing fees, registration and verification charges, using scratch-card cashback and spin-to-win to trigger collect requests.
No. There is no legitimate payment flow that requires a customer to enter their UPI PIN for the benefit of the merchant or a support agent. If someone asks for it, end the interaction and call the number on your card or in the official app.
Display a static QR code with your own UPI ID, never send collect requests, verify out-of-band payment changes by callback, refund only to the original source account, train counter staff on the one PIN rule, and keep a transaction log with payee name and timestamp so disputes can be decided on evidence.
Read the full guide on AAVETech: How Do You Stop UPI Payment Fraud in India?.
Send us your payment approval and refund flow and we will return a fixed-price UPI fraud readiness review with a written policy set.
Talk to an analyst about this.