Scam Help · Free public service
UPI, OTP and fake KYC fraud in India: how it works and what to do in the first hour
UPI, OTP, fake KYC and fake bank-call fraud all work the same way: a stranger makes you hurry, then gets you to share an OTP or UPI PIN, install an app, or approve a request. Banks do not need your OTP or PIN. If money has left, call 1930 at once and tell your bank.
We are a private marketing company. We are not the police, a bank or a government body, and we cannot recover money. This page explains what official sources and news reports say, so you can act fast.
What is happening with UPI, OTP and fake KYC fraud?
There are five common versions. They look different, but each one ends the same way: you give away a code, a PIN, or control of your phone.
- Fake customer care: a false helpline number is planted in online search results. You call it and a "support agent" answers.
- Fake KYC: a message says your account will be blocked unless you update KYC today.
- Fake bank or RBI call: a call says there is suspicious activity and asks for your card number, CVV or OTP.
- UPI collect and QR tricks: you are told to approve a request or scan a code to receive money.
- SIM swap: criminals get a duplicate of your SIM, so your OTPs and bank alerts reach them.
Time pressure is the common thread. In some of the cases below, money left the account within minutes. So the warning signs matter more than the technique.
How big is this fraud in India?
The government counts complaints made on the National Cyber Crime Reporting Portal. These numbers cover all types of cyber fraud, not only UPI and OTP fraud.
| Year | Incidents on the portal | Losses reported by citizens |
|---|---|---|
| 2022 | 1,029,026 | Rs 2,290.24 crore |
| 2023 | 1,596,493 | Rs 7,465.18 crore |
| 2024 | 2,268,346 (up 42.08% on 2023) | Rs 22,845.73 crore |
Source: Ministry of Home Affairs, Lok Sabha Unstarred Question 432, answered 2 December 2025. Calendar years 2022 to 2024. Losses are as reported by citizens, not audited.
Over the three financial years 2023-24 to 2025-26, the Ministry of Home Affairs said the portal received more than 53,87,905 cyber fraud complaints. It said more than 1,81,271 FIRs were registered and more than Rs 56,087 crore was reported lost. More than Rs 9,079 crore was marked as lien (held), and more than Rs 206 crore was refunded.
Source: PIB, Ministry of Home Affairs, 22 July 2026. Financial years 2023-24 to 2025-26. All are "more than" figures.
Read the last number twice. About Rs 206 crore was refunded against more than Rs 56,087 crore reported. Getting money back is not assured. A fast report is the best chance of a bank hold, but no one can promise a refund, and it depends on police and courts.
Banks report a different set of figures to RBI. As reported by Outlook Business from RBI data, banks and financial institutions reported 10,114 fraud cases worth Rs 48,021 crore in FY2025-26. Card, internet and digital payment frauds were 293 cases worth Rs 29 crore, against 13,332 cases and Rs 517 crore in FY2024-25.
Source: Outlook Business, citing RBI data released 29 May 2026. Financial years 2025-26 and 2024-25.
Do not read this as "scams have stopped". Bank-reported cases are far fewer than the complaints people file on the national portal. The two counts measure different things.
Who gets hit by these scams?
The official figures we found do not split victims by age, income or education, so we will not guess. The cases below show a pattern instead: ordinary account holders across India, from one person searching for a helpline to 2,993 victims of a single app file. Anyone with a phone, a bank account and a moment of worry can be caught.
How does each scam work, step by step?
| Scam | How it starts | What they want | The tell |
|---|---|---|---|
| Fake customer care | You search for a bank or app helpline and call a number planted in the results | Card details, OTP, UPI PIN, a remote-access app, or a small "verification" payment | You found the number online, not on your card or official app |
| Fake KYC | SMS, call or WhatsApp: "update KYC today or the account is blocked", with a link or an app file (APK) | You install the file, which can hand over your banking apps and OTP messages | An app from a link, not from the official app store |
| Fake bank or RBI call | Automated or live call about suspicious activity: "press a key" or "stay on the line" | Card number, CVV, OTP, net banking details | Anyone asking for your OTP or CVV |
| UPI collect and QR trick | You are told to approve a request or scan a code to receive money | Your UPI PIN | Being asked for your PIN in order to "receive" money |
| SIM swap | Criminals collect your personal data and use forged papers to get a duplicate SIM | Your OTPs and bank alerts | Your phone suddenly loses signal for no reason |
Source: scam mechanics compiled from news reports on the cases below and Kerala Police advice as reported by The420.in (4 October 2026). Not a count of cases.
A news agency report dated 2 October 2026 says frauds using fake customer care numbers found through internet searches are on the rise. Kerala Police, as reported on 4 October 2026, say these fake agents ask victims to install remote-access apps, share banking details or pay a small verification amount.
Source: UNI India, 2 October 2026; The420.in citing Kerala Police, 4 October 2026.
What do real cases look like?
These are news reports of real cases, with names removed. Reports are not court findings. Anyone arrested is accused until a court decides.
Case 1: the helpline found in a search
What happened. A person in Uttar Pradesh searched online for a bank's customer care number and called a fake one. The caller sent a form on WhatsApp asking for banking details. Two transfers of Rs 1 lakh each left the account within minutes. The person noticed only when alerts showed up the next day. An FIR was filed. Reported loss: Rs 2 lakh.
The tell. The number came from search results. Then a form arrived on WhatsApp asking for banking details, which is a warning sign.
What would have helped. Getting the helpline number from the card, the passbook, the official app or the official website. Not filling a form sent by a caller.
Source: The420.in, reported 16 September 2025.
Case 2: the KYC app file
What happened. Victims got an SMS asking them to download an app file for an urgent utility account KYC check. Once installed, it gave criminals access to mobile banking. Police reported 2,993 victims, 9,192 fraudulent transactions and Rs 63.69 crore lost. Police said a man in his twenties who allegedly built and supplied the app files was arrested in July 2026.
The tell. An "urgent" KYC message with a link that downloads an app outside the official app stores.
What would have helped. Not installing any app from an SMS or chat link, and checking the claim with the company through its official app or website.
Source: The420.in. Complaint 3 July 2026, arrest 24 July 2026. Figures as stated by police.
Case 3: the dead SIM
What happened. A gang in Varanasi obtained a person's Aadhaar and PAN details, then went to mobile shops with forged papers saying the SIM was lost and got duplicate SIM cards activated. They received the OTPs and bank alerts and moved money out. Police arrested two members in May 2026 and said at least 11 victims over the past year were hit the same way. One victim lost Rs 12 lakh.
The tell. The real SIM stops working, with no explanation.
What would have helped. Treating sudden loss of network, especially with unexpected bank messages, as an emergency: contact your mobile operator and your bank at once.
Source: The420.in, arrest reported May 2026.
In a related court matter reported on 7 June 2026, a High Court judgment in Karnataka held a telecom operator liable after a duplicate SIM was issued to someone who was not the subscriber in February 2019. About Rs 87.7 lakh was taken from a cooperative bank's account. The court ordered Rs 50,50,762 in compensation, Rs 5 lakh in damages and 9% yearly interest. The case took years.
Source: Business Today, 7 June 2026. Fraud in 2019, judgment reported June 2026.
Who pays if money is stolen from my account?
RBI's circular of 6 July 2017 on limiting customer liability sets the rules for unauthorised electronic transactions. The time you take to report matters.
| When you report | What the circular says (third-party breach) |
|---|---|
| Within 3 working days of the bank's alert | Zero liability for you |
| After 4 to 7 working days | Your liability is capped by account type, from Rs 5,000 to Rs 25,000 in the circular's table |
| After 7 working days | Follows the bank's Board-approved policy |
Source: Reserve Bank of India, circular RBI/2017-18/15, dated 6 July 2017. Banks are to credit the disputed amount within 10 working days.
This table is for third-party breaches. We have not covered how the rules apply if you shared a code yourself, so ask your bank and do not assume. That is one more reason to never share an OTP. On 6 March 2026 RBI also issued a draft on small-value fraud compensation. We could not confirm a final version, so do not rely on it.
Source: Taxmann, summarising RBI press release, March 2026. Draft only.
What should I do in the first hour after a scam?
- Call 1930, the national cyber fraud helpline, as soon as money is lost. The Ministry of Home Affairs describes it as the toll-free number for online cyber complaints.
- Report on cybercrime.gov.in, the National Cyber Crime Reporting Portal run by I4C under the Ministry of Home Affairs.
- Tell your bank about the unauthorised transaction. Use the number on your card or the official app. Do not use a number from a search ad. The three working day window above starts from the bank's alert.
- If your phone lost signal for no reason, contact your mobile operator. You can also check connections issued in your name on Sanchar Saathi, run by the Department of Telecommunications, and report suspicious calls or messages through its Chakshu facility.
- Do not call back the number that cheated you, and do not install anything the caller sent.
Speed matters because the money often lands in mule accounts (accounts opened or rented for fraud) and is moved on quickly. A fast report gives banks the best chance to place a lien (hold) on an amount. Refund still depends on police and courts.
Source: PIB, Ministry of Home Affairs, 22 July 2026 and 28 July 2026; PIB backgrounder on Sanchar Saathi, 2 December 2025.
The same system reports results. The Ministry says more than Rs 11,158 crore has been saved in more than 32.80 lakh complaints since 2021. It describes this as money saved through the system, not money returned to victims.
Source: PIB, Ministry of Home Affairs, 28 July 2026. Cumulative from 2021 till 30 June 2026.
What are the warning signs?
If you notice any of these, stop and pause before you do anything else:
- Anyone asks for your OTP, UPI PIN, CVV, card PIN or net banking password, for any reason.
- A helpline number came from a search result, ad or message instead of your card, passbook or official app.
- You are asked to install an app, a remote-access tool or an APK file from a link.
- A message says KYC must be updated today or the account will be blocked.
- You are told to scan a code or approve a request in order to receive money.
- A caller says RBI holds your money, a prize or a refund for you. RBI has said it does not hold accounts for individuals, and its only official website is rbi.org.in.
- You are told to stay on the line or keep it secret.
Source: Reserve Bank of India press release, 4 July 2018; Kerala Police advice as reported by The420.in, 4 October 2026.
Common questions
Will my bank ask for my OTP or UPI PIN?
No. Banks do not need your OTP, UPI PIN, CVV, card PIN or net banking password from you. If anyone asks for them, for any reason, treat it as a scam. Hang up and call the number on your card or in the official app.
Does entering my UPI PIN let me receive money?
Being asked for your UPI PIN in order to "receive" money is a red flag. If someone tells you to scan a code or approve a request to receive money, treat it as a trick. Never approve a request or scan a code from a stranger, even if they say a refund is waiting.
Can I get my money back after a UPI or OTP fraud?
Not always. The Ministry of Home Affairs reported more than Rs 206 crore refunded against more than Rs 56,087 crore reported lost over three financial years. Report to 1930 and your bank quickly. Under RBI's 2017 circular, reporting within three working days of the bank's alert can mean zero liability in third-party breach cases.
How do I find my bank's real customer care number?
Take it from the back of your card, your passbook, the official bank app or the bank's official website. Do not trust a number from a search result, map listing or advertisement. Kerala Police advise checking helpline numbers only on official websites or apps.
What is a fake KYC message and what should I do with it?
It is an SMS, call or WhatsApp saying your account will be blocked unless you update KYC today, usually with a link or an app file. Do not click or install it. Check the claim through your bank's official app or branch. You can report suspicious messages through Sanchar Saathi.
What to do now
- Never share an OTP, UPI PIN or CVV with anyone.
- Save your bank's real helpline number from your card, not from a search.
- Do not install an app or APK file from an SMS or chat link.
- If money is lost, call 1930, report on cybercrime.gov.in and tell your bank the same day.
- If your phone loses signal for no reason, call your mobile operator and bank straight away.
More help: the first hour after a scam, scam help for India, how to check a suspicious message, digital arrest scams, fund recovery scams, how scammers manipulate you, scam statistics by country, scam awareness, and our charter.
Sources checked 3 October 2026
- Ministry of Home Affairs, Lok Sabha Unstarred Question 432 (NCRP incidents and losses) (Calendar years 2022 to 2024, answered 2 Dec 2025)
- PIB, Ministry of Home Affairs, National Cybercrime Response Mechanism (FY2023-24 to FY2025-26, 22 Jul 2026)
- PIB, Ministry of Home Affairs, CFCFRMS 2.0 Platform and helpline 1930 (Cumulative 2021 to 30 Jun 2026, 28 Jul 2026)
- PIB backgrounder on Sanchar Saathi App (Department of Telecommunications) (2 Dec 2025)
- Outlook Business, citing RBI data on bank fraud (FY2025-26 and FY2024-25, released 29 May 2026)
- Reserve Bank of India, circular RBI/2017-18/15 on limiting customer liability (Circular dated 6 Jul 2017)
- Reserve Bank of India press release on accounts for individuals (4 Jul 2018)
- Taxmann, summarising RBI draft on digital transaction liability (Draft dated 6 Mar 2026)
- The420.in, fake bank helpline case, Uttar Pradesh (Reported 16 Sep 2025)
- The420.in, fake KYC app file case, Mumbai police (Complaint 3 Jul 2026, arrest 24 Jul 2026)
- The420.in, SIM swap case, Varanasi (Reported May 2026)
- The420.in citing Kerala Police, fake customer care advice (4 Oct 2026)
- UNI India, fake customer care numbers on the rise (2 Oct 2026)
- Business Today, High Court duplicate SIM judgment (Reported 7 Jun 2026)
Figures are as reported by the named agencies for the periods shown. Reporting rules differ by country, so totals are not directly comparable.