The Most Common UPI & Phone Scams in India (2026) — and How to Beat Them

Cyber fraud in India is now measured in tens of thousands of crores. Indians lost an estimated ₹22,495 crore to cyber fraud in 2025, with complaint volumes up around 24% year on year. UPI scams alone accounted for over ₹1,750 crore in FY2025-26, a 31% jump.

The good news: most of these scams rely on the same few tricks. Learn the trick, and you are largely immune. Here are the ones to know in 2026.

1. The "Digital Arrest" scam

How it works: You get a call — increasingly a video call — from someone claiming to be CBI, ED, Customs or police. They say your Aadhaar or a parcel in your name is linked to a crime. They keep you on the line in a fake "digital custody", sometimes for hours or days, forbidding you from contacting anyone, until you transfer money to "clear your name". In 2026, some use AI deepfake "officials" and spoofed video-call screens to look convincing. Over 30,000 digital-arrest complaints were filed in 2025.

The rule that beats it: No real law-enforcement agency in India arrests or investigates anyone over a video call, and none takes payment to "clear" you. The instant someone on a call says "digital arrest", it is a scam. Hang up and call 1930.

2. The UPI "collect request" trap

How it works: A "buyer" (say, on OLX) or a "refund" agent says they are sending you money. Instead they send a UPI collect request. If you approve it and enter your PIN, money leaves *your* account, not theirs.

The rule that beats it: You never enter your UPI PIN to receive money. Receiving is automatic. Any PIN entry means you are paying. Anyone asking you to "enter your PIN to get a refund/prize/cashback" is stealing from you.

3. Fake KYC-update messages

How it works: An SMS or WhatsApp warns that your bank, wallet or UPI account will be blocked today unless you "update KYC" via a link. The link is a cloned login page that captures your credentials and OTP.

The rule that beats it: Banks never send KYC-update links by SMS or WhatsApp. Update KYC only inside the official app or at a branch. Never click a KYC "verify now" link.

4. Deepfake investment schemes

How it works: A slick video shows a famous Indian business figure "endorsing" a trading app or crypto scheme with guaranteed returns. You are moved to a WhatsApp/Telegram group, shown fake profits, encouraged to invest more — and then you cannot withdraw. Investment fraud was one of the biggest drivers of 2025's losses.

The rule that beats it: No legitimate investment guarantees returns, and a celebrity video is not proof of anything in the age of deepfakes. Verify any adviser or platform against SEBI's registered list before paying.

5. The "mule account" recruitment trap

How it works: A "work from home" or "easy commission" offer asks you to receive money and forward it, keeping a cut. You are being recruited as a money mule to launder scam proceeds. India flagged over 524,000 mule accounts in March 2026 alone, and mule-account holders can face prosecution.

The rule that beats it: Never let anyone route money through your bank account for a fee. If an "employer" needs your account to move funds, walk away and report it at cybercrime.gov.in.

The two habits that protect you from all of them

1. Slow down. Every one of these scams manufactures urgency — a deadline, an arrest, a vanishing deal. Fraud dies when you pause and verify through an official channel.
2. Shrink your attack surface. Scammers need your phone number to reach you in the first place, and they buy those numbers in bulk from data brokers. The fewer lists you are on, the fewer scam calls you get.

If you have already been hit

Report immediately — the first hour matters most. Call 1930 or file at cybercrime.gov.in. Fast reporting lets banks freeze the receiving account before the money is withdrawn.

The bottom line: the 2026 scam playbook is fear, urgency and a payment you did not intend to make. Learn the five patterns above and you will spot them cold. Then scan your data to review source-attributed findings, and use the organisation's published privacy or unlisting route where available. A request is not proof of deletion; see our DPDP Act guide for the commencement schedule.