Digital safety · Banking awareness · Cyber law

UPI and Cyber Fraud in India: Common Scams, How to Stay Safe and How to Report Within the Golden Hour

India processes billions of UPI transactions every month, and fraudsters follow the money. Knowing how scams work protects your savings, and the same knowledge is tested in computer awareness, banking and police exams. This guide explains the common frauds, the safety rules, the reporting system and the laws behind it.

By PunjabExams Editorial Team · Updated 29 October 2026 · 7 min read · How we prepare guides

How UPI works — and where fraud happens

UPI (Unified Payments Interface), launched by the National Payments Corporation of India (NPCI) in 2016, lets you send money using a UPI ID (virtual payment address), a mobile number or a QR code, authorised by your UPI PIN. The system itself is secure; almost all UPI fraud happens because a person is tricked into authorising a payment or sharing a secret. Remember one rule: you never need to enter your UPI PIN to receive money.

Common scams and how to spot them

Ten safety rules

1. Never share your UPI PIN, OTP, CVV or passwords with anyone, including people claiming to be from your bank.
2. Check the name displayed before confirming a UPI payment.
3. Do not scan QR codes or enter your PIN to receive money.
4. Use only official apps from official app stores.
5. Do not install screen-sharing apps at a stranger's request.
6. Find helpline numbers only from your bank's official website or app.
7. Set transaction limits in your banking app.
8. Turn on SMS and email alerts for every transaction.
9. Do not click links in unsolicited SMS, email or WhatsApp messages.
10. If someone creates urgency or fear, hang up and verify independently.

The golden hour: what to do if you are defrauded

Speed matters most. The faster a fraud is reported, the better the chance that the money can be frozen before it is withdrawn or moved.

1. Call 1930 — the National Cyber Crime Helpline for financial fraud — immediately.
2. Register a complaint at cybercrime.gov.in (the National Cyber Crime Reporting Portal).
3. Inform your bank and block the card, UPI or net-banking access through the official app or helpline.
4. Preserve evidence — screenshots, transaction IDs, phone numbers and messages.
5. If an FIR is needed, the information can be recorded at any police station as a Zero FIR under the BNSS, or registered by the cyber police.

The Citizen Financial Cyber Fraud Reporting and Management System, linked to the 1930 helpline, connects police, banks and payment platforms so that suspected fraudulent money can be put on hold quickly.

RBI's customer-protection rules (zero liability)

Under RBI's framework on limiting customer liability in unauthorised electronic banking transactions:

Banks are expected to credit the amount involved (shadow reversal) within 10 working days of notification in eligible cases. These rules show why reporting immediately matters.

Telecom-side tools against fraud

• Sanchar Saathi (Department of Telecommunications) — lets you check the mobile connections registered in your name, block lost or stolen phones (CEIR) and report suspected fraud communication through Chakshu.
• Financial Fraud Risk Indicator (FRI) — launched by DoT in May 2025, it classifies mobile numbers linked to cyber fraud by risk level and shares this with banks and payment apps so they can take extra care. The government reported in September 2026 that the FRI had helped prevent suspected fraud losses of more than ₹5,000 crore. See our FRI explainer.
• TRAI's anti-spam rules — require registration of commercial senders and action against unsolicited calls; see our TRAI rules guide.

Laws involved

• Information Technology Act, 2000: Section 66C (identity theft), Section 66D (cheating by personation using a computer resource), Section 43 (unauthorised access and damage).
• Bharatiya Nyaya Sanhita, 2023: cheating (Section 318), organised crime (Section 111), extortion and criminal intimidation.
• Indian Cyber Crime Coordination Centre (I4C) under the Ministry of Home Affairs coordinates the national response.

Practice questions

1. Q1. Which helpline number should be called immediately after online financial fraud?

   • (a) 100
   • (b) 1098
   • (c) 1930
   • (d) 181
   Show answer

   Answer: (c) 1930 — 1930 is the National Cyber Crime Helpline for financial fraud.

2. Q2. UPI was launched by:

   • (a) RBI
   • (b) SBI
   • (c) NPCI
   • (d) SEBI
   Show answer

   Answer: (c) NPCI — NPCI launched UPI in 2016.

3. Q3. To receive money through UPI, you need to:

   • (a) Enter your UPI PIN
   • (b) Share your OTP
   • (c) Do nothing beyond sharing your UPI ID
   • (d) Scan the sender's QR code
   Show answer

   Answer: (c) Do nothing beyond sharing your UPI ID — Receiving money never requires your PIN or an OTP; only sending does.

4. Q4. Under RBI rules, if a third-party fraud is reported within three working days, the customer's liability is:

   • (a) Full
   • (b) 50%
   • (c) Limited to ₹10,000
   • (d) Zero
   Show answer

   Answer: (d) Zero — Prompt reporting of a third-party breach within three working days results in zero liability.

5. Q5. Identity theft is punishable under which section of the IT Act, 2000?

   • (a) Section 43
   • (b) Section 66C
   • (c) Section 66D
   • (d) Section 67
   Show answer

   Answer: (b) Section 66C — Section 66C deals with identity theft; Section 66D with cheating by personation.

6. Q6. Which DoT portal helps you check how many mobile connections are registered in your name?

   • (a) DigiLocker
   • (b) Sanchar Saathi
   • (c) UMANG
   • (d) e-Courts
   Show answer

   Answer: (b) Sanchar Saathi — Sanchar Saathi offers services such as checking connections in your name and blocking lost phones.

7. Q7. A "digital arrest" scam typically involves:

   • (a) Police arresting someone online legally
   • (b) Fraudsters impersonating officials on video calls and demanding money
   • (c) Banks freezing accounts for KYC
   • (d) Courts issuing e-summons
   Show answer

   Answer: (b) Fraudsters impersonating officials on video calls and demanding money — No genuine agency arrests people over video calls or demands money to close a case.

Frequently asked questions

Can money lost in a UPI fraud be recovered?

Sometimes. If you report quickly through 1930 and cybercrime.gov.in, the money may be frozen in the receiving accounts before it is withdrawn. Recovery becomes harder with every hour of delay.

Is it safe to use UPI?

Yes, if you follow basic rules: never share your PIN or OTP, check the payee's name and use official apps.

Should I also file a police complaint?

Yes. The online complaint on cybercrime.gov.in is forwarded to the police, and an FIR may be registered depending on the case.

Practise current affairs MCQs All preparation guides