How easily ‘UPI money collection fraud’ occurs
This scam works on a simple principle – you are tricked into believing a fake story or are taken by surprise and approve an unknown UPI cashout or auto payment request. You might be wondering why you would approve such unknown requests. The reason is that you might not be able to distinguish between a genuine request and a fraudulent one. It is important to note that the cashout or auto payment request itself is valid, but the person initiating these requests is a scammer.
Look at the image below – it shows an auto-payment request for Netflix. Can you tell if this is a real request sent by Netflix for your account or if it is a request sent by scammers for their Netflix account? This is a real UPI auto-payment request initiated by a scammer from their Netflix account. So, if you mistakenly end up approving this request thinking it is your own Netflix subscription, you will essentially be paying money for the scammer’s Netflix subscription. This is exactly how scammers can try to steal your money if they know your UPI ID.
(The image above is shared by a user who does not use Netflix)
“UPI IDs are usually expressed as phone numbers followed by the UPI provider’s extension. Scammers take advantage of this. Phone numbers and details are easy targets as phone numbers are often shared and cited at multiple places – e-stores, restaurants, malls, parking lots, etc. Since it is easy to crack UPI IDs, customers using them for online and digital transactions need to be very aware of the risks. There have been a number of fraud cases in the past where customers approved transactions thinking it was a receipt but ended up transferring money from their account,” says Vikram Babbar, Partner, EY Forensic & Integrity Services – Financial Services. He is also the President, India Chapter of the Association of Certified Financial Crime Specialists (ACFCS).
A UPI user, who did not want to reveal her name, shares her experience: Over the past few weeks, she has been receiving a lot of requests for UPI auto-payment and cash collection from Netflix, Google Pay, etc. Online payment account. However, none of these UPI cash-out or auto-pay requests have been initiated by anyone she knows, and she does not have a Netflix subscription or a Google Pay account. The image below, shared by the user, shows actual UPI cash-out requests received from unknown people.
“Since UPI IDs are basically an extension of phone numbers, they can be easily duplicated or generated in various formats. This makes it easy for spammers to create multiple fake IDs and bombard users with requests,” says Sheetal R Bhardwaj, executive member, MENA chapter, ACFCS.
What should you do to prevent this fraud from happening to you?
“Senior citizens are vulnerable to frauds and are considered as ‘mule accounts’. They should avoid directly linking their bank accounts with UPI ID and use a wallet with limited balance. This will help avoid high-value frauds. They should consult their relatives in case of any suspicion,” says Babbar of EY India.
Babbar reports that UPI service providers themselves have taken additional steps to make customers aware. “In some cases, for example, high-value transactions outside the normal pattern, customers are warned before entering the UPI PIN that this is a pay transaction and not a receipt transaction,” he says.
Bhardwaj shares some tips for senior citizens to use UPI safely:
- Higher risk of scams: Older people may be less familiar with digital payment systems and the possibility of fraud, making them more vulnerable to scams. Therefore, always verify the UPI address and double-check with the intended recipient or service provider for its authenticity.
- Emotional manipulation: Scammers often use emotional tactics, such as posing as a family member in distress. Older people are more likely to react to these manipulative tactics, which can lead to financial losses. Be aware of these tactics and do not give in to these requests.
- Education and Awareness: It is essential for seniors to be aware of the risks associated with UPI transactions and to recognise legitimate requests. It may also be helpful to encourage them to consult with trusted family members or friends before accepting such UPI requests.
What experts suggest the government and other companies should do
According to Shobhit Goyal, Founder and CEO, BeFiSc, “NPCI should create or require any UPI wallet to create a security layer to send auto-payment requests. The UPI ID should not have a 10-digit mobile number, instead, they can add the name or initials of the name so that auto-generation of UPI ID can be stopped. There can be many other technical solutions, but the point is that NPCI should recognize and start considering this as a big problem to be solved. Sadly, there is no facility available if users want to disable auto-payment requests permanently, though they can decline the request. NPCI should come up with such a feature.”
Bhardwaj reports that many UPI platforms may not have strict measures in place to verify the authenticity of cash-out or auto-pay requests. “This absence of strong verification allows spammers to exploit the system more easily,” he says.
Disclaimer:
The information contained in this post is for general information purposes only. We make no representations or warranties of any kind, express or implied, about the completeness, accuracy, reliability, suitability or availability with respect to the website or the information, products, services, or related graphics contained on the post for any purpose.
We respect the intellectual property rights of content creators. If you are the owner of any material featured on our website and have concerns about its use, please contact us. We are committed to addressing any copyright issues promptly and will remove any material within 2 days of receiving a request from the rightful owner.