UPI fraud: how it works and how to spot it
A UPI fraud works because you approve the payment. Read a link or a QR code first and see which of the usual tricks it has.
Most UPI frauds take one of four shapes: a request that takes money while claiming to give it, a code you must scan to be paid, a fake service desk with a mobile-number UPI ID, or a payment link whose bank ending has one letter changed. The decoder checks a link for each.
The example link has a copied bank ending, so the decoder reads it Medium and finds 1 thing worth a second look. It would send ₹850 to quickmart@okhdfcbnk, which is exactly what the sender hopes you do not read before you approve.
Nothing you paste leaves your device, and the decoder never contacts a bank, an app or anyone else.
Common questions
Do I ever have to scan a QR code to receive money?
No. Scanning a payment code only asks your UPI app to send money, and so does entering your PIN. Receiving needs neither, so a person who says you must scan or enter a PIN to get paid is asking you to pay.
Can any tool tell me if a UPI ID is fraudulent?
No. A UPI ID is text, and its owner cannot be seen from outside. A tool can read the ID for signs a trick leaves, such as a service-desk word or a bank ending with a letter changed. The name your own UPI app shows is the better check.
In what order should I report a UPI fraud?
Call your bank first, to block the UPI ID and stop more leaving. Then call 1930, the national cyber-fraud helpline, and report it at cybercrime.gov.in with the details. Speed matters more than a perfect write-up, so do the writing afterwards.
What if I have already paid someone I now doubt?
Call your bank straight away to block the UPI ID, then call 1930, the national cyber-fraud helpline, and report it at cybercrime.gov.in. Save the chat and the payment details first. The steps are in order in the after-a-scam guide on this site.
Does the decoder send my link anywhere?
No. It is code running in your browser, and the link you paste is read on your device and sent nowhere. Nothing is stored, logged or looked up, so you can paste any link without it leaving your phone.