UPI fraud: how the money actually leaves your account
You never enter your UPI PIN to receive money. A PIN authorises money leaving your account, and nothing else. If anyone — a buyer, a "refund" desk, a helpline, a stranger who says he paid you by mistake — asks you to enter your PIN, scan a QR code or approve a request in order to be paid or repaid, that request is taking money from you, not sending it.
How it plays out
The ₹9,000 that was "sent to you by mistake"
An SMS arrives on a Tuesday evening: ₹9,000 credited to your account. It reads like every bank alert you have ever had — the same shape, the same words. The only thing that is different is the sender, which is an ordinary ten-digit mobile number rather than your bank's usual six-character header, and nobody reads the sender.
A minute later that number calls. A man, apologetic and clearly in a hurry: he was paying a hospital bill, mistyped one digit of the UPI ID, and the money went to you instead. He can see your name on the transaction, and he says it. He asks whether you would please send it back, and offers to make it easy — he will send a QR code so you do not have to type anything.
The QR code is a payment request. Scanning it and entering the UPI PIN sends ₹9,000 out of the account. Nothing was ever credited: the alert was an SMS from a person, not a message from a bank.
The other version of this call is worse, because the credit is real. Then the ₹9,000 came out of somebody else's account that had already been compromised, and sending it onward by hand puts a stolen payment through the account. That is how an ordinary account ends up flagged as part of a mule chain and frozen, sometimes weeks later, by a police request from a city the account holder has never been to.
₹9,000 gone in under four minutes, out of an account that never received anything.
A composite of the "wrong transfer" pattern as described in Indian police cyber-cell advisories and bank customer-awareness notices. No real person, bank or case is depicted; the amount is illustrative.
Where it could have stopped
Opening the bank's own app before answering. A real credit shows in the balance; this one did not. And a genuine wrong transfer is reversed by the sender's own bank on a written complaint — the person who received it is never the one who has to send it back.
High riskWhat EnfoldAI does here
Scam SMS filter
EnfoldAI reads that credit alert before you do. A bank message arriving from a personal ten-digit number is not a bank message, and the app marks it as a scam in your inbox — so when the apologetic call comes a minute later, the evidence it depends on has already been labelled.
Flags scam and spam SMS automatically.
Auto-check with EnfoldAIHow this scam works
The order is the explanation. Find where your own experience stops in this list — that is how far along the script has run.
- Every version starts the same way: you are given a reason to expect money. A payment for something you listed for sale, a refund for a cancelled order, a cashback, a prize, a delivery fee they say was overcharged — or a stranger's transfer that landed on you by accident.
- In the "wrong transfer" version, an SMS that looks like a bank credit alert arrives first, sent from an ordinary mobile number rather than a registered bank header. Nothing has actually been credited; the message is the whole of the evidence.
- The caller then asks you to return the money, and supplies the means — a QR code, a link, or a request already sitting in your UPI app. All three are payment instruments. Scanning a UPI QR code or approving a collect request pays out of your account; neither can pull money into it.
- In the collect-request version there is no story about a mistake at all. The request simply arrives with an amount and a plausible name on it, and approving it is what moves the money.
- If you hesitate, they talk you through it: "just enter your PIN to confirm receipt", "approve the request to unlock the credit". The urgency is manufactured and the script is well practised — a hospital, a flight, a closing shop.
- A further variant uses a real refund flow. They ask you to install a screen-sharing or remote-support app so they can "help you claim it", then read your OTP and PIN off your own screen while you type them.
- Occasionally the credit is genuine and comes from an account the scammers already control or have compromised. Returning it by hand is what they want: it launders the transfer through your account and leaves your name on the trail.
If it has already happened
In order, and the order matters. The first step is the one that can still get the money held, so it comes before everything else.
- Open your UPI app and check whether the payment is still pending. If it is, decline it — nothing has moved yet.
- If money has left, call your bank on the number printed on your debit card or in your passbook, not a number from a search result, and ask them to raise a fraud dispute and freeze further debits.
- Report it on the national cyber-crime helpline 1930, or at cybercrime.gov.in, as soon as you can — in the first hour if at all possible. This is what allows the receiving account to be held before the money is moved onward.
- Raise the dispute inside the UPI app you paid from as well. The app is the first level of the NPCI redressal chain and the bank will ask whether you have.
- If a credit really did land in your account and you have not sent it anywhere, leave it alone and tell your bank in writing. A genuine wrong transfer is reversed by the sender's bank; moving it yourself is what puts your account in the chain.
- If you installed a screen-sharing app, uninstall it, then change your UPI PIN and your banking passwords from a different device if you can.
- Keep the transaction reference number, the collect-request screenshot and the phone number that contacted you. Every later step asks for them.
UPI fraud — common questions
The questions people actually ask about this one, answered in a line or two each.
Do I ever need to enter my UPI PIN to receive money?
Someone says they sent me money by mistake. Should I send it back?
How do I know a credit alert is really from my bank?
Can I get UPI money back after I approve a request?
Can scanning a QR code take money from me?
Check before you trust
Paste any SMS, link or app and get a verdict before money moves. Auto-scan flags scam messages the moment they arrive.
Suspicious message? Check it free →