New UPI Scams in India 2026: Collect Requests, Fake QR Codes, APK Malware & How to Stay Safe

New UPI Scams in India 2026: How Fraudsters Are Draining Accounts & How You Can Stop Them

 

UPI has made payments extremely convenient for Indians. But the same speed and ease that made it successful have also made it a favorite target for fraudsters.

In FY 2025-26 (till November), government data showed more than 10.64 lakh UPI-related fraud cases involving losses of around ₹805 crore. While the percentage of fraudulent transactions remains low compared to the total volume, the absolute numbers are high enough to affect thousands of people every month.

The nature of UPI scams has also evolved. Earlier, many frauds were simple phishing links. In 2026, the more dangerous ones involve social engineering combined with technical tricks — fake collect requests, QR code stickers, malicious APK files, and hidden autopay mandates.

Here is a clear breakdown of the major UPI scams active right now and how you can protect yourself.

1. Fake Collect Request Scam (Most Common)

This remains one of the most frequent UPI frauds.

How it works: A scammer contacts you (often on WhatsApp or OLX) claiming they want to buy something from you or send a refund/cashback. Instead of sending money, they send a UPI collect request. The notification looks similar to an incoming payment. When you enter your UPI PIN thinking you are receiving money, the amount is actually debited from your account.

Key rule to remember: You never need to enter your UPI PIN to receive money. Entering the PIN always means money is leaving your account.

2. QR Code Swap / Sticker Scam

Fraudsters paste their own QR code sticker over the genuine merchant QR at petrol pumps, parking lots, temples, vegetable shops, and event counters.

You scan what looks like the shop’s QR, enter the amount, and the money goes to the scammer’s account instead of the merchant.

Simple habit that stops this: Always check the payee name on the screen before entering the PIN. It should match the shop or organisation name.

3. Malicious APK / Fake KYC App Scam

This is currently one of the most damaging methods.

You receive a WhatsApp message or SMS saying your bank KYC is expiring, or that you need to update something urgently. The link asks you to download an APK file (not from the Play Store). Once installed, the app often requests Accessibility permission and can read OTPs, record your screen, or take control of your banking apps.

In several recent cases in Andhra Pradesh and other states, victims lost their entire account balance within minutes of installing such an APK.

Never install any APK received via WhatsApp, SMS, or email — even if it claims to be from your bank, Income Tax Department, or a government scheme.

4. UPI Mandate / Autopay Fraud

Scammers trick you into approving a recurring payment (mandate) by disguising it as a one-time verification or small refundable amount. Once approved, money starts getting deducted automatically over days or weeks.

Always check the “Autopay” or “Mandates” section in your UPI app and cancel anything you do not recognise.

5. Advanced Rogue QR & Device Binding Attempts

In some newer cases, scanning a specially crafted QR code has been used to try and link the victim’s phone number to the scammer’s device. This is less common but more sophisticated. The safest approach is still the same — never scan unknown QR codes and always verify the payee name.

What You Should Do Immediately If You Fall for a UPI Scam

1. Call the national cybercrime helpline 1930 as soon as possible.
2. File a complaint on cybercrime.gov.in.
3. Contact your bank and request them to freeze the account / block further transactions.
4. Change your UPI PIN and net-banking password from a different device if possible.
5. If you installed an APK, put the phone on airplane mode, uninstall the app (preferably in Safe Mode), and consider a factory reset after backing up important data.

Speed matters. The earlier you report, the higher the chance that the receiving account can be frozen.

Simple Habits That Protect Most People

• Never enter UPI PIN to “receive” money.
• Always read the payee name before paying.
• Never install APK files from WhatsApp or unknown links.
• Keep transaction limits reasonable.
• Regularly check the Autopay/Mandates section in your UPI app.
• Enable transaction alerts and review them.

For Businesses and Teams

Employees who handle payments or have access to company UPI accounts are also at risk. A single successful social engineering attack can lead to significant losses.

Regular awareness sessions that cover real UPI scam patterns (collect requests, QR swaps, APK malware) help teams recognise these tactics early. At BharatSec, we conduct practical cybersecurity awareness training focused on the actual threats Indian users and businesses face today.

If you would like to discuss training for your team or need help with incident response readiness, you can visit bharatsec.com.

Final Thought

UPI is extremely useful, but it requires a few careful habits. Most successful frauds still rely on the victim being in a hurry or not reading the screen carefully. Once you understand the common patterns, these scams become much easier to spot and avoid.

Stay alert, verify before you pay, and share this information with family members — especially those who are less familiar with how UPI works.