Cybercriminals are targeting UPI users with a 'fake refund' scam. Fraudsters send unsolicited money to accounts and use social engineering to pressure victims into scanning malicious QR codes or entering their UPI PINs, which inadvertently authorizes a debit from the victim's own bank account. This guide details how to recognize these deceptive tactics and how to protect your digital wallet from such fraudulent activity.
Indian financial institutions, including the State Bank of India, have issued urgent warnings regarding a rise in UPI-based fraud known as the 'jumped deposit' or 'fake refund' scam. This security threat relies on social engineering, a technique where criminals exploit human trust and emotions to manipulate victims into making unauthorized transactions.
How the Deception Works
The scam typically begins with a perpetrator sending a small or medium-sized sum of money to a target account. Shortly after, the fraudster contacts the recipient—often through phone calls or urgent messages—claiming the transfer was made in error. By creating a high-pressure, emotional scenario, the scammer attempts to convince the victim to refund the money immediately. The trap is sprung when the scammer sends a custom QR code or a payment link, falsely describing it as a 'refund gateway.'
When the recipient scans this QR code and enters their UPI PIN, they are not performing a refund. Instead, the action functions as a 'collect request,' effectively authorizing a debit from the victim’s bank account. It is a fundamental rule of digital payments that a UPI PIN is exclusively for authorizing money to be sent (debited) from an account. A user never needs to enter a PIN or provide an OTP to receive money or a refund.
Official Guidance and Protection
Banking authorities emphasize that if you receive an unexpected credit in your account, you should not interact with the sender. Instead, verify the transaction independently through your official bank application or the UPI platform's statement page, ignoring any screenshots or messages provided by the stranger. If the funds are confirmed, the correct procedure is to contact your bank’s customer service through official channels to initiate a formal reversal.
By allowing the bank to handle the reversal process, the account holder creates a documented trail, which provides a layer of protection against liability. Financial regulators also caution against sharing banking credentials or scanning codes sent by unknown individuals, as these can lead to broader compromise of financial data.
Reporting Fraudulent Activity
If you suspect that you have been targeted by this scam, or if you have already been defrauded, immediate action is necessary. Do not continue to communicate with the suspected scammer. Instead, report the incident immediately to the national cybercrime helpline at 1930 or through the official portal at cybercrime.gov.in. Additionally, notify your bank right away so that they can secure or freeze your account to prevent further unauthorized transactions. Taking these steps quickly is essential to safeguarding your financial assets and minimizing potential losses.