One wrong click could clear out your bank account: How to spot modern UPI scams

From grabbing groceries to splitting dinner bills, UPI apps like Google Pay have made everyday payments effortless. But as digital transactions become second nature, cybercriminals are finding increasingly deceptive ways to exploit our habits. An unfamiliar link or a seemingly routine phone call could put your bank balance and personal information at risk.

How scammers get in

• Fake Bank Calls and Malicious Downloads: Fraudsters often impersonate bank officials, convincing unsuspecting customers to install an application or click on a link to resolve a fabricated account-related issue. These malicious files, sometimes distributed as APK downloads outside official app stores, can give criminals remote access to a device, particularly when users grant the requested permissions.
• Disguised System-Update Links: Users may receive urgent messages claiming that their smartphones need an immediate software update. Clicking on these links can download malware disguised as a legitimate update. Such applications may access SMS messages, steal personal information, intercept OTPs and monitor activity on the device.

Once a smartphone is compromised, banking credentials and other sensitive information may be exposed, potentially allowing fraudsters to carry out unauthorised transactions. The financial risk can extend beyond the money already available in a bank account. Stolen identity information may also be misused to apply for loans or credit in the victim's name. Cases involving fraudulent loans following smartphone compromises have been reported in India.

Essential protection rules

• Ignore Unsolicited App Requests: Never download an application simply because an unknown caller asks you to, even if they claim to represent your bank. Legitimate bank representatives will never ask you to disclose your UPI PIN or OTP.
• Stick to Official App Stores: Download applications through trusted sources such as the Google Play Store or Apple App Store. Check the permissions they request and be particularly cautious about granting access to Accessibility Services, SMS messages and other sensitive information.
• Protect Your Credentials: Never share your UPI PIN, OTPs or banking passwords with anyone. Remember that a UPI PIN is not required to receive money or claim a refund. You should never enter it at someone else's request to receive a payment.

What to do if you suspect a compromise

1. Disconnect the Internet: Immediately switch off both mobile data and Wi-Fi. Removing the SIM card alone is not enough if the device remains connected to a wireless network.
2. Secure Your Bank Account: Contact your bank immediately and request that UPI and other affected payment channels be blocked or restricted. Also inform the payment application's official support team and report any suspicious transactions.
3. Report the Fraud: Call the national cybercrime helpline at 1930 or register a complaint through cybercrime.gov.in. You should also approach the police. Prompt reporting can help authorities and banks trace and potentially freeze fraudulent funds, although recovery is not guaranteed.
4. Check Your Device: Avoid using banking applications or entering sensitive information on a suspected compromised phone. Remove suspicious applications, run a scan using trusted security software and secure your accounts from a device you know is safe. If signs of malware persist, seek professional assistance or consider a factory reset.

Digital payments should make life simpler, not put your savings at risk. A little caution before clicking a link, installing an application or sharing sensitive information can go a long way towards protecting your money.