Author: Himanshu Mishra

Disclaimer: Everything shared in this article is strictly for learning purposes. We’re not providing financial or legal advice. If someone has cheated you through a fake UPI transaction, act fast call your bank immediately and report it at cybercrime.gov.in or dial 1930. For case-specific guidance, consult a qualified professional.

Key Takeaways

• Every UPI payment creates a unique 12-digit number called a UPI Reference Number or UTR. This number tells you whether your payment actually went through or not.
• To check if a transaction was successful, just open your UPI app and look at your transaction history. You can also log in to your bank’s mobile or internet banking, or use the NPCI dispute system to cross-check.
• Here’s something important, scammers often send fake payment screenshots with made-up transaction IDs. So never trust a screenshot alone. Always match the transaction ID with your actual bank records. That’s the only way to know for sure.
• If money got deducted from your account but never reached the other side, don’t panic. As per RBI rules, the amount should automatically get reversed within 5 working days. If that doesn’t happen, raise a complaint right away.
• And the golden rule, never hand over any product, service, or refund unless the payment actually shows up in your bank account. A screenshot means nothing. Your bank balance does.

Why You Need to Know How to Verify a UPI Transaction ID

Here’s something I’ve seen happen repeatedly while working on scam awareness: a shopkeeper in a busy market gets shown a “successful payment” screenshot on someone’s phone, hands over the goods, and later discovers the money never arrived.

This isn’t a rare edge case. According to RBI’s Annual Report for FY2024–25, digital payment frauds numbered 13,516 cases accounting for 56.5% of all reported banking frauds. A LocalCircles survey of over 32,000 UPI users found that 1 in 5 families experienced UPI fraud at least once in the past three years.

The UPI ecosystem processed over 185.8 billion transactions in FY2024–25 alone (a 41.7% year-on-year increase, per NPCI data). With that volume, verifying whether a specific payment actually happened isn’t optional anymore, it’s a basic financial safety skill.

And the simplest way to do it? Check the UPI Transaction ID.

What Is a UPI Transaction ID (and How Is It Different from UTR)?

Before diving into verification steps, let’s clear up a common confusion. There are multiple reference numbers involved in a single UPI payment, and people often mix them up.

UPI Transaction ID vs UTR vs UPI Reference Number

Term	What It Is	Format	Where to Find It
UPI Transaction ID	A unique identifier generated by your UPI app for every transaction you initiate	Alphanumeric (varies by app)	Transaction history in your UPI app
UPI Reference Number	A 12-digit number assigned by NPCI’s UPI system to track the transaction across banks	12 digits (numeric)	Transaction details screen, SMS alerts
UTR (Unique Transaction Reference)	A bank-level reference code used for interbank settlement	Alphanumeric (format varies by bank)	Bank statement, internet banking portal

The UPI Reference Number is the most important one for verification purposes. It’s the number that NPCI, your bank, and the recipient’s bank all recognize. When someone shows you a payment screenshot, this is the number you should be cross-checking.

How to Verify UPI Transaction ID Online: 5 Methods

Method 1: Check Transaction History in Your UPI App

This is honestly the simplest way to check. Just open your UPI app doesn’t matter if it’s Google Pay, PhonePe, Paytm, or BHIM.

Once you’re in, look for your payment history. It’s usually sitting right there on the home screen or somewhere in the main menu. Find the transaction you’re looking for, scroll by date or use the search bar, and tap on it.

You’ll see everything, the amount, when it was made, who received it, and whether it actually went through. Right there in the details, you’ll also find a 12-digit UPI Reference Number. Save that number. It comes in handy if anything goes wrong later.

And if you’re selling something – please don’t trust a screenshot the buyer shows you. Check your own app. Check your own account. What’s on their screen is their business, not your proof.

Always verify your UPI Id here

Method 2: Verify Through Your Bank’s Mobile or Internet Banking

Your bank records UPI transactions on its own, totally separate from your UPI app. So if you want to be really sure, this is where you go.

Step 1: Log in to your bank’s official mobile app or internet banking portal.

Step 2: Go to “Account Statement” or “Transaction History.”

Step 3: Filter by date range to locate the specific UPI transaction.

Step 4: The bank statement will show the transaction amount, the counterparty’s UPI ID or name, the UTR number, and the debit/credit status.

Here’s the thing: If a payment looks “successful” in someone’s UPI app but shows nothing in your bank statement, something is off. Either the app hasn’t updated yet, or that screenshot was never real.

Method 3: Use SMS Alerts from Your Bank

Your bank texts you every single time money moves in or out. The message shows the amount, a partial account number, and a reference code.

It’s a quick check, not a deep one but it works. If someone says they paid you and your phone got no message from the bank, don’t release anything. Just stop and verify first.

Also, check that your SMS alerts are actually switched on. Surprisingly easy to turn them off by mistake and not realise it until something goes wrong.

Method 4: Raise a Query Through NPCI’s UPI Help Portal

If you need official confirmation of a transaction’s status especially for disputes, fraud cases, or when your bank isn’t resolving the issue NPCI has a dedicated system.

Step 1: Visit the NPCI website (npci.org.in) and navigate to the “UPI” section, or directly contact them through their helpline at 1800-120-1740 (toll-free).

Step 2: You’ll need to provide the UPI Transaction ID or Reference Number, the transaction date, the amount, and your registered mobile number.

Step 3: NPCI can verify whether the transaction was processed on its system and confirm the settlement status between banks.

This method is particularly useful when there’s a dispute between the sender’s bank and the receiver’s bank, and neither side is providing clarity.

Method 5: Contact Your Bank’s Customer Support Directly

Sometimes you just need to talk to a person. Call your bank’s customer care, give them your UTR number, the transaction date, and the amount and they’ll trace it for you on the spot.

If money left your account but the transaction failed, RBI says the bank has to reverse it within 5 working days. If that window passes and nothing happens, escalate. You’re well within your rights to do so.

As per RBI guidelines, banks are required to resolve UPI transaction complaints within specific timeframes. Failed transactions where money was debited should be auto-reversed within T+5 working days. If that doesn’t happen, you have the right to escalate.

How to Spot a Fake UPI Payment Screenshot

Knowing how to verify a UPI transaction ID is your strongest defence against fake payment screenshot scams. But it also helps to recognize the visual red flags before you even get to the verification stage.

Here are the most common signs of a fabricated screenshot:

• Take a close look at the fonts and spacing. Most fake screenshots are made using photo editing apps. So zoom in a little does the font on the amount look the same as the rest of the text? Does anything look slightly off, stretched, or out of place? Even a small gap or alignment issue can give it away.
• Check the UPI Reference Number carefully. Every real UPI transaction has a 12-digit number only digits, no letters. If the number in the screenshot is too short, too long, or has any alphabets in it, that’s your answer right there. It’s fake.
• Did you get an SMS? A real payment hits your bank account and your phone gets a text immediately. No SMS means no payment. It really is that simple. Don’t let anyone convince you otherwise.
• Check your own account, not their screen. This is the only thing that actually matters. Whatever someone’s phone is showing is irrelevant. Has the money landed in your account? If yes, great. If no, nothing else they show you counts.
• Watch out for “Pending” being passed off as “Done.” Some scammers show a transaction that’s still pending and tell you the money is on its way. It’s not. A pending payment is an incomplete payment. Hold on to whatever they’re asking for until the status actually says successful and the amount is sitting in your account.

Verify your screenshot: Fake Payment Screenshot Checker Tool

What to Do If a UPI Transaction Fails but Money Is Debited

This is genuinely one of the most frustrating things that can happen with UPI and honestly, it’s more common than people realise. A lot of times it’s just a server hiccup or a bad network moment.

Step 1: First, just wait. Give it about 30 minutes before you do anything. A lot of these transactions sort themselves out automatically once the banking servers catch up. No need to spiral right away.

Step 2: Then check your bank statement. If the money did get deducted, write down the UTR or UPI Reference Number. You’ll need it going forward.

Step 3: Raise a complaint in your UPI app. Go to the specific transaction in your history and use the “Report a problem” or “Help” option. This creates a formal dispute ticket that your bank and NPCI can track.

Step 4: If nothing moves in 48 hours, call your bank. Have your transaction details ready and explain what happened. According to RBI rules, any money deducted in a failed transaction must be reversed within 5 working days.

Step 5: Still no resolution? Escalate. If your bank hasn’t sorted it out within 30 days, take it higher. You can approach the RBI Banking Ombudsman at rbi.org.in or file a grievance directly through NPCI’s portal.

Step 6: And if you think fraud was involved, report it immediately. Don’t wait. Go to cybercrime.gov.in or call 1930 right away. The Government’s Cyber Crime Coordination Centre works directly with banks and law enforcement to handle exactly these situations.

Understanding UPI Transaction Statuses

When you check a UPI transaction, you’ll see one of these statuses. Here’s what each one actually means:

Status	What It Means	What You Should Do
Successful	Money has been debited from the sender and credited to the receiver	No action needed. Save the reference number for your records
Pending	The transaction is still being processed by the banking system	Wait 30-60 minutes. If still pending after 24 hours, raise a complaint with your bank
Failed	The transaction did not go through	Check if money was debited from your account. If yes, it should auto-reverse within 5 working days. If not reversed, contact your bank
Deemed	The transaction status is uncertain due to a technical issue between banks	Contact your bank with the reference number. NPCI tracks deemed transactions for resolution

RBI’s New Proposals to Curb UPI Fraud (April 2026 Update)

Something worth paying attention to – the Reserve Bank of India released a discussion paper on April 9, 2026, titled “Exploring Safeguards in Digital Payments to Curb Frauds.” And some of the ideas being proposed could actually change how UPI works for everyday users.

One of the key proposals is a “cooling-off period.” In simple terms, if you’re transferring above a certain amount, there could be a short delay built in. The logic is straightforward scammers usually rely on panic and urgency. They pressure you to act quickly so you don’t get time to think. A small delay could help break that pattern before any real damage is done.

The paper also introduces something called a “Kill Switch.” This would allow you to instantly disable all digital payments from your account with a single tap. If you ever sense something suspicious, you wouldn’t need to call your bank or wait on hold just hit the switch, and everything stops immediately.

These are still just proposals. Public feedback is open until May 8, 2026, so nothing has been finalised yet. But the fact that RBI is actively working on such measures says a lot UPI fraud is clearly being taken seriously at the highest level. And while regulators do their part, it’s equally important that we stay alert on ours.

Also Read: How to Report a Cyber Crime in India: Complete Step-by-Step Guide (2026)

Quick Checklist: Verifying a UPI Payment Before Releasing Goods

If you’re a shopkeeper, freelancer, seller, or anyone who receives UPI payments from strangers, use this checklist every time:

1. Check your own bank account or UPI app for the incoming payment never rely on the buyer’s screen.
2. Wait for the bank SMS confirming the credit before handing over goods.
3. Match the amount scammers sometimes send ₹1 and show a doctored screenshot for ₹1,000.
4. Verify the UPI Reference Number if anything feels off cross-check it in your transaction history.
5. Don’t accept “pending” as payment a pending transaction is not money in your account.
6. Use ScamDekho’s Fake Payment Screenshot Checker to quickly analyse suspicious screenshots.

Final Thoughts

Verifying a UPI transaction ID isn’t complicated — but it’s a habit that can save you from losing real money to a fake screenshot. Whether you’re a street vendor, an online seller, or just someone who splits bills with friends, taking 10 seconds to check your own bank account before trusting someone else’s phone screen is the simplest fraud prevention step you can take.

The tools exist. Your UPI app shows transaction history. Your bank sends SMS alerts. NPCI has a helpline. Use them.

And if you suspect a payment screenshot is fake, run it through our Scamdekho’s free upi payment screenshot checker it’s free and takes seconds.

Frequently Asked Questions

Let us tell you something that bothers us. In the last year alone, we have personally reviewed over 4,000 scam complaints that came through ScamDekho. And a surprising number of them came from people you would never expect to fall for a scam. Software engineers. Chartered accountants. Business owners who handle crores in transactions. A retired IAS officer.

These are not careless people. They are busy, distracted, trusting, or simply unfamiliar with one specific trick that a scammer used on them at exactly the right moment. That is how modern scams work. They do not target the foolish. They target the moment you let your guard down.

This article covers ten online scams that are actively running in India right now, in 2026. Each one has fooled otherwise intelligent, careful people. We are going to explain exactly how each scam works, show you the red flags, and tell you what to do if you are targeted.

1. The Fake Customer Care Number Scam

This is probably the most underrated scam in India right now, and it catches smart people more than any other.

Here is what happens. You have a problem with Swiggy, or your bank, or your broadband connection. You open Google and type something like “Swiggy customer care number” or “HDFC credit card helpline.” You see a number at the top of the results. You call it. The person who answers sounds professional. They ask for your account details to “verify your identity.” Then they ask you to share a screen, download an app, or read out an OTP. Within minutes, money is gone.

The number you called was not Swiggy or HDFC. It was a scammer who paid to have their number show up on Google, sometimes through Google Ads, sometimes through fake websites that rank well because nobody is actively taking them down.

We have seen this happen to people who work in tech. The problem is not intelligence. The problem is that when you are frustrated and searching for quick help, you do not stop to verify whether a phone number on Google is actually real.

How to protect yourself: Never call a customer care number from a Google search. Go to the company’s official website or app and find the contact information there. If you receive a suspicious link during a customer care call, check it on our free website checker at scamdekho.in/url-checker before clicking anything.

2. The UPI Collect Request Scam

You list something for sale on OLX, Quikr, or Facebook Marketplace. A buyer contacts you within hours. They sound genuine. They agree to your price without bargaining. They say they will send the money now.

Then instead of sending money, they send a UPI collect request. Your phone shows a payment notification. If you are not paying close attention, it looks like money is coming in. You approve it. And your money goes out.

Some scammers make this more convincing by first sending you a small amount, say one or two rupees, so you trust them. Then they send a collect request for a large amount disguised as a payment.

This scam catches smart people because the UPI interface on some apps does not clearly differentiate between “someone is sending you money” and “someone is requesting money from you.” The victim is expecting a payment, sees a notification, and approves without reading carefully.

How to protect yourself: Remember that you never need to approve anything to receive money via UPI. If someone asks you to approve a request or enter your PIN to receive payment, it is a scam. Before transacting, you can verify the buyer’s UPI ID on our free UPI ID checker at scamdekho.in/upi-qr-checker.

3. The Telegram Task Scam (Part-Time Job Fraud)

This one has exploded in the last two years and the losses are staggering. We have personally spoken to people who lost ten lakh, twenty lakh, even fifty lakh rupees to this single scam type.

It starts with a WhatsApp or Telegram message offering you a simple part-time job. Like videos on YouTube. Rate products on Amazon. Write reviews. The pay is 500 to 5,000 rupees per task. You start doing tasks and they actually pay you. Small amounts. 300 here, 800 there.

Then comes the “prepaid task.” To unlock a higher-paying task, you need to deposit some money first. Maybe 1,000 rupees. You deposit it, complete the task, and they pay you 1,500 back. It works. So when the next task requires a 5,000 rupee deposit, you do it. Then 15,000. Then 50,000.

At some point, the withdrawal gets “stuck.” They say there is a tax issue, or a system error, or you need to complete one more deposit to release all your earnings. By the time you realize it is a scam, you have deposited lakhs.

This catches smart people because the initial payments are real. Your brain sees a pattern of legitimate returns and trusts it. That is exactly what the scammers are counting on.

How to protect yourself: No legitimate company requires you to deposit your own money to earn money. If you receive a message offering easy part-time work, run it through our free message scam checker at scamdekho.in/scam-message-checker before responding.

4. The Fake Payment Screenshot Scam

You are selling something. The buyer shows you a payment screenshot proving they have made the transfer. You see the green tick, the transaction ID, the amount. It looks perfect. So you hand over the product or release the service.

But the money never arrives in your account. The screenshot was fake. Made in two minutes using a free app or a photo editor.

This catches sellers, delivery partners, and even small shopkeepers who are busy and check the screenshot instead of checking their actual bank account. The fake screenshots have become incredibly realistic. Some even include the correct bank logos, fonts, and timestamp formats.

How to protect yourself: Never confirm a payment by looking at a screenshot. Always check your own bank account or UPI app for the actual credit. If you want to verify a screenshot someone sent you, upload it to our free fake payment screenshot checker at scamdekho.in/fake-payment-screenshot-checker. It detects edited images, fake UTR numbers, and manipulated amount fields.

Also Read: IPL 2026 Betting App Scam – How Fake Apps Are Stealing Crores

5. The KYC Expiry / Account Block Scam

You receive an SMS or WhatsApp message saying your bank account will be blocked in 24 hours because your KYC is incomplete. There is a link. You click it. It opens a page that looks exactly like your bank’s website. You enter your login details. Done. The scammer now has your credentials.

Some versions of this scam ask you to download an APK file for “KYC verification.” That file is a screen-sharing or keylogging app that gives the scammer complete access to your phone.

This catches smart people because the urgency feels real. When your brain reads “your account will be blocked in 24 hours,” it triggers a fear response that overrides logical thinking. That is exactly what the scammer designed it to do.

How to protect yourself: No bank sends KYC reminders via WhatsApp or SMS with clickable links. If you get such a message, ignore it. If you are worried, open your banking app directly or visit your bank branch. You can also verify the link by pasting it into our free URL checker at scamdekho.in/url-checker. We will tell you if it is a phishing page.

6. The QR Code Scam at Shops and Markets

This one is beautifully simple and almost impossible to detect without being told about it.

A scammer visits a small shop, tea stall, or street vendor. They wait for a quiet moment and stick their own QR code label over the merchant’s existing QR code. Every customer who scans that QR code to pay the merchant is now paying the scammer instead. The merchant does not realize the problem until they check their account and see missing payments.

A variation of this targets individuals. Someone sends you a QR code and tells you to scan it to receive money. You scan it, and it initiates a payment from your account. Remember: scanning a QR code is always a payment action, never a receiving action.

How to protect yourself: If you are a merchant, regularly check that your QR code has not been covered with a sticker. If someone sends you a QR code and asks you to scan it to receive money, it is a scam. You can upload any QR code to our free QR code checker at scamdekho.in/upi-qr-checker to see exactly what UPI ID and amount is embedded inside before scanning.

7. The Investment and Stock Market Scam

Somebody adds you to a WhatsApp or Telegram group. The group has hundreds of members. An “expert” posts stock tips daily. Other members post screenshots of their profits. Everything looks active and genuine.

Eventually, you are told about a “premium” trading platform with guaranteed 30 to 40 percent monthly returns. You sign up. You deposit money. The dashboard shows your investment growing. You even withdraw a small amount to test it and the money arrives.

Then you invest a large sum. The dashboard still shows growing returns. But when you try to withdraw, there are delays. Then fees. Then taxes. Then the app stops responding. The website goes offline. The Telegram group is deleted.

Every single member in that group except you was either a bot or part of the scam operation. The profit screenshots were fabricated. The trading platform was never connected to any real stock exchange.

This catches smart people, including people who actually understand markets, because the initial returns are real and the social proof from the group feels convincing.

How to protect yourself: No legitimate investment can guarantee fixed returns. Check if the platform is registered with SEBI. If someone adds you to a group promoting an investment opportunity, verify the website on our URL checker before depositing any money. And remember, if the returns sound too good, they are.

Check: Cyber Insurance in India: Will It Pay You Back After a UPI Scam?

8. The Fake Job Offer Letter Scam

You applied for a job weeks ago. You get an email with a formal offer letter from what appears to be a real company. The letter has the company logo, HR contact details, salary breakdown, and a joining date. But before joining, you need to pay a “security deposit” or “training fee” or “laptop advance.”

In 2026, these fake offer letters have become so polished that even HR professionals have trouble spotting them at first glance. Scammers are using real company names, real employee names pulled from LinkedIn, and realistic CTC tables.

Fresh graduates are the primary target, but we have seen experienced professionals with ten plus years of experience fall for these, especially when they are between jobs and emotionally vulnerable.

How to protect yourself: No legitimate employer asks for money before your joining date. If you receive an offer letter that requires any payment, it is a fraud. Upload the letter to our free job offer letter checker at scamdekho.in/fake-offer-letter-checker. We verify the sender, check the company details, and flag common red flags in fake offer letters.

9. The Loan Approval Scam

You need money. You search for a personal loan online. You find an app or website that promises instant approval, no documents, low interest. You apply. You get “approved” within minutes.

Then the process starts. They need a processing fee of 2,000 rupees. You pay. Then GST charges. Then stamp duty. Then insurance for the loan. Each time, they promise the loan will be disbursed after this one last payment. It never is.

Some of these fake loan apps actually disburse a small loan first, say 5,000 rupees, but then harass you for repayment of 15,000 or more. They access your phone contacts and send threatening messages to your friends and family, sometimes with morphed photos.

This catches smart people because the apps look professional, the interest rates seem competitive, and the “approval” creates a sense of commitment. Once you have paid one fee, sunk cost fallacy kicks in and you keep paying more.

How to protect yourself: Check if the lending app is RBI-registered. Legitimate lenders never ask for upfront fees before disbursement. If you receive a loan offer via SMS or WhatsApp, run the message through our free message scam checker at scamdekho.in/scam-message-checker and verify any website links on our URL checker at scamdekho.in/url-checker.

10. The Parcel or Courier Scam (FedEx / Customs Fraud)

You receive a call from someone claiming to be from FedEx, DHL, or India Post. They tell you that a parcel in your name has been intercepted by customs because it contains illegal items, maybe drugs, fake passports, or undeclared cash. They transfer you to a “customs officer” or “cyber crime officer.” This person tells you that an FIR has been filed in your name and you need to pay a fine or deposit money in a “verification account” to avoid arrest.

Some versions involve a Skype or WhatsApp video call where the scammer is wearing a police uniform and sitting in front of a government-looking background. They show you a fake FIR with your name on it.

This scam has taken crores from educated professionals across India. It works because the fear of legal trouble, especially involving drugs or forged documents, creates panic. When you are panicking, you do not think clearly. That is the entire design.

How to protect yourself: No law enforcement agency in India calls you on the phone to collect fines. No customs officer will ask you to transfer money to avoid arrest. If you receive such a call, hang up immediately. If you are worried, call your local police station directly using the number from their official website, not a number the caller gives you.

What All Ten Scams Have in Common

If you read through all ten carefully, you will notice a pattern. Every single one of these scams relies on the same three psychological triggers.

• The first is urgency. Your account will be blocked. Your parcel will be seized. The offer expires today. Scammers create artificial time pressure because they know that the longer you think, the more likely you are to spot the fraud.
• The second is trust. A professional-sounding caller. A polished website. A legitimate-looking screenshot. An official-seeming letter. Scammers invest heavily in appearing credible because trust is what makes you lower your defenses.
• The third is isolation. Scammers want you to act alone. They tell you not to discuss the matter with anyone, sometimes claiming it is “confidential” or “under investigation.” The moment you talk to a friend, family member, or colleague, the spell usually breaks.
• The antidote to all three is simple. Slow down. Verify independently. And talk to someone you trust before making any payment or sharing any information.

What to Do If You Have Been Scammed

If you have already fallen for any of these scams, here is your action plan.

• Call 1930 immediately. This is the National Cybercrime Helpline. The faster you call, the higher the chance they can freeze the scammer’s account before the money is moved.
• File an online complaint at cybercrime.gov.in. Upload all the evidence you have, including screenshots, transaction IDs, phone numbers, and any messages or emails from the scammer.
• Contact your bank. Ask them to flag the fraudulent transaction and freeze the recipient account. Banks are more responsive to this when you file within the first few hours.
• Save everything. Do not delete any chats, call logs, emails, screenshots, or app data related to the scam. This is your evidence and you will need it for the police complaint and any recovery process.
• Do not blame yourself. These scams are designed by professional criminals who do this full time. Being deceived does not make you stupid. Getting help quickly is what matters now.

How ScamDekho Helps You Stay Protected

ScamDekho is built to give you the tools to verify anything suspicious before you lose money. All our tools are free, require no login, and give results in seconds.

• If you receive a suspicious message on WhatsApp, SMS, or email, check it on our Message Scam Checker.
• If someone shares a website link or asks you to visit a URL, verify it on our Website and URL Checker.
• If a buyer or seller sends you a payment proof, upload it to our Fake Payment Screenshot Checker.
• If you are asked to pay a UPI ID or scan a QR code, verify it on our UPI ID and QR Code Checker.
• If you receive a job offer letter that asks for money, upload it to our Job Offer Letter Checker.

None of these checks take more than ten seconds. And ten seconds is often the difference between keeping your money and losing it.

Frequently Asked Questions

I have spent the better part of three years reading cybercrime complaints and talking to victims of online fraud in India. And there is one question that comes up more often than almost anything else, especially after someone has already lost money:

“Is there some kind of insurance for this?”

The answer is yes. Cyber insurance exists in India. Multiple insurance companies sell it. Some policies cost less than a thousand rupees a year. And yet, almost nobody buys it. The ones who do often discover at claim time that what they assumed was covered is not.

This article is going to be honest with you about what cyber insurance in India can and cannot do. I am not going to sell you a policy. I am going to tell you what I have seen, what the fine print actually says, and whether it makes sense for someone like you.

What Is Cyber Insurance? In Simple Terms

Cyber insurance is a policy that pays you money if you suffer a financial loss because of a cyber event. That sounds broad, and it is intentionally so, because different insurers define “cyber event” differently.

At its core, the idea is simple. If someone hacks your email and transfers money out of your account, or if you fall for a phishing attack and lose funds, the insurance company reimburses part or all of the loss. Some policies also cover identity theft, social media hacking, cyber extortion, and even legal costs if you need to go to court.

In countries like the US and UK, cyber insurance has been around for over a decade, mostly sold to businesses. In India, it is still relatively new for individuals, and most people have never heard of it.

Which Companies Offer Cyber Insurance for Individuals in India

As of 2026, these are the main insurers offering standalone cyber insurance policies for individual buyers:

• HDFC Ergo offers a policy called Cyber Sachet. It is one of the most widely discussed individual cyber insurance policies in India and covers a broad range of cyber events including identity theft, phishing, and financial fraud.
• Bajaj Allianz has an individual cyber insurance plan that covers unauthorized digital transactions, email spoofing, cyber extortion, and media liability related to online activities.
• ICICI Lombard offers cyber risk insurance for individuals that includes financial loss from phishing, vishing, and SIM swap fraud, along with identity theft expenses.
• SBI General has entered the market with a cyber insurance product aimed at individual digital banking users, covering online banking fraud and UPI-related incidents.
• IFFCO Tokio offers cyber insurance with coverage for social media identity theft and cyber stalking, in addition to standard fraud coverage.

Some of these policies start at around ₹500 to ₹700 per year for basic coverage of one to two lakh rupees. Higher coverage of five to ten lakh rupees costs more, typically between ₹2,000 and ₹5,000 per year depending on the insurer and plan.

What Does Cyber Insurance Actually Cover

This varies from policy to policy, but most individual cyber insurance plans in India cover the following:

• Unauthorized digital transactions: If someone gains access to your bank account, credit card, or UPI and makes transactions without your consent, the insurer covers the financial loss.
• Phishing and vishing: If you receive a fake email, SMS, or call that tricks you into sharing your banking credentials, and money is then stolen, this is typically covered.
• Identity theft: If someone uses your personal data to open accounts, take loans, or commit crimes in your name, the policy may cover expenses related to restoring your identity and any legal fees.
• Cyber extortion: If someone threatens to release your personal data or photos unless you pay, some policies cover the extortion amount and related counseling expenses.
• Social media hacking: If your social media account is hacked and used to damage your reputation, or if someone creates fake profiles in your name, some policies offer coverage for related expenses.
• Malware and ransomware damage: If malware damages your devices or encrypts your data, certain policies cover the cost of data recovery or device replacement.
• Legal costs: If you need to hire a lawyer because of a cyber incident, some policies reimburse legal fees up to a specified limit.

What Cyber Insurance Does NOT Cover and This Is Where Most People Get Disappointed

Here is the part that matters most, and the part that most people do not read before buying:

• Losses where you voluntarily shared your OTP or password: This is the biggest exclusion and the one that catches the most victims. If a scammer called you, pretended to be from your bank, and convinced you to read out your OTP, most insurers will argue you voluntarily shared the credential. Your claim may be denied. This is exactly how most UPI fraud works in India, which means the most common type of scam affecting Indians right now may not be covered.
• Losses from investing in fraudulent platforms: If you put money into a fake trading app, a Telegram task scam, or an IPL betting app, that is not a hack. You transferred the money yourself. Most policies do not cover this.
• Losses from cryptocurrency transactions: Most Indian insurers explicitly exclude crypto-related fraud from individual cyber insurance policies.
• Pre-existing incidents: If the fraud happened before the policy start date, it is not covered, even if you discover it later.
• Losses exceeding the coverage limit: If your policy covers two lakh rupees and you lose five lakh, you only get two lakh.
• Business losses: Individual policies do not cover losses related to your business, freelancing income, or professional activities. For that, you need a commercial cyber insurance policy.
• Waiting period: Some policies have a waiting period of 15 to 30 days after purchase, during which claims are not accepted.

I want to be direct about this. The majority of online fraud cases I have seen at ScamDekho would fall into one of these exclusion categories. It does not mean cyber insurance is useless. It means you need to know exactly what scenario your policy covers before you assume you are protected.

Is Cyber Insurance Worth It for You

This depends on who you are and what risks you face.

• It probably makes sense if you regularly shop online with multiple cards, use several banking apps, and your exposure to digital fraud is high. For someone handling lakhs of rupees through UPI every month, a policy that costs 1,500 rupees a year for five lakh coverage is not a bad tradeoff, assuming the policy covers the specific risks you face.
• It also makes sense if you are a senior citizen or someone who is not very comfortable with digital transactions but is forced to use them. The risk of unknowingly clicking a phishing link or falling for a fake app is higher for this group.
• It may not be necessary if you use only one bank account, rarely transact online, and already follow basic digital safety practices. The premium might be low, but the probability of an eligible claim is also very low.

And it is definitely not a substitute for being careful. No insurance company is going to reimburse you if you ignored every red flag and sent money to a stranger on WhatsApp. Insurance works as a safety net for situations where you did everything right and still got hit.

How to File a Cyber Insurance Claim

If something does happen and you believe it is covered by your policy, here is the general process:

• File a complaint with the police and cybercrime cell immediately. Call 1930 and register your complaint at cybercrime.gov.in. Get the complaint number.
• Inform your bank and request them to flag the transaction and freeze the recipient account if possible.
• Notify your insurance company within the time window specified in your policy. Most insurers require notification within 24 to 72 hours of the incident. Late reporting is one of the most common reasons for claim rejection.
• Gather all evidence. Transaction screenshots, bank statements showing the fraud, cybercrime complaint receipt, FIR if filed, communication records with the scammer, and any other relevant proof.
• Fill out the claim form provided by the insurer. Attach all supporting documents.
• Wait for the investigation. The insurer will verify the incident, check whether it falls within coverage, and may ask for additional documents. The process usually takes 15 to 45 days.

One important thing. If the police or bank manage to recover the stolen money, the insurer will deduct that amount from your claim payout. You are not going to get double compensation.

What I Actually Recommend to People Who Ask

When someone who has just been scammed asks me whether they should buy cyber insurance, I tell them two things.

First, file your complaint right now. Insurance is not going to help you with an incident that already happened. Focus on recovery through the cybercrime helpline.

Second, before you buy a policy, read the exclusions page. Not the brochure. Not the advertisement. The exclusions. If you understand exactly what is not covered and you are comfortable with that, buy the policy. If you read the exclusions and realize that the exact scenario you are worried about is not covered, then the policy is not for you.

Prevention is cheaper and more reliable than insurance. Checking a suspicious link before clicking it takes ten seconds. Verifying a payment screenshot before handing over goods takes thirty seconds. These small habits prevent the kinds of losses that insurance often refuses to cover anyway.

The goal is not to become paranoid. The goal is to build a few simple habits that make you a harder target. Insurance is a backup for the rare case where those habits are not enough.

Frequently Asked Questions

Every IPL season, millions of Indians glued to their screens become easy targets for a very specific kind of fraud. It does not come through a stranger at the door. It comes through your own WhatsApp. It looks like a tip from a friend. It starts with a winning prediction. And by the time most people realize what happened, their money is already gone.

This is not a new scam. But in 2026, it has grown more sophisticated, more widespread, and more convincing than ever. Cybercrime police in India have recorded over 1,400 complaints since this IPL season began, with individual losses ranging from ten thousand rupees to several lakhs.

This article explains how these fake IPL betting apps work, how to recognize them before you fall for them, and what steps to take immediately if you or someone you know has already lost money.

What Actually Happens When You Join One of These Groups

Most people who lose money to this scam did not look for it. The scam found them.

Someone adds you to a WhatsApp group. The group is called something like IPL Match Experts or Cricket VIP 2026. There are dozens, sometimes hundreds of members. The admin is an analyst who says he has contacts inside IPL franchises and claims to know the outcome of matches before they are played.

He gives one free prediction. It comes true. He gives another. That one comes true too. By the third correct prediction, people in the group are convinced. Comments start rolling in. Members share screenshots of their winnings. The energy in the group feels real.

But here is what is actually happening behind the scenes. The scammer is running multiple groups at the same time. Each group is given a different prediction for the same match. Whichever group receives the correct prediction becomes the primary target. The members of that group have been pre-selected by chance, not by expertise. The analyst is not a genius. He is playing probability with your trust.

Once the trust is established, he introduces the app.

How the App Itself Is Used to Steal From You

The app is never on Google Play Store. It is always shared as a downloadable file, called an APK, directly through WhatsApp or through a link that takes you to an unofficial website. This alone should stop anyone from proceeding, but most people do not know what an APK is or why it matters.

You download it, create an account, and deposit a small amount to try. Maybe five hundred rupees. Maybe a thousand. The app shows you winning almost immediately. Your balance grows. The interface looks clean and professional. There are live score updates, transaction histories, and a withdrawal button that works without any friction the first time.

If you try to withdraw a small amount early on, some scammers actually let it go through. This is deliberate. It builds more confidence. You deposit a larger amount next time.

Then one day, after you have put in a significant sum, the withdrawal stops working. The app gives you an error message, or it says your account is flagged or pending verification. A support agent contacts you, usually through WhatsApp, and explains that you need to pay a tax fee, a GST charge, or a security deposit before your funds can be released.

People pay it. And then there is another fee. And another. Every time you threaten to stop, the agent says your money is right there, just one more payment and it will be released. This second layer of extraction is often where victims lose far more than their original deposit.

When you finally refuse to pay, the app goes offline. The WhatsApp support disappears. The group admin vanishes. You are left with transaction records you made to a number that no longer exists.

Who Is Most at Risk

The pattern in cybercrime reports shows that these scams do not only target people who are financially naive. Victims include software engineers, teachers, small business owners, and government employees. People in their thirties and forties make up the majority of reported cases.

The common thread is not lack of education. It is a combination of excitement about cricket, social validation from the group, and the very human tendency to believe good things when they seem to be happening.

Young men who follow IPL closely are the most targeted demographic. But cybercrime cells also report a growing number of women and senior citizens being targeted through different entry points, such as investment groups that slowly pivot toward IPL predictions once trust is established.

Why These Fake Apps Are So Convincing

The apps themselves are often built by professional developers hired through dark web forums or shell companies. They are not rough or poorly designed. They have real-looking dashboards, fake transaction histories, and even customer support scripts.

Some of the more advanced operations use actual UPI payment infrastructure for initial deposits, which means the first few transactions appear legitimate in your bank statement. This is why many victims do not realize they have been scammed until withdrawals are blocked.

The apps also use fake social proof aggressively, including screenshots from other winners, leaderboards showing high earners, and push notifications congratulating you on winnings you never actually received.

A cybersecurity researcher at ScamDekho who analyzed three such apps in April 2026 found that all of them used the same payment gateway backend and had domain names registered in the same week, indicating a single organized network behind multiple app brands.

Pig Butchering Scam in India: How Fake Trading Apps Stole ₹14,000 Crore

How to Identify a Fake IPL Betting App

There are specific markers that separate fake apps from legitimate platforms. Knowing these before you act is the most effective protection.

• The app is not listed on Google Play Store or Apple App Store. This is the single most important indicator. Every legitimate fantasy or gaming platform in India maintains a verified listing on official app stores. If someone is asking you to download through a link or APK file, the conversation should end right there.
• It promises guaranteed match outcomes. Cricket is a live sport played by real athletes under real conditions. No person or software tool can guarantee a result. Any claim of 90 percent accuracy, insider information, or fixed predictions is either a lie or an advertisement for criminal activity.
• Withdrawal requires you to pay first. In any legitimate financial platform, you withdraw what you have earned. You do not pay fees, taxes, or deposits to access money that is already yours. The moment an app asks you to pay to get your money out, you are being robbed.
• The only payment method is UPI to a personal number. Regulated fintech companies in India have verified business accounts and official payment systems. Scammers avoid these because business bank accounts can be traced and frozen quickly. If payments go to a personal UPI number, that platform is not a legitimate business.
• There is no verifiable company behind it. No registered company name, no GSTIN, no physical office, no contact information beyond a WhatsApp number. Searching the company name on the Ministry of Corporate Affairs portal returns nothing.

The Only Safe Platforms for IPL Fantasy Cricket

If you enjoy IPL and want to participate in fantasy cricket, there are legitimate options that operate within Indian law and are subject to regulatory oversight.

Dream11 is the largest fantasy sports platform in India and is available on both Android and iOS through official stores. My11Circle operates similarly and has a substantial user base. MPL, or Mobile Premier League, offers fantasy cricket along with other gaming options. Ballebaazi is another licensed platform with a smaller but established audience.

All of these are companies registered in India, file taxes, and operate under licenses where applicable. None of them will ever ask you to download an APK from a WhatsApp message.

It is also important to note that fantasy sports platforms are legal in India because the Supreme Court and multiple High Courts have classified them as games of skill. What is illegal is fixed-odds betting on match outcomes, which is what fake apps claim to offer. There is no legal platform in India that sells match predictions for money.

What to Do Immediately If You Have Already Been Scammed

If you have already transferred money into one of these apps, the actions you take in the next few hours matter significantly.

• Call 1930 right away. This is India’s National Cyber Crime Helpline. When you call early enough, they can initiate a freeze on the recipient account before the scammer withdraws the funds. The window for this is short, sometimes just a few hours, so do not wait.
• File a complaint at cybercrime.gov.in. Select Online Financial Fraud in the complaint form. You will need the UPI transaction IDs, the phone numbers involved, screenshots of the app and any conversations, and details of the amounts paid. Keep all of this ready before you start.
• Tell your bank immediately. Ask them to raise a formal cyber fraud dispute at the branch level. Give them your cybercrime complaint number as a reference. Ask whether the recipient UPI ID can be flagged within their system.
• Do not delete anything. WhatsApp chats, the APK file if you still have it, browser history, any email correspondence, and all payment screenshots are evidence. A lawyer or cybercrime officer will need these if the case goes further.
• Go to your nearest police station and file an FIR. Refer to Section 420 of the IPC for cheating and Sections 66C and 66D of the IT Act for identity fraud and personation using digital means. The cybercrime complaint number you received online will support this.

The Ministry of Home Affairs has confirmed that through the national fraud reporting system, over 1,200 crore rupees have been recovered for fraud victims since the platform launched. Recovery is genuinely possible when you act fast.

How to Recover Money Lost in Online Scam in India (Step-by-Step Guide 2026)

A Note for People Who Have Not Been Scammed Yet

The people most vulnerable to this scam are not the ones who have heard about it. They are the ones who assume it cannot happen to them.

If someone adds you to a WhatsApp group with IPL tips, leave it. If someone in a group recommends downloading an app that is not on the Play Store, leave the group and report the admin on WhatsApp. If an app promises you a guaranteed win, close it.

Share this article with one person in your family or among your friends. Not because they are gullible, but because these operations are designed by people who do this full time and have studied exactly what makes someone trust quickly and question slowly.

Checking any website or app link through ScamDekho’s URL Checker before you deposit anything is a free, ten-second step that could save you from losing money you cannot get back.

Frequently Asked Questions

Every day, millions of Indians receive links on WhatsApp, SMS, email, and social media. Some links are genuine. But many are designed to steal your money, passwords, or personal information.

So before you click any link, you need to ask one question: is this URL safe?

In this guide, we will show you 5 simple and free ways to check if any URL is safe or dangerous — even if you are not a tech expert. All methods work on mobile and desktop, and take less than a minute.

Quick answer: Paste any suspicious link into ScamDekho’s free URL checker to get an instant safety verdict with a trust score. No login, no download — results in 10 seconds.

Why Checking URL Safety Matters More Than Ever

India reported over 12 lakh cyber fraud cases in 2025, and the number is growing every year. Most of these frauds start with a single click on a dangerous link.

Here is what can happen if you click an unsafe URL:

• Phishing: A fake website steals your bank login, UPI PIN, or credit card details
• Malware: The link downloads a virus or spyware onto your phone or laptop
• Data theft: Your personal information (Aadhaar, PAN, contacts) gets stolen
• Money loss: Scammers can drain your bank account in minutes

The scary part? Most dangerous URLs look completely normal. A link like sbi-kyc-update.net looks real, but it is a scam. That is why you need to check URL safety before clicking — every single time.

5 Free Ways to Check if a URL is Safe

Method 1: Use ScamDekho URL Safety Checker (Fastest & Easiest)

The simplest way to check any URL is to use a dedicated URL safety checker like ScamDekho.

How to use it:

1. Copy the suspicious link (do NOT click it — long press and copy)
2. Go to scamdekho.in
3. Select Url Checker
4. Paste the link and click “Check if Safe or Scam”
5. Get your result in 10 seconds — SAFE, SUSPICIOUS, or SCAM

What it checks automatically:

• SSL certificate validity
• Domain registration age
• Phishing database matches
• Malware and virus signals
• Server location and IP reputation
• AI-powered content analysis

You also get a trust score out of 100 and specific reasons explaining why the link is safe or dangerous. No login needed. Completely free.

Pro tip: This is the only method that checks all 12+ signals at once. All other methods below check only 1-2 signals each.

Method 2: Check the Domain Name Carefully

Before using any tool, look at the URL itself. Scammers create domain names that look almost identical to real websites.

Examples of fake vs real domains:

Fake Domain	Real Domain	Difference
sbi-kyc-update.net	onlinesbi.sbi	Completely different domain
amaz0n-india.com	amazon.in	Zero instead of “o”
flipkart-sale99.in	flipkart.com	Extra words added
hdfc-netbanking.org	hdfcbank.com	Wrong extension

Red flags in domain names:

• Extra words like “login”, “secure”, “update”, “verify”
• Hyphens that the real website does not use
• Unusual extensions like .xyz, .top, .buzz, .info
• Misspelled brand names

This method helps you catch obvious fakes, but clever scammers use domains that look very convincing. That is why an automated URL checker is more reliable.

Method 3: Look for HTTPS and the Padlock Icon

Check the browser address bar before entering any personal details on a website.

• HTTPS = The connection is encrypted (data travels safely)
• HTTP (no S) = The connection is NOT encrypted (anyone can see your data)

But here is the important thing: HTTPS alone does NOT mean the website is safe. Scammers can also get SSL certificates for their fake sites. In fact, over 80% of phishing websites now use HTTPS.

So HTTPS is a basic minimum — not a guarantee of safety. You still need to check domain age, blacklist status, and content using a proper safe URL checker.

Method 4: Check the Domain Age

This is a very powerful check. If a website was registered only a few days or weeks ago and it is asking for your bank details or OTP — it is almost certainly a scam.

How to check domain age:

• Use a WHOIS lookup tool (like whois.domaintools.com)
• Or simply use ScamDekho URL checker — it checks domain age automatically

What to look for:

• Domain registered less than 6 months ago = High risk
• Domain registered 6-12 months ago = Medium risk
• Domain registered more than 1 year ago = Lower risk

Real banks like SBI, HDFC, and ICICI have domains registered for 15-20 years. A “bank website” with a 2-week-old domain is 100% fake.

Method 5: Search the Website Name + “Scam”

This is a quick manual check. Open Google and search:

"website-name.com" scam

or

"website-name.com" fake

If other people have been scammed by this website, you will often find complaints on forums, Reddit, Twitter, or consumer complaint websites.

Limitations:

• New scam websites may not have complaints yet
• This method is slow and unreliable for brand new scams
• Works best as a secondary check alongside automated tools

URL Safety Checker vs Manual Checking — What is Better?

Feature	Manual Checking	ScamDekho URL Checker
Time needed	5-10 minutes	10 seconds
SSL check	Visual only	Deep analysis
Domain age	Need separate WHOIS	Built-in
Phishing database	Not possible	Auto scan
Malware detection	Not possible	Auto scan
AI content analysis	Not possible	Built-in
Trust score	No score	Score out of 100
Works on mobile	Difficult	Easy
Cost	Free	Free

Verdict: Manual checking catches obvious scams but misses sophisticated ones. A URL safety checker like ScamDekho runs 12+ checks in seconds and catches threats that human eyes cannot see.

For maximum safety, do both — glance at the domain name first, then run it through the URL checker.

Most Common Types of Dangerous URLs in India

Understanding what kinds of URLs are dangerous helps you stay alert:

1. Fake Bank KYC Links

• Example: “Your SBI account will be blocked. Update KYC now: sbi-kyc-update.net”
• Comes via SMS or WhatsApp
• Steals login credentials and OTP
• Related: KYC Scam in India — How Fraudsters Use Fake KYC Links

2. Fake Shopping Websites

• Example: “90% off on Nike shoes — limited time: nikesale-india.com”
• Takes payment but never delivers products
• Often promoted through Instagram and Facebook ads

3. Fake Government Scheme Portals

• Example: “Free gas cylinder under PM scheme — register at pmyojana-register.in”
• Collects Aadhaar, bank details, and personal information
• Shared heavily on WhatsApp groups

4. Fake E-Challan Links

• Example: “Pay your traffic challan now: echallan-payment.in”
• Redirects to a fake payment page

5. Shortened Links Hiding Scam Websites

• Example: bit.ly/xyz123 or tinyurl.com/abc456
• You cannot see the real destination
• Always check shortened links before clicking

What to Do if You Already Opened an Unsafe URL

If you already clicked a suspicious link, act fast:

Step 1: Do NOT enter any details Close the browser tab immediately. If you have not entered any information, you are likely safe.

Step 2: Clear your browser data Go to browser settings → Clear cache, cookies, and browsing history.

Step 3: If you entered bank details or OTP

• Call your bank immediately and block your account
• Change your internet banking and UPI PIN
• Most banks have a 24-hour window to reverse fraudulent transactions

Step 4: Report the scam

• Call the National Cybercrime Helpline: 1930
• File a complaint at cybercrime.gov.in
• Report the URL to ScamDekho so we can warn other users

Step 5: Check for malware If you downloaded anything from the link, run an antivirus scan on your device immediately. If you received a suspicious message along with the link, check it using our Message Scam Checker.

For a complete step-by-step recovery guide, read: How to Recover Money Lost in Online Scam in India

7 Red Flags That a URL is Not Safe

Here is a quick checklist you can use every time you receive a link:

1. Domain registered less than 6 months ago — New domains asking for money = scam
2. URL has misspelled brand names — amaz0n, flipkart-sale, sb1-bank
3. No HTTPS or SSL warning — Never enter details on HTTP sites
4. Link creates urgency — “Act NOW or your account will be blocked”
5. Asks for OTP, Aadhaar, or bank details — No legitimate site asks this via links
6. Sent by unknown number on WhatsApp or SMS — Do not trust, verify first
7. Too-good-to-be-true offers — “Win iPhone 16 FREE” or “₹10,000 cashback”

If a link shows even 2-3 of these red flags, do not click it. Run it through a URL safety checker first.

Stay Safe Online — Check Before You Click

The internet is full of useful information, but it is also full of traps. Every month, thousands of Indians lose money because they clicked a link without checking first.

The good news is that protecting yourself is easy. It takes just 10 seconds to check if a URL is safe before clicking. Make it a habit — just like locking your door before leaving the house.

Remember these 3 rules:

1. Never click links from unknown senders
2. Always check URLs before entering personal details
3. If it sounds too good to be true, it probably is

Stay alert. Stay safe. And when in doubt — check the URL first 

Real Case: Shriram Natarajan, a 44-year-old Mumbai resident, was browsing for a 2BHK flat on the NoBroker app when he found a listing in his own housing society at ₹47,000 per month. He contacted the “landlord,” paid an advance, and only later discovered the account the money went to was linked to a petrol pump in Bhopal. The real flat owner had no idea their listing was being used to run a scam. Shriram lost ₹2.8 lakh.

This case isn’t an exception. It’s the pattern.

If you’re currently house hunting in Delhi, Bangalore, Mumbai, Pune, or anywhere else in India, this blog could save you lakhs.

Why Rent Scams Have Gotten Much Worse Recently

Finding a flat in any Indian metro today is already stressful. Demand is high, good flats get taken fast, and brokers push you to “decide quickly or lose it.” Scammers have studied this pressure very closely. They know that when someone is desperate to find a flat near their office, or moving from another city, or relocating for a new job, they’re not thinking straight. That’s exactly when they strike.

The rental fraud problem in India has also gone digital in a much more sophisticated way. Scammers no longer just post obviously fake ads. They copy real listings from 99acres, NoBroker, and MagicBricks, replace the contact number with their own, and wait for calls. They use AI-generated face overlays on video calls. They send fake e-stamp certificates that look completely official. In late 2025, Bengaluru police registered an FIR where a victim was pulled into a private Telegram chat, guided step by step through a payment process, and lost ₹6.25 lakh. The “landlord” was never real.

Understanding exactly how these scams work is the first step to not becoming the next case.

The 6 Most Common Fake Rent Scams in India Right Now

1. The Fake Listing / Token Money Trap

This is the most common scam and it targets people who are searching on their own. No broker, just scrolling through apps late at night.

Here’s how it plays out: You find a beautifully photographed 2BHK at a rent that’s 25–30% below what similar flats in the area cost. You message the “owner.” They respond quickly, seem friendly, answer your questions confidently. They say the flat is getting a lot of interest and they need a small token amount, usually ₹5,000 to ₹20,000, to “block it for you” before others book it.

You pay. They disappear.

Sometimes the flat doesn’t exist at all. Other times, it’s a real flat that’s already occupied. The scammer just copied the listing, photos and all, from another platform and replaced the contact number.

Red flag: Any landlord or agent asking for money before you’ve physically visited the property is running a scam.

2. The Fake Visiting Pass Fee

This one is increasingly common in Bangalore and Hyderabad, where rental markets are extremely competitive.

The “landlord” tells you that the flat is part of a gated society that requires a “visiting pass” or “entry fee” to see the property. They ask you to pay ₹2,000–₹3,000 as a refundable deposit to arrange the visit. You pay, you never hear from them again.

No legitimate housing society in India charges a potential tenant a fee to visit a property. If someone tells you this, hang up.

3. The Fake Army Officer / Government Employee Landlord Scam (Landlords Beware Too)

This one doesn’t target tenants. It targets landlords. And it’s especially cruel because it exploits the trust and respect people naturally have for defence personnel.

A gang in Noida was recently found to be systematically running this scam on 99acres, MagicBricks, and OLX. Here’s how it works:

A person posing as an Army officer or senior government employee contacts a landlord whose flat is listed. They say they’re being transferred suddenly and need to move in next month with their family. They’re very polite, very professional. They say they’re willing to pay the full security deposit plus two or three months’ rent in advance, whatever the landlord wants.

The “tenant” then sends a QR code to the landlord saying “please scan this to receive the advance payment.” The moment the landlord scans and enters their UPI PIN, money is debited from the landlord’s account, not credited. The scammer disappears.

Elderly landlords are targeted most frequently because they are less familiar with how UPI and QR codes actually work.

Remember: Scanning a QR code and entering your PIN means you are sending money. You never scan a QR code to receive money.

4. The Illegal Sublet Scam

This one is very sneaky because the person you’re dealing with is actually living in the flat. They’re just not the owner.

The actual tenant of a property poses as the landlord, shows you the flat, and collects a security deposit or advance rent from you. Sometimes they do this to multiple people simultaneously, collecting deposits from 3 to 4 different people for the same flat.

When you arrive on move-in day and find someone else living there, or the real landlord shows up, there’s nothing you can do. The fake “landlord” has switched off their phone.

A real case from NoBroker: A man posed as a NoBroker agent, showed a flat to a prospective tenant, and collected ₹50,000 as a “pre-deposit.” He turned out to be the tenant illegally subletting the flat. The actual owner had no idea any of this was happening.

5. The Fake E-Stamp / Fake Rent Agreement Scam

This is the most sophisticated scam on this list, and it’s growing fast since the 2025 update to the Model Tenancy Act made digital rent agreements more common.

Here’s what happens: You’ve found a flat, you like it, you’ve met the “landlord” (or so you think). They say they’ll get the rent agreement registered digitally and ask you to pay stamp duty and registration charges upfront, usually ₹5,000 to ₹15,000. This sounds completely normal because digital stamp duty and e-registration are genuinely real things now.

A few days later, they send you a PDF agreement with an official-looking e-stamp number, a proper format, and both signatures. It looks 100% legitimate. But the e-stamp number is either fake or belongs to an entirely different transaction filed years ago. You’ve paid for nothing, and you have no legal protection.

Most people never check the e-stamp number on the government portal. Scammers know this.

How to verify: Every genuine e-stamp certificate issued in India can be verified on the Stock Holding Corporation of India (SHCIL) portal at shcilestamp.com or the respective state’s stamp verification portal. Always verify the certificate number before handing over any money.

6. The Catena Homes Model: Large-Scale Organised Fraud

In late 2025, Bangalore saw one of the largest organised rental scams in recent memory. A company called Catena Homes was arrested for defrauding over 400 tenants of more than ₹50 crore.

Their method was disturbingly professional: they rented high-end apartments from genuine landlords, then sub-leased the same flats to multiple tenants for lump-sum “lease” amounts ranging from ₹10 lakh to ₹29 lakh per person, promising 2–3 years of rent-free stay. They had a proper office, a proper website, professional staff, and legal-looking agreements.

This is now called the “lease company” scam. Be extremely cautious about any company asking for a large upfront lump sum in exchange for a multi-year rent-free period.

How to Verify Before You Pay: A Practical Checklist for Indian Tenants

This is the part most blogs skip. The actual “how to check.” Here’s what you can do in 2026 before paying a single rupee:

Step 1: Visit the Property in Person. Always.

This sounds obvious but it’s the single rule that prevents 90% of rental scams. No exceptions. Do not pay any token money, booking amount, or deposit until your feet have physically been inside the flat and you’ve met the landlord face to face.

If someone says they’re abroad, on transfer, or “too busy to meet,” that is a scam.

Step 2: Verify Property Ownership Online

Every state in India has an official land records portal where you can verify who actually owns a property. Here are the most commonly used ones:

State	Portal Name	What to Check
Karnataka	Kaveri Online / Bhoomi	Owner name, survey number
Maharashtra	IGR Maharashtra	Registration records, ownership
Delhi	DORIS (Delhi Online Registration)	Property registration status
UP	UP Bhulekh (upbhulekh.gov.in)	Khasra/Khatauni ownership
Telangana	Dharani Portal	Pattadar passbook, land details
Haryana	Jamabandi Portal	Record of Rights
Tamil Nadu	TNREGINET	EC, registration documents

Enter the owner’s name or survey number and confirm that the person showing you the flat is actually the registered owner. This takes 5 minutes and can save you lakhs.

Also ask to see a recent electricity bill, property tax receipt, or water bill in the landlord’s name. Scammers can fake IDs, but utility bills linked to the property are harder to fake.

Step 3: Verify Their Identity Through Multiple Means

Don’t accept just an Aadhaar card or ID on WhatsApp. Ask to see the original property documents. Ask to meet at the property, not at a cafe or via video call only. Talk to neighbours or the building society’s security guard to confirm the person you’re dealing with is actually the owner.

If someone claiming to be an Army officer is the landlord or tenant, you can request a verification through their unit’s official contact. Real officers won’t be offended by this. Scammers will immediately become defensive.

Step 4: Verify the Rent Agreement’s E-Stamp

If you’re given a digitally stamped rent agreement, take the e-stamp certificate number and verify it on:

• shcilestamp.com (for most states)
• Your state’s official stamp verification portal

The portal will tell you the date the stamp was issued, the amount, and what it was issued for. If the stamp was issued for a different transaction, you have a fake agreement.

Step 5: Never Pay Cash, Never Pay Before the Agreement Is Signed

All payments, whether token money, security deposit, or advance rent, should go through bank transfer or UPI with a clear transaction record. Never pay in cash for a rental transaction. And never pay before you have a signed, verified rent agreement in hand.

If the landlord insists on cash only, or wants payment before signing the agreement, walk away. These are not negotiating styles. They are fraud tactics.

Step 6: Know Your Legal Rights on Security Deposit

Under the Model Tenancy Act 2021, the maximum security deposit is:

• 2 months’ rent for residential properties

However, landlords in cities like Bangalore routinely demand 6–10 months. While not always strictly illegal under state law, a very high deposit significantly increases your risk if something goes wrong. Always negotiate, and always get the deposit terms, including the refund timeline, clearly written in the agreement.

The Exact Conversation Pattern Scammers Use (So You Can Spot It)

If you know what the script looks like, you’ll recognize it immediately. Rental scammers almost always follow the same pattern:

1. They respond immediately and seem very eager. Real landlords are busy. A “landlord” who responds within minutes at odd hours is likely a scammer monitoring multiple listings.
2. The price is attractive but not ridiculous. It’s not ₹5,000 for a ₹30,000 flat, that would be too obvious. It’s ₹25,000 instead of ₹32,000. Just attractive enough to make you want to act quickly.
3. They create urgency. “Three other people are coming to see it tomorrow.” “My current tenant is leaving this weekend, I need someone to book it today.” Urgency is their most important tool.
4. They ask for a small “token” first. Not the full deposit, just a “token to block the flat.” This lowers your psychological resistance because it feels like a small risk.
5. They go quiet after payment. Sometimes immediately, sometimes after a few more messages to keep you comfortable.
6. They explain they can’t meet right now. They’re “on transfer,” “out of station,” “at the army base,” or “abroad.” This explains why everything has to be done remotely.

If you see 3 or more of these in one conversation, stop and do not pay.

Also Read: Why Is Your Bank Account Frozen Without Warning & How to Get It Back

I’ve Already Paid. What Do I Do Right Now?

If you’ve just been scammed, speed matters enormously.

In the first hour: Call your bank immediately at their 24/7 helpline and report the transaction as fraud. Ask them to flag the transaction or attempt a recall. If the money hasn’t been withdrawn yet from the scammer’s end, there’s a small chance it can be stopped.

Within 24 hours:

• File a complaint on cybercrime.gov.in or call the Cyber Crime Helpline 1930
• File an FIR at your nearest police station. Bring: your bank statement, screenshots of all conversations with the “landlord,” their phone number, UPI ID, and any documents they shared
• Report the fake listing on the platform (99acres, NoBroker, OLX) so it gets taken down and others are protected

Know your rights: Under RBI guidelines, if a fraudulent transaction is reported within 3 working days, your liability may be zero. Banks are required by law to investigate. Many victims have successfully recovered funds, but only when they reported quickly. Do not wait.

Check: KYC Scam in India: Fake Bank Messages That Are Stealing Your Money

Quick Reference: Red Flags vs. Green Flags

Red Flag	Green Flag
Rent is 25–40% below market rate	Price matches area market rates
Landlord can’t meet in person	Meeting happens at the property
Asks for token money before visit	Visit first, payment only after agreement
Insists on cash payment only	Accepts traceable bank transfer/UPI
Sends QR code “to pay you”	Gives their UPI ID for you to send normally
No original property documents shown	Property documents and utility bills in their name
Creates extreme urgency	Patient and transparent
Agreement e-stamp can’t be verified	E-stamp verified on government portal
Only communicates via WhatsApp	Okay with meeting and official channels

Final Thought

The reason rental scams work is simple: people are under pressure when they’re house hunting. Deadlines, new jobs, kids’ school admissions, the urgency is real. Scammers use that urgency against you. They want you to act before you think.

The one habit that protects you from every single rental scam on this list is this: Never pay anyone money before you have physically visited the property, met the landlord in person, verified their ownership documents, and signed a verified rent agreement.

That’s it. One rule. It sounds simple because it is simple. But in the pressure of house hunting, it’s surprisingly easy to skip. Don’t.

Frequently Asked Questions

Real Case: Ankur Dutta, a 30-year-old from Hyderabad, was trying to sell his motorcycle on OLX. A buyer claiming to be an Army officer contacted him, sent a QR code “to pay,” and the moment Ankur scanned it ₹46,000 was instantly drained from his account. The “buyer” disappeared.

This is not a rare case. This happens every single day across India.

What Is the OLX / Facebook Marketplace Advance Payment Scam?

India’s second-hand goods market is booming. Millions of people every day buy and sell phones, bikes, cars, furniture, and electronics on platforms like OLX, Facebook Marketplace, and Quikr. And scammers know this.

The fake advance payment scam is a type of fraud where a scammer posing as either a buyer or seller tricks you into paying money upfront through UPI, QR code, or a fake payment link. Once the money leaves your account, they vanish.

What makes this scam dangerous is how believable it looks. The scammer doesn’t ask for your OTP. They don’t ask for your bank details. They simply use your own trust against you.

The 5 Most Common Tricks Used on OLX and Facebook Marketplace

1. The Fake Army/Defence Personnel Scam (Most Common)

This is India’s most reported OLX scam, documented by Delhi Police, Tamil Nadu Police, and Rajasthan Police.

How it works:

A scammer contacts you as a buyer on OLX. They say they are posted in the Indian Army or paramilitary forces and are being transferred to another location, so they urgently need to buy or sell an item. They sound professional and trustworthy.

• As a seller scam: They agree to buy your item at full price, then say they’ll pay via UPI. They send a “payment request” — which looks like a credit notification — and ask you to enter your UPI PIN to “confirm receipt.” The moment you enter your PIN, money is debited from your account, not credited.
• As a buyer scam: They post a vehicle, phone, or laptop at a price 30–40% below market rate. They share fake Army ID cards, canteen cards, and even courier receipts. They ask for an advance amount of ₹20,000–₹50,000 to “book” the item. After receiving the money, their phone is switched off permanently.

Real example: Tamil Nadu Police traced a scam operation to 10 villages in Rajasthan’s Bharatpur district where hundreds of people were running this scheme as a full-time operation.

2. The QR Code Trap (Seller Gets Robbed)

This is one of the most technically clever tricks used on OLX.

How it works:

You are selling an item. The buyer says they want to pay via Google Pay or PhonePe. They send you a QR code and say: “Scan this to receive the money.”

What they don’t tell you: In UPI, you scan a QR code to make a payment — not to receive one. When you scan a scammer’s QR code and enter your PIN, you are paying them, not the other way around.

The scammer often doubles down. After you lose money, they say it was a “mistake” and send another QR code for “double the amount as compensation.” Victims lose money again.

Rule to remember: You never need to scan a QR code or enter your UPI PIN to receive money. If someone asks you to do this, it is 100% a scam.

3. The Fake Payment Screenshot Trick

A scammer buys something from you on OLX or Facebook Marketplace. They send you a fake payment screenshot often a doctored PhonePe, GPay, or Paytm confirmation and ask you to hand over the item or ship it immediately.

The screenshot looks completely real with transaction IDs, timestamps, and your name. But no money was ever actually sent.

How to protect yourself: Never hand over any item or ship a product until you can physically see the amount credited in your bank account or UPI app not in a screenshot someone sent you.

Use tools like ScamDekho’s Fake Payment Screenshot Checker to verify if a payment screenshot is genuine before releasing any goods.

4. The Courier / Delivery Charge Scam

This scam mainly targets buyers of vehicles and electronics.

How it works:

A seller (usually posing as Army personnel or someone relocating abroad) lists a car, bike, or iPhone at an attractive price. They say they cannot meet in person but will ship the item via courier. They send you:

• A fake courier booking receipt
• A fake OLX “escrow” confirmation email
• Sometimes even a fake tracking number

Once you pay the item price or “advance booking,” they ask for additional charges — GST fees, insurance, customs duty, or delivery confirmation fees. These fees keep coming. The item never arrives.

Red flag: No legitimate seller on OLX or Facebook Marketplace ships vehicles or high-value items via courier to a stranger. If they refuse to meet in person, walk away.

5. The “Payment Upgrade” Scam (New in 2025–26)

This is a newer scam making waves on Facebook Marketplace India.

How it works:

A buyer contacts you, agrees to your price, and says they’ve already paid. You then receive a message — either from a fake email or a WhatsApp message — saying your account needs to be “upgraded to a business account” to receive the funds, and you need to pay a small activation fee of ₹499 or ₹999.

This fee is the scam. No payment platform in India charges you to receive money. The buyer was never real.

Why Do So Many People Fall for These Scams?

Understanding the psychology helps you stay safe:

1. Authority Bias

The moment someone says “I am an Army officer,” most people lower their guard. Scammers know this. They show fake ID cards that look completely official and use military language to sound credible. Respect for authority is natural — but it can be exploited.

2. Artificial Urgency

“I am getting transferred tomorrow.” “Ten other buyers are waiting.” These lines are designed to stop you from thinking clearly. When you feel rushed, you skip the verification steps. That is exactly what the scammer wants.

3. Confusion Around UPI

Many people, especially new UPI users, do not fully understand how payment requests work. A scammer sends a payment request and the victim thinks money is coming in — but approving it actually sends money out. This one gap in knowledge has cost thousands of people their savings.

4. Prices That Seem Too Good

A phone worth ₹60,000 listed for ₹35,000 feels like a great deal. But that excitement switches off the part of your brain that asks questions. If the price makes no logical sense, the listing is almost certainly fake.

How to Verify Before You Pay: Step-by-Step

Step 1: Reverse image search the product photos

Copy the product image and search it on Google Images. If the same photo appears on multiple listings or stock photo websites, the seller is using stolen images. Move on.

Step 2: Check the seller’s profile carefully

Look at when the account was created. No reviews, no history, and a recently made profile are all red flags. On Facebook Marketplace, a genuine seller usually has friends, old posts, and visible activity on their profile.

Step 3: Verify identity through a video call

Anyone can claim to be an Army officer or a government employee. Ask for a video call before any transaction. If they refuse or keep making excuses, do not proceed.

Step 4: Meet in person for anything above ₹5,000

Insist on meeting at a public place a busy market, shopping mall, or police station parking lot. No exceptions for high-value items.

Step 5: Verify payment in your own app

Open PhonePe, GPay, or Paytm yourself and check your actual balance before handing over anything. Screenshots sent by buyers can be easily faked. Only trust what your own app shows.

Step 6: Never scan a QR code to receive money

You only scan QR codes to send money. If a buyer tells you to scan to receive payment, disconnect immediately.

Real Scam Warning Signs — Quick Checklist

Use this before any OLX or Facebook Marketplace transaction:

Warning Sign	What It Means
Seller/buyer claims to be Army personnel	Possible impersonation scam
Price is 30–50% below market rate	Bait to attract victims
Refuses to meet in person	Almost always a scam
Asks for advance before showing the item	Classic advance payment scam
Sends QR code “to pay you”	QR code trap — you will lose money
Shares payment screenshot before item	Fake screenshot scam
Asks you to pay extra “GST/insurance/courier” fees	Courier fee scam
Profile is newly created, no reviews	High risk account
Moves conversation to WhatsApp immediately	Avoiding platform detection

I Already Paid — What Do I Do Now?

If you’ve been scammed, act immediately:

Within 1 hour:

• Call your bank’s 24/7 helpline and report the fraudulent transaction. Ask them to flag or freeze the transaction.
• Note down the UPI transaction ID, the scammer’s phone number, and UPI ID.

Within 24 hours:

• File a complaint on the National Cyber Crime Reporting Portal: cybercrime.gov.in or call 1930 (Cyber Crime Helpline).
• File an FIR at your nearest police station. Take your bank statement, screenshots, and chat history.

Important: As per RBI guidelines, if a fraudulent transaction is reported within 3 days, your liability may be zero. Banks are required to investigate and may refund the amount. Do not delay.

How OLX and Facebook Are (Trying to) Fight Back

OLX India has deployed fraud detection algorithms that flag listings with unusually low prices relative to market rate. They also have a Trust & Safety team reachable at +91 9999140999 and allow users to hide their phone numbers in privacy settings while posting ads.

Facebook Marketplace uses AI-based listing review and has increased enforcement against fake profiles — but with over 1.1 billion monthly users globally, no automated system catches everything.

The responsibility ultimately lies with the user.

Final Word: The Rule That Saves You Every Time

Never pay advance to anyone you haven’t met in person. Never enter your UPI PIN to “receive” money. If the deal is too good to be true, it always is.

Scammers on OLX and Facebook Marketplace are getting more sophisticated every year. AI-generated fake profile photos, forged government IDs, and scripted conversations make them harder to spot. But the core of every scam is the same: they need you to send money before you’ve verified anything.

Slow down. Verify. Meet in person.

Frequently Asked Questions

Quick Answer: A fake UPI QR code scam tricks you into scanning a QR code that sends money to the scammer instead of receiving it. Scammers place fake QR stickers over real ones at shops, temples, and parking lots. Always verify the UPI ID name before confirming any payment.

What Is a UPI QR Code Scam?

Most people think scanning a QR code to pay is safe. But there is one thing many Indians don’t know — a QR code can only be used to collect money, not send it to you.

Scammers exploit this confusion every day.

In a UPI QR code scam, a fraudster either:

• Replaces a genuine QR code at a shop or temple with a fake one linked to their own UPI account, or
• Sends you a QR code on WhatsApp/Telegram saying “scan this to receive your payment”

When you scan and pay, the money goes directly to the scammer and there is almost no way to reverse a UPI transaction once confirmed.

According to the Indian Cyber Crime Coordination Centre (I4C), QR code-based fraud is one of the fastest-growing categories of UPI fraud in 2025–2026, with thousands of cases reported across Maharashtra, Delhi, Karnataka, and UP.

How This Scam Actually Works — Step by Step

Understanding the exact method helps you spot it before it’s too late.

Method 1: The Fake Sticker Scam (Shops, Dhabas, Temples)

1. A scammer visits a shop, restaurant, temple donation box, or parking lot
2. They paste their own QR code sticker directly over the merchant’s original QR code
3. You scan what looks like the shopkeeper’s QR code
4. The payment goes to the scammer’s account
5. The shopkeeper never receives any money and has no idea

This happens most commonly at:

• Small kirana stores and tea stalls
• Temple donation counters
• Street food vendors
• Parking lots and toll booths
• Petrol pumps in smaller towns

Real case: In January 2026, a Pune-based sweet shop owner filed a complaint after realizing his QR code had been replaced. Over 3 days, customers paid ₹14,000 to a scammer while the shopkeeper received nothing. He only found out when a customer complained that the payment didn’t go through “again.”

Method 2: “Scan to Receive Money” on WhatsApp/Telegram

This is the more dangerous version because it targets individuals directly.

1. Scammer contacts you — often posing as a buyer on OLX, Quikr, or a part-time job recruiter
2. They say: “We need to send you ₹5,000. Please scan this QR code to receive the payment.”
3. You scan the QR code — which actually triggers a payment from your account
4. You enter your UPI PIN thinking you’re receiving money
5. Money is deducted from your account, not credited

Why people fall for it: Most people don’t realize that entering your UPI PIN is always an authorization to pay, never an authorization to receive. Receiving money on UPI requires no PIN whatsoever.

Method 3: Fake Refund or Cashback QR

1. You order something online or at a store
2. Scammer (posing as customer care or the seller) says there was an error and offers a refund
3. They send a QR code and say “scan this and enter the amount ₹X to get your refund”
4. You pay instead of receiving

6 Signs a UPI QR Code Is Fake

Warning Sign	What to Do
QR sticker looks newer or slightly misaligned vs. surrounding surface	Peel corner gently — a fake sticker sits on top of the original
UPI ID name after scanning doesn’t match the business name	Do not pay. Ask the shopkeeper to verify
Someone sends you a QR code to “receive” money	Refuse. You never need to scan to receive money
The QR code is sent via WhatsApp, Telegram, or SMS	Treat it as suspicious by default
You are asked to enter your PIN to get a refund or cashback	Stop immediately — this is always a scam
Payment amount field is pre-filled and you can’t change it	Red flag — close the app and verify

How to Verify a UPI QR Code Before Paying

Follow these steps every time — especially for amounts above ₹500.

Step 1: Check the name that appears after scanning

When you scan any UPI QR code, your app shows the registered name before you confirm. Always read it. If you’re paying a shop called “Sharma General Store” but the name shows “Rahul Kumar” or any personal name, stop and ask.

Step 2: Check for sticker layering

At shops and temples, gently check if the QR code is a sticker placed over another surface. Scam QR codes are often printed on plain white sticker paper and look slightly different in texture or color.

Step 3: Never scan a QR code sent via chat to “receive” money

No legitimate payment gateway, employer, bank, or government body will ever ask you to scan a QR code to receive money. This is always a scam, without exception.

Step 4: Use ScamDekho’s UPI QR Checker

Before paying on an unfamiliar QR code, you can verify it using our UPI QR Checker tool. It checks the UPI ID against known fraud patterns and flags suspicious accounts.

Step 5: Confirm with the merchant verbally

For amounts above ₹1,000 at a new shop, just ask the shopkeeper: “Aapka UPI ID kya hai?” and match it to what your app shows after scanning. This takes 5 seconds and can save you thousands.

Who Is Getting Targeted the Most?

Based on cybercrime reports filed across India in 2025–2026, the most affected groups are:

• Small shopkeepers and vendors — whose QR codes get replaced without their knowledge
• OLX and Quikr sellers — targeted with fake buyer “send money” QR scams
• Job seekers — told to scan a QR to receive a “registration fee refund” or “advance salary”
• Devotees at temples and dargahs — where fake QR donation boxes are placed
• Senior citizens — who are less familiar with how UPI sending vs. receiving works

What to Do If You Already Got Scammed

Time is critical. Act within the first 30 minutes if possible.

Step 1: Call 1930 immediately

This is India’s National Cyber Crime Helpline. Report the fraud and provide the transaction ID, UPI ID of the scammer, and amount. They can initiate a hold on the fraudster’s account if acted on quickly.

Step 2: File a complaint at cybercrime.gov.in

Register a formal complaint online. Download your bank statement showing the transaction as evidence.

Step 3: Report to your bank

Call your bank’s fraud helpline and ask them to raise a chargeback or fraud dispute. Success rate is higher if you report within 24 hours.

Step 4: Report the UPI ID on the app

In PhonePe, GPay, or Paytm — go to the transaction, tap “Report an issue” and select fraud. This flags the UPI ID and can help prevent others from being scammed.

Step 5: File an FIR at your local police station

Even if online complaint is filed, a physical FIR strengthens your case for bank recovery.

How Shopkeepers Can Protect Their QR Codes

If you own a business, these steps protect your customers and your revenue:

• Laminate your QR code — A laminated QR code cannot have a sticker placed over it cleanly. This is the single most effective physical protection.
• Check your QR code daily — Spend 10 seconds scanning your own QR code every morning to verify it shows your name and UPI ID.
• Keep a printed backup — Store a backup printout of your original QR code and compare it monthly.
• Affix QR codes to a flat, painted wall — Avoid placing them on portable stands where they can be swapped easily.
• Enable SMS alerts on your UPI account — So you immediately know if a customer paid but the money didn’t reach you.

Check Any Suspicious UPI QR Code Right Now

If you have received a QR code that seems suspicious — from a WhatsApp message, OLX buyer, or job recruiter — don’t scan it on your payment app. Use ScamDekho’s free tool first.

Check a Suspicious UPI QR Code →

You can also check:

• Fake Payment Screenshot Checker — if someone shows you a “proof of payment”
• URL Checker — if someone sends you a suspicious link along with the QR code
• Scam Message Checker — if you received a text message with the QR code

Summary

UPI QR code scams work because they exploit a simple misunderstanding — most people don’t know that you never need to scan a QR code to receive money, and that entering your UPI PIN always means you are paying.

The key rules to remember:

• Always check the name shown after scanning before entering your PIN
• Never scan a QR code sent via WhatsApp, Telegram, or SMS to “receive” money
• Shopkeepers should laminate their QR codes and verify them daily
• If scammed, call 1930 immediately — every minute matters

Stay alert, verify first, pay second.

ScamDekho is India’s free platform for detecting online scams, fake payments, and digital fraud. Our tools are used by thousands of Indians every month to verify suspicious QR codes, payment screenshots, offer letters, and URLs.

Frequently Asked Questions

Your UPI stops working. Bank app shows “Debit Freeze Applied.” No warning. No reason. Money stuck. EMIs failing.

You are not alone. Thousands of Indians are facing this right now — and most of them have done nothing wrong.

This guide tells you exactly what to do, step by step.

Why Was Your Account Frozen?

When someone reports a cyber fraud, police trace the money. Every account in that chain gets frozen — including accounts of innocent people.

Common reasons your account got caught:

You sold something on OLX and the buyer’s money turned out to be fraud money.

You did a P2P crypto trade (like selling USDT on Binance) and the buyer used stolen funds.

Someone asked you to receive and forward money for commission — that money was stolen. You became a money mule without knowing.

A scammer routed a small amount through your UPI to confuse the money trail.

Important: The freeze is an investigative measure, not a punishment. But it can continue until the investigating authority lifts it or a court orders otherwise. It will not go away on its own — you have to act.

What Happens When Your Bank Account Is Frozen in India?

Debit Freeze (most common):

• You cannot send money, withdraw cash, or use your debit card
• But salary and other credits can still come in
• You just cannot touch any of it

Complete Freeze (rare):

• Nothing goes in, nothing comes out
• Even salary stops

Your bank will not tell you the full reason. They will just say “law enforcement direction.” You need to dig deeper yourself.

Step 1: Visit Bank Branch to Check Why Your Account Was Frozen

Do not waste time calling the helpline. Go to the branch in person with your Aadhaar and PAN.

Ask for these details in writing:

• Why was the account frozen?
• Which police station or cyber cell ordered the freeze?
• What is the FIR or complaint number?
• Is it a debit freeze or complete freeze?

Do not leave without this information. Banks may share basic details like the freezing authority and complaint number, but full details may be limited due to investigation confidentiality. Push for whatever they can share.

Step 2: Contact the Cyber Cell That Ordered the Freeze

Now that you know which police station or cyber cell froze your account, contact them.

• If the cyber cell is in your city: Visit in person. Bring your bank statements, ID proof, and any evidence that your transactions were genuine (invoices, receipts, exchange records).
• If the cyber cell is in another state: Call them. Send a written letter by speed post. Follow up by email.

What to tell them:

“My account has been frozen under complaint number [X]. I am not involved in any fraud. I am attaching my bank statements and transaction records showing that my transactions are legitimate. Please verify and issue an NOC to unfreeze my account.”

Keep it simple. Keep it polite. Keep it documented.

Step 3: Submit a Formal Written Representation

Write a letter to the Investigating Officer (IO) and the SP (Cyber Cell). Include:

• Your full name, address, and occupation
• Bank name, branch, account number, and IFSC
• The complaint/FIR number linked to the freeze
• A clear statement that you are not involved in the crime
• Supporting documents (bank statements, invoices, crypto trade records)
• A request to issue an NOC for de-freezing

Send this by registered post or speed post. Keep the receipt. This creates a paper trail.

Step 4: Get the NOC and Submit to Bank

If the IO is satisfied that you are innocent, they will issue a No Objection Certificate (NOC).

Take this NOC to your bank branch manager. After verification, your account is usually unfrozen within 3 to 7 working days.

This is the fastest route. But many IOs take time, especially in inter-state cases.

Step 5: If the IO Does Not Respond — Go to Court

If the IO ignores you or refuses the NOC, you have legal options.

Option A: File application before the Magistrate

You can file an application before the Magistrate for release or de-freezing of your account. The Magistrate can examine if the freeze was lawful and order it to be lifted.

Option B: File a Writ Petition in High Court

File under Article 226 of the Constitution. Argue that the freeze violates your right to livelihood (Article 21) and right to business (Article 19(1)(g)).

You will need a lawyer for both options. A cyber crime lawyer is ideal.

What Courts Have Said in 2026

Several High Courts in India have recently spoken up against the common practice of freezing entire bank accounts and have ruled in favour of innocent account holders.

• On freezing full accounts: courts have said that if only a small amount of disputed money passed through your account, freezing the whole balance is unfair. Only that specific amount should be held, not everything you have.
• On police powers: Multiple courts have questioned whether police can freeze accounts on their own without any order from a judge. They have stressed that proper legal process must be followed.
• On innocent account holders: Courts have made it clear that someone who is not an accused or even a suspect should not have to suffer endlessly just because fraud money moved through their account for a short time.
• What this means for you: If your full account has been frozen over a small disputed amount and no proper legal procedure was followed, you have the right to challenge it in court. Talk to a lawyer who understands these recent rulings.”

How Long Does Unfreezing Take?

Route	Estimated Timeline
NOC from IO → Bank	3 to 7 working days
Magistrate application	2 to 6 weeks
High Court writ petition	1 to 3 months (interim relief possible in days)

These are approximate timelines. Actual duration varies depending on the case, location, and response from authorities.

The faster you act, the faster you get your money back.

Do NOT Do These Things

• Do not approach middlemen who promise to unfreeze your account for a fee. They are scammers.
• Do not ignore the freeze. It will not resolve on its own. Ever.
• Do not open a new account and try to route frozen funds through it. This creates more legal trouble.
• Do not fight with bank staff. They are following orders. Your fight is with the investigating authority.

Also Read: KYC Scam in India: Fake Bank Messages That Are Stealing Your Money

How to Prevent This from Happening

• Never receive and forward money for strangers. If someone offers you commission to let money flow through your account — say no.
• Be careful with P2P crypto trades. Verify the buyer. Avoid large trades with unknown parties.
• Do not share your bank details with anyone. No real employer needs your personal account.
• Check before you transact. Got a suspicious link, UPI ID, or QR code? Verify it on ScamDekho first. 10 seconds can save you months of trouble.
• Monitor your account. If you see any unknown credits, report to your bank and call 1930 immediately.

When Should You Hire a Lawyer?

• Account frozen for more than 2 weeks and IO not responding
• Complaint filed in a different state
• Amount involved is above ₹1 lakh
• You received a legal notice or summons

A cyber crime lawyer knows the latest court rulings and can file the right applications fast.

Conclusion

The experience of having your bank accounts frozen due to cyber crime can be frustrating and unfair, especially when you have done nothing wrong. However, the good thing is that this problem can be solved if the right process is taken. From calling your bank and cyber cell to obtaining the NOC or going to the court, all these steps are important in unfreezing your accounts.

The most important thing is to remain calm and avoid any shortcuts that might come your way. The most important thing in all this is that this experience should be taken as a lesson and that one should be careful with online transactions and P2P transactions. The experience of having your accounts frozen is just that—a hurdle that needs to be passed.

Bank account frozen? Act fast. Follow these steps. Do not wait for it to fix itself.

Frequently Asked Questions

A WhatsApp message arrives on your phone. It says:

“Dear Customer, your Aadhaar card details need to be updated immediately. Failure to do so will result in your bank account being blocked. Click here to update now.”

It looks official. It has the UIDAI logo. The language sounds formal. And you are worried.

This is exactly what scammers want.

In January 2026, the Press Information Bureau (PIB) officially confirmed that a message circulating in the name of SBI was completely fake. The message claimed that users must download an APK file to update their Aadhaar or their YONO banking app would be blocked. PIB stated clearly: SBI does not ask customers to update Aadhaar through unsolicited messages or APK downloads. Thousands of people had already received this message before the fact-check was issued.

This scam — the fake Aadhaar and PAN update scam — is one of the most dangerous and widespread frauds in India right now. Here is everything you need to know to protect yourself.

How the Fake Aadhaar and PAN Update Scam Works

Scammers don’t just guess — they have a playbook. Every method they use is carefully designed to make you panic and act fast, before you have a chance to think clearly.

Method 1: Fake WhatsApp Messages

You get a WhatsApp message saying your Aadhaar needs to be updated right now or your account will be blocked. There’s a link attached. You click it, and the website looks completely real — same UIDAI logo, same colors, same layout. But the moment you type in your Aadhaar number and OTP, a scammer on the other end is watching. Your details are gone in seconds.

Method 2: Fake Phone Calls

Your phone rings. The person on the other end sounds official — they say they’re calling from UIDAI, your bank, or the Income Tax Department. They tell you your Aadhaar is linked to suspicious activity, or that your PAN card has been misused. They sound calm, professional, even concerned. All they need, they say, is your Aadhaar number and OTP to “verify” your identity. The moment you share that OTP, they’re inside your bank account.

Method 3: Fake APK Files

A message arrives — sometimes on WhatsApp, sometimes SMS — telling you to download an app to update your Aadhaar. It’s not from the Play Store. It’s an APK file, a raw app file you install directly. Once it’s on your phone, you won’t notice anything different. But quietly, in the background, it’s reading your SMS messages, stealing your OTPs, and giving scammers a window into your banking apps.

Method 4: Fake Aadhaar Centers

This one is scarier because it happens in person. In Aligarh, Uttar Pradesh, police busted a network that had created over 5,000 fake Aadhaar cards in just six months. These people set up what looked like legitimate Aadhaar registration centers. They had fake certificates on the walls. They charged a small fee and promised faster service. Thousands of people walked in trusting them completely. It got so serious that UIDAI had to personally audit 47 Jan Seva Kendras across the district.

What Happens After You Fall for This Scam

This is not just about losing money in one transaction. The consequences can be much worse.

Once scammers have your Aadhaar number and OTP, they can open bank accounts in your name, apply for loans you never took, get new SIM cards registered to your identity, perform AePS (Aadhaar Enabled Payment System) transactions to withdraw money directly from your bank account, and use your identity to commit other crimes — leaving you legally exposed.

UIDAI has confirmed that there have been multiple cases where criminals misused leaked Aadhaar biometric data to withdraw money through AePS by replicating fingerprints using compromised biometric devices.

Check: Fake Loan App Scam India: How to Identify Them and Protect Yourself

6 Red Flags to Identify a Fake Aadhaar or PAN Update Scam

1. Any message asking you to update your Aadhaar via WhatsApp or SMS

UIDAI has said this clearly and repeatedly — it never asks you to submit documents or update your Aadhaar through WhatsApp or email. Full stop. If you need to update anything, the only places to do it are myaadhaar.uidai.gov.in, the mAadhaar app, or by visiting an Aadhaar Seva Kendra in person. Anything else is a scam.

2. A link in a message that looks like UIDAI’s website

Before you click anything, look at the URL closely. The only real UIDAI website is uidai.gov.in. Scammers create sites like uidai-update.in or aadhaar-verify.com that look identical at first glance. One extra word, one hyphen, one dot out of place — and it’s fake. When in doubt, don’t click. Open your browser and type the address yourself.

3. Someone on the phone asking for your OTP

This is the simplest rule to remember. No government agency, no bank, no legitimate organization will ever ask for your OTP over a call. Not once, not ever. The moment someone asks for your OTP — hang up. Don’t explain, don’t argue, just hang up.

4. A message warning your account will be blocked unless you act immediately

That panic you feel when you read those words? That’s exactly what the scammer is counting on. Real banks and UIDAI don’t send threatening WhatsApp messages with countdown timers. They send formal notices through proper channels. If a message is designed to scare you into acting fast, slow down instead.

5. A request to download an APK file

If someone sends you an app file through WhatsApp or SMS and asks you to install it, do not touch it. Legitimate apps are on the Google Play Store or Apple App Store — that’s it. An APK file sent through a chat message is almost always malware, and once it’s installed, you may not even know it’s there.

6. Anyone offering to update your Aadhaar for a fee

Basic Aadhaar updates online are completely free. UIDAI offers this directly on their website. So if a person, a shop, or a “center” is charging you money to update your Aadhaar through some unofficial process, they are scamming you. Pay nothing, share nothing, and walk away.

Know More: SIM Swap Scam India: What It Is, Warning Signs and How to Stay Safe

How to Verify Your Aadhaar Safely — Official Methods Only

If you genuinely need to update or verify your Aadhaar, use only these official channels:

• Online: Visit myaadhaar.uidai.gov.in — this is the only official portal. Do not trust any other website.
• App: Download the mAadhaar app from the Google Play Store or Apple App Store. Do not install any APK sent via message.
• In person: Visit your nearest Aadhaar Seva Kendra or post office that is officially authorized by UIDAI.
• To verify if your Aadhaar is being misused: Go to the UIDAI Authentication History page on uidai.gov.in. Enter your Aadhaar number and OTP to check all recent authentication activity. If you see any activity you did not initiate, report it immediately.
• To lock your Aadhaar biometrics: You can lock your fingerprint and iris data on the mAadhaar app or the UIDAI website. This prevents anyone from using your biometrics for AePS transactions without your permission.

How to Verify Your PAN Card

For PAN-related fraud or verification, use only these official sources:

The official Income Tax Department portal is incometax.gov.in. You can verify your PAN status, check if your PAN is linked to your Aadhaar, and report misuse directly on this site.

The official NSDL portal for PAN services is tin.tin.nsdl.com.

If someone calls claiming your PAN is linked to illegal activity, do not share any details. Hang up and call the Income Tax helpline at 1800-180-1961 to verify.

If You’ve Already Shared Your Details, Do This Right Now

First — don’t panic. Panicking is what the scammer is counting on, and it won’t help you here. What will help you is moving fast and in the right order.

Step 1: Lock your Aadhaar biometrics

Do this before anything else. Open the mAadhaar app or go to uidai.gov.in and lock your fingerprint and iris data immediately. Once locked, nobody can use your biometrics to withdraw money from your account through AePS — even if they already have your Aadhaar number. This one step can stop a lot of damage before it starts.

Step 2: Call your bank

Call your bank’s customer care right after. Don’t visit the branch, don’t send an email — call, because it’s faster. Tell them exactly what happened and ask them to flag your account for suspicious activity and block any new UPI registrations linked to your number.

Step 3: Call 1930

This is India’s Cyber Crime helpline and it exists exactly for situations like this. The sooner you call, the better your chances of recovering any money that was taken. Have the details ready — what you shared, with whom, and when.

Step 4: File a complaint at cybercrime.gov.in

Go to cybercrime.gov.in and file a written complaint. Include everything — the phone number that contacted you, the exact message you received, any links you clicked, and screenshots if you have them. The more detail you provide, the stronger your case.

Step 5: Visit your nearest cyber cell

Take printed copies of everything — screenshots, messages, call logs — and go to your nearest cyber cell police station to file a formal report. This creates an official record that can protect you legally if the scammer has done something in your name.

Step 6: Check your credit report

Go to cibil.com and pull your credit report. Look carefully for any loans, credit cards, or accounts you didn’t open. If you find anything suspicious, dispute it immediately. Catching this early is the difference between a small problem and a years-long legal headache.

You can also check any suspicious link, UPI ID, or message on ScamDekho for free before acting on it.

FAQ