Fake refund scams can trick UPI users into authorising payments while believing they are receiving money back. Fraudsters may pose as sellers, customer-care agents or delivery representatives and use links, QR codes or calls to create urgency. Here is how to identify and avoid these scams.
What Is a Fake UPI Refund Scam?
A fake refund scam usually starts with a message or phone call claiming that money is being returned to your bank account. The fraudster may say that a previous payment failed, a product was cancelled, a refund is pending or an excess amount needs to be returned.
The important warning sign is what happens next.
Instead of simply receiving a refund, the victim is asked to click a link, scan a QR code, enter a UPI PIN or approve a payment request. NPCI specifically warns that scanning a QR code and entering a UPI PIN is meant for making a payment, not receiving money.
The scam works because the victim expects money to arrive and may not notice that the UPI screen is actually asking for authorisation to send money.
How Fraudsters Create Fake Refund Requests
Scammers can use several approaches to make a refund request appear genuine.
One common method involves a fake customer-care representative. The caller may claim to be from a bank, shopping website, payment app or merchant. They might already know some basic details about a recent purchase, making the conversation appear legitimate.
Another method uses WhatsApp or SMS messages containing a refund link. The message may ask the recipient to confirm bank details or complete a small verification payment.
Fraudsters can also send QR codes while claiming that scanning the code will credit a refund.
NPCI lists fake cashback links, QR codes, unknown applications and deceptive messages among the fraud patterns against which UPI users should remain vigilant.
Why You Should Never Enter Your UPI PIN to Receive Money
The UPI PIN is used to authorise transactions from your bank account.
NPCI says users should never share their UPI PIN with anyone. It also states that a bank’s customer support will not ask for the UPI PIN.
This makes the payment screen one of the most important checkpoints during a suspected refund.
If someone tells you that you must enter your UPI PIN to receive a refund, stop the transaction.
A genuine incoming payment does not require you to authorise a separate outgoing payment by entering your UPI PIN. The same principle applies to QR codes. If someone says scanning a QR code will automatically deposit money into your account, do not proceed simply because the message appears urgent or professional.
How to Check Whether a Refund Is Genuine
Before acting on a refund message, independently verify the original transaction.
Open the shopping app, merchant website or service provider’s official application where the purchase was made. Check the order history and payment records to see whether a refund has actually been initiated.
Do not use the phone number, website link or WhatsApp account provided by the person contacting you if you are unsure about its authenticity.
Instead, find the company’s official customer-care details through its verified website or application.
You should also check your bank statement or UPI transaction history. If a refund has genuinely been processed, there should be a corresponding transaction record once the money reaches your account.
A caller telling you that a refund is waiting does not itself prove that a refund exists.
Never Scan a QR Code to Receive a Refund
QR codes are another major warning point.
NPCI’s fraud-awareness guidance specifically says users should be careful with QR codes and reminds them that scanning a QR code and entering a UPI PIN is for making payments, not receiving money.
Suppose someone says, “Scan this QR code and you will receive ₹5,000.”
Do not assume that the money will be credited.
After scanning, the UPI application may display a payment request. If you enter your PIN and approve it, you could be authorising money to leave your account.
The safest response is to close the request and independently contact the merchant or bank through an official channel.
Avoid Refund Links and Unknown Apps
Fraudsters may send links that lead to fake websites designed to resemble banks, shopping platforms or payment services.
A link can also be used to encourage users to download an application that the scammer claims is necessary for processing the refund.
NPCI advises users to be cautious about downloading unknown applications because fraudsters use social-engineering techniques to manipulate users.
Do not install an app simply because a caller says it will help process a refund.
Do not share your screen with an unknown person either. A scammer who can see your banking or UPI application may be able to observe sensitive information or guide you through a fraudulent transaction.
For customer support, start from the official website or application yourself instead of following an unsolicited link.
What to Do If Someone Calls About a Refund
A genuine customer-service interaction does not require you to surrender control of your bank account.
If someone calls claiming that a refund is pending, ask for the transaction or order reference and independently verify it.
Do not share your UPI PIN, OTP, card PIN, CVV, passwords or other banking credentials.
If the caller pressures you to act immediately, treat that as a warning sign. Social-engineering scams often rely on fear, urgency, greed or confusion. NPCI identifies these psychological tactics as factors that can make users vulnerable to digital-payment fraud.
You can simply end the call and contact the relevant bank, merchant or payment provider using its official customer-service channel.
How to Protect Your UPI Account Every Day
Basic precautions can significantly reduce the risk of a fake refund scam.
Keep your UPI application and phone operating system updated. Use a strong device lock and avoid allowing unknown applications unnecessary permissions.
Check the recipient’s name before approving a payment. Do not approve a collect request or payment request merely because someone says it is necessary to receive money.
Keep transaction notifications enabled so you can quickly identify unexpected debits.
If your UPI application or bank provides transaction controls or limits, review the available settings and use them according to your requirements.
Most importantly, never treat a UPI PIN as a verification code for receiving money. It is an authorisation mechanism for a transaction. NPCI states that the UPI PIN should not be shared with anyone, including people claiming to represent the bank or payment application.
What to Do If Money Has Already Been Lost
If you accidentally authorised a fraudulent UPI transaction, act immediately.
Contact your bank through its official customer-service channel and report the transaction as fraud. Provide the transaction ID, amount, date and other information requested by the bank.
You should also report financial cyber fraud immediately through India’s National Cyber Crime Reporting Portal or by calling the national cybercrime helpline at 1930. The official portal identifies 1930 as the 24×7 helpline for immediate reporting of financial cyber fraud.
The faster the incident is reported, the sooner the relevant authorities and financial institutions can begin the required process.
The National Cyber Crime Reporting Portal also allows citizens to report suspicious identifiers such as phone numbers, email IDs, website URLs and social-media accounts associated with suspected cybercrime.
Keep screenshots, transaction details, phone numbers, messages and other evidence related to the incident. Do not delete potentially useful records before reporting the fraud.
Fake Refund Scams: The Simple Rule to Remember
The easiest way to avoid a fake UPI refund scam is to remember one basic rule: receiving money should not require you to authorise an unrelated outgoing payment.
If a person asks you to enter your UPI PIN to receive a refund, scan a QR code to get money, install an unknown app or share an OTP, stop and verify the request independently.
UPI itself is designed as an instant bank-to-bank payment system, but the security of an individual transaction also depends on the user’s actions.
For users in Tier-2 and Tier-3 cities, where UPI is increasingly used by local shops, service providers and individuals, understanding these simple warning signs can help prevent costly mistakes.
Key Takeaways
- Never enter your UPI PIN to receive a refund or cashback.
- Do not scan an unknown QR code when someone claims it will credit money to your account.
- Verify refunds directly through the merchant, bank or payment app’s official channels.
- If money is lost through a UPI scam, report the financial fraud immediately by calling 1930 and through the National Cyber Crime Reporting Portal.
FAQ
Can someone send me a UPI refund without my PIN?
Yes. You do not need to share your UPI PIN with someone in order to receive money. A request asking you to enter your PIN to receive a refund should be treated with caution.
Is it safe to scan a QR code to receive money?
Be careful. NPCI specifically warns that scanning a QR code and entering a UPI PIN is meant for making payments, not receiving money.
What should I do if I clicked a fake refund link?
Do not enter banking credentials or approve any UPI payment request. If you have already shared sensitive information or money has been debited, contact your bank immediately and report the financial cyber fraud through 1930 and the National Cyber Crime Reporting Portal.
What is the cybercrime helpline number for UPI fraud in India?
The national cybercrime helpline for reporting financial cyber fraud is 1930. The National Cyber Crime Reporting Portal also provides an online reporting facility.
(Internal keywords: UPI fake refund scam, UPI refund fraud, how to avoid UPI scams, UPI fraud prevention, fake cashback scam, UPI QR code scam, UPI PIN safety, fake customer care scam, online payment fraud India, cyber fraud helpline 1930, how to report UPI fraud, UPI scam protection)