"Let Me Help You with That": How UPI Phishing Fraud Empties Bank Accounts

Imagine your phone rings while you are in the middle of something. A polite voice says it is calling from your bank and that there is a small problem with your account. It can be fixed in two minutes, if you just forward a message and read out a code. Most of us, wanting the problem to go away, would at least consider it.

That moment of trust is exactly what UPI phishing fraud depends on. It is a form of social engineering: the criminal does not hack your phone or your bank. They persuade you to do the one step that lets them in.

How the fraud unfolds

It usually starts with a phone call. The caller offers to help with something routine, such as updating your KYC, linking your Aadhaar, or connecting your account to UPI. Sometimes the story is a blocked account. Sometimes it is a refund.

Then comes the request. You are asked to send a message, which the caller describes as an alphanumeric link or code, from your registered mobile number to a particular number. Which number you are told to use depends on the bank your account is with. You are also asked to share an OTP that arrives on your phone.

It all feels like paperwork. In reality, those two steps are what the fraudster needs to set up your UPI profile on a phone of their own. Once they are in, they create their own MPIN, and from that point your bank account is effectively theirs to use. The tricks that normally protect UPI, such as tying the app to your SIM, are the very thing they get around by using your own message and your own OTP.

By the time you realise something is wrong, the money is already moving. Victims often find out only when they see a string of debit alerts, and then have to scramble to get the account blocked.

Why the SIM binding does not help you here

UPI apps check that the phone you are using and the SIM registered with your bank belong together. This is a good safeguard. But it relies on the genuine customer sending the verification message. When a fraudster persuades you to send it for them, the safeguard confirms a stranger's device on your behalf.

The lesson is simple and a bit uncomfortable: the strongest lock fails if the owner hands over the key because someone friendly asked.

The fake customer care trap

There is a second route into the same fraud, and it catches people who think of themselves as careful. Many of us, when a flight needs rescheduling or an online order needs a refund, search for the company's customer care number and call the first one that appears.

Fraudsters know this. They get numbers listed in search results and on map listings, and pose as the airline or the e-commerce company. The person who answers sounds helpful, asks you to follow some steps, and the steps lead back to the same place: a code to forward, an OTP to read out.

If the number did not come from the company's own app, official website or the receipt in your hand, treat it with suspicion.

Why it works so well

• Helpfulness. The caller is framed as someone solving your problem, so refusing feels rude.

• Official language. Words like KYC, Aadhaar linking and RBI sound serious, so people do not question them.

• Pressure. A threat of a blocked account or a missed refund leaves little room to think.

• Small asks. Forwarding a message feels harmless compared with giving away a password, which is exactly why the request is split into small steps.

The legal side

Cases like this are generally dealt with under the Information Technology Act, 2000, notably Section 66C (dishonest use of someone's identifying information) and Section 66D (cheating by personation using a computer resource), along with the Bharatiya Nyaya Sanhita provisions on cheating. The exact sections depend on the facts recorded in each FIR.

What to do, and what never to do

Never:

1. Share an OTP with anyone who calls claiming to be from a bank or the RBI.

2. Forward a link or a message to a number given by a caller.

3. Call a customer care number you found through a search without checking it against the company's official app or website.

4. Let a stranger talk you through steps on your phone, however patient they are.

Do:

1. Hang up and call the number printed on your bank card or on the bank's official site.

2. Keep your phone's SMS and call history, because they help the investigation.

3. Tell elderly relatives about this scam. They are targeted often, and a two-minute chat can save their savings.

If it has already happened

Act fast and do not feel embarrassed. These people are professionals.

1. Call your bank right away and ask them to block UPI and freeze the account or the disputed transactions.

2. Dial the National Cyber Crime Helpline, 1930, as soon as you can.

3. File a report at cybercrime.gov.in and keep the reference number.

4. Collect the transaction IDs, screenshots and the caller's number.

5. Report quickly. Under RBI's framework for unauthorised electronic transactions, reporting within three working days generally gives the customer zero liability where the fault is not their own. Delay can weaken that protection.

A closing thought

UPI has made payments quick and simple for hundreds of millions of people. That convenience is also why fraudsters are attracted to it. The defence costs nothing: no bank, no RBI official and no customer care executive will ever need you to forward a link or tell them an OTP. If someone asks, you have found the scam.