All you know about UPI Fraud Types and Prevention to save Money

Digital transactions are the need of the hour, and with the country rushing towards a cashless economy, it’s important to stay vigilant of fraud and all the loopholes in the system. You will encounter many instances of fraud that will increase fraudsters’ revenue due to open digital avenues. If you aren’t staying vigilant, you are more prone to lose your hard-earned money. Changing your UPI pin every month is one of the practices you can do to keep your distance from the UPI scam. UPI fraud is like other digital scams due to human fear, greed, and emotion. So, be aware!!

What is UPI Fraud?

UPI, being one of the foundation stones of the digital economy, needs to be airtight when it comes to security. With UPI transactions hitting an all-time high this year, it’s no surprise that UPI has been one of the most preferred payment methods in recent times. So, with the popularity and presence in the digital world, it is more prone to UPI fraud, UPI scams and hacking. UPI fraud happens when scammers steal your money or sensitive information by breaking into your account.

And why wouldn’t it be?

You only need a 4-digit PIN to authorize your transaction, and the deal is done in seconds. But, of course, something so extraordinary comes with its share of liabilities like the UPI scam & UPI fraud, and that’s what we’ll see in this article.

Amid a massive spike in online banking fraud & UPI fraud, HDFC Bank issued a warning to all online banking users. According to the alert, fraudsters steal money from users’ bank accounts via UPI. In addition, hackers access users’ mobile phones remotely through a device control app called AnyDesk.

So, how do we deal with UPI fraud? How do hackers take your information? Can UPI be hacked? What are the best ways to keep yourself safe from so many seemingly intelligent tricksters online? We will answer them all.

Let’s begin!

Type of online fraud/UPI fraud

Being aware of the types of UPI fraud activities out there is a part of staying vigilant. While there are one too many types of UPI fraud, we’ll be discussing those about UPI scamming in this article. Below are the types of online fraud:

1. Phishing

Phishing is the most common UPI fraud. Fraudsters send bogus emails to access sensitive information of the potential victim. Once the victim keys their details (password or PIN) into the fraudulent site, the information is immediately passed on to the hacker for misuse. This way, the user is more prone to UPI scam.

2. Malware

Malware is one of the most common forms of UPI fraud and can be mistakenly downloaded from a fake email attachment or an unsecured website. Malware is designed to extract and copy data from the infected device.

3. Money Mule

Money Mule is a more elaborate fraud where once the victim’s data is obtained, fraud rings transfer money to an intermediary account to house the loot. This account acts as one of the money mules to park money collected from different victims. It is also common in UPI hacking.

4. SIM Cloning

SIM cloning is a recent addition that has mushroomed after the OTP-mandatory rule by banks. If a fraudster clones your SIM, he can even change the UPI PIN. The fraudster gets hold of the victim’s bank account details and ID proof to reset the PIN. Within a minute, you will be the victim of UPI fraud.

5. Vishing

Vishing is mostly fraudsters posing as bank representatives, asking questions ‘on behalf of the bank’. These individuals weave a web of lies and enquire about the victim’s personal information to extract their PIN or password.

How do hackers execute UPI fraud?

It’s been observed that fraudsters follow a pattern whilst executing these elaborate plans. As a result, we’ve managed to weave a stepwise timeline of how these plans are generally performed. Let’s take a look at how UPI fraud occurs:

• Step 1: It all starts with a random call. Fraudsters usually call targets to get their attention, as opposed to texting. They commonly disguise themselves as a bank representative, calling for a seemingly harmless issue.
• Step 2: To make the call sound legit, they proceed to ask verification questions like your date of birth, name, or mobile number.
• Step 3: There is always a problem. Hackers use technical difficulties in the app or website to talk to the victim. They usually weave false stories that the victim may have to forfeit their personal information to resolve the issue.
• Step 4: Once the fraudster has convinced the victim, they proceed to ask the latter to download an application on their phone. Some apps are AnyDesk and ScreenShare, available on the Google Play Store.
• Step 5: While downloading AnyDesk or any similar application, it asks for the user’s privacy permission, like any regular app. But don’t be fooled; these apps can access everything on your phone.
• Step 6: The fraudster will then ask the victim for a 9-digit OTP generated on their phone. As soon as the victim reveals the code, the hacker will also ask to grant permission from the phone.
• Step 7: When the app acquires all permissions required, the caller starts to take complete control of the victim’s phone without their knowledge. After full access to your phone, a hacker steals passwords and begins transacting with the victim’s UPI account. Now you are one of many victims of UPI fraud.

We identified other approaches, too. For example, fraudsters send an SMS and ask the victim to forward it to another number they provide. After the message is successfully sent, the fraudster can link the victim’s mobile number or account through UPI to their mobile.

Fraudsters also send a ‘collect request ‘or a refund request to your Virtual Payment Address (for ex: name@bankname) on apps like Google Pay, PhonePe, etc.

Most users authorize these requests without paying attention, leading to UPI fraud and a large amount of money being collected from their accounts.

Staying vigilant: A guide to prevent UPI fraud

Scamsters aren’t inevitable; they can, of course, be avoided by taking some essential precautions. These aren’t just to keep you away from fraud; these are also fundamental things to keep in mind to keep all your information safe in the Internet era.

1. Beware of engaging with fraudsters

As vague as it sounds, avoiding engaging with UPI fraud is the best way to protect yourself from fraudsters. Your bank will never call to discuss your sensitive information; if you receive any call asking you to do the same, that’s a red flag right there.

You can check for the authenticity of unknown numbers with apps like Truecaller, which has a global database of numbers flagged by users.

2. Take extra precaution while requesting/accepting requests

Fraudsters take advantage of the “request money” feature on apps like Google Pay, PhonePe, BHIM, etc. Imposters express interest in buying a product advertised on various online platforms and engage with the seller on a phone call.

They make the seller of the product transfer the money using the UPI apps’ ‘request money’ option. So, a tiny careless click can sometimes cost you thousands via UPI fraud. Remember, receiving money requires no PIN.

3. Pay attention to SPAM warnings on your UPI app

UPI apps like Google Pay and PhonePe generally give users a spam warning if they receive a request from an unknown account. So, keep an eye out for such statements, and if you spot any suspicious accounts, report them as spam or face UPI fraud.

4. Be wary of malicious apps

UPI Frauds have also been found using fake mobile apps to cheat people. They create an app similar to the original bank app and submit it to the Google Play Store.

When a customer accidentally downloads and installs the fake app on their mobile phone and gives necessary permissions, the app sends out sensitive data to enable fraudsters to withdraw money from the victim’s account.

Several fake apps like Modi Bhim, Bhim Modi App, BHIM Payment-UPI Guide, BHIM Banking Guide, Modi ka Bhim, etc., have been reported to have stolen customers’ data in the name of providing some valuable banking service.

5. Follow security practices to avoid UPI fraud

Make sure that you don’t reveal your PIN to strangers under any circumstances. Also, make sure to protect your UPI apps with biometric recognition software. This way, hackers cannot misuse your account. You should also install anti-virus software to check for other malicious software.

6. Never open emails without checking their authenticity to avoid UPI hacking

Emails are one of the easiest ways to trick users into downloading Malware and obtaining their information. Always scan your emails for viruses/Malware to avoid UPI fraud.

7. Keep a check of your account every once in a while

Once in a few months, sift through your account activity to check for any suspicious behaviour on your account. We often forget to keep track and may miss a few red flags along the way. It’s always best to check thoroughly once in a few months. If you notice any unusual pattern or you are prone to UPI fraud, make sure to alert the bank right away.

8. Avoid using open Wi-Fi

Open Wi-Fi is never a good idea as it may give the hacker a chance to access everything on your device. Instead, always check if the Wi-Fi is trustworthy before connecting to it.

9. Keep track of all your bank messages to avoid UPI fraud

Take a closer look when you receive messages from your bank. Know the difference between a password, PIN, and an OTP and carefully examine the message for inconsistencies to stay safe. Keep track of all your bank messages to ensure you’re aware of all the transactions.

While no application is entirely foolproof, the only way to stay safe is to be wary of fraudsters who can go to any level to fool you. Contact your bank if you think something’s wrong or don’t want a UPI fraud issue.

Also read: IPL & World Cup Contribute to 15% of Digital Payments

Frequently Asked Questions

1. How do I report online money fraud or UPI fraud?

In case of online UPI fraud, you need to contact the company or bank that issued the credit/debit card and inform them about the fraudulent charge. Then, you can ask them to reverse the transaction and give you a refund.

2. Is the bank responsible for UPI fraud?

No, the PSP (Payment Service Provider) is responsible for any losses incurred during any instance of online payment fraud.

3. What happens if I get UPI scammed?

If you’ve been scammed, you should consider reporting the fraud to the responsible authorities to see if they can take any action and to your state consumer protection office. You can also report scams to the FTC (Federal Trade Commission).

4. Do banks investigate UPI fraud?

Banks provide protection services for their customers, so they don’t have to worry about the ever-increasing sophistication of UPI fraud. The first thing the bank will do is try to substantiate that UPI fraud has occurred. They will ask the cardholder to provide additional details about the transaction and how they know it’s fraudulent. Secondly, depending on the type and scale of fraud, the bank decides whether higher authorities are needed to interfere with the matter.

5. Is sharing account numbers safe, or does it lead to UPI fraud?

Yes, giving someone your basic bank account details, like the account number to deposit money, is generally safe. But, If people ask for crucial information like your social security number and IFSC code, it could be dangerous.

6. What happens if someone hacks your bank account or you face UPI fraud?

If at all your bank account is hacked, you need to verify your account activity, call your bank, freeze your account, change your PIN and other relevant passwords, check your transaction history, file a police report.

7. Do banks refund fraudulent money?

Yes, banks are obligated to refund the money in case of fraudulent activity like UPI fraud. In most cases, banks offer debit fraud protection and must refund the money if the customer follows the bank’s fraud reporting procedures systematically.