The UPI ‘Wrong Transfer’ Scam: How It Works

The Setup: A Surprise Credit You Did Not Ask For

You receive a UPI notification: Rs 2,000 has been credited to your account. Moments later, a caller introduces themselves as a businessman from another city. They sound flustered and apologetic. They explain they were trying to pay a supplier and accidentally typed your UPI ID. They ask you to please send the Rs 2,000 back right away.

So far this sounds like an honest mistake that deserves a helpful response. That reaction — the impulse to do the right thing — is exactly what the fraudster is counting on.

How the Scam Actually Works

The money in your account is not an innocent mistake. There are two common ways it arrives:

• Stolen-account transfer: The Rs 2,000 was sent from a bank account belonging to another victim, compromised earlier through phishing or SIM-swap fraud. You are an unwitting intermediary.
• Reversible-credit trick: In some variants the credit appears genuine but will be reversed by the payment system after you have already sent your own real money.

When you ‘return’ the money, you typically send it to a mule account or a different UPI ID entirely — not the original source. The scammer collects your real money, then sometimes claims you sent too little and asks for more.

Why You Are Not Required to Return Money This Way

Under standard NPCI UPI guidelines, a payer who sends money to the wrong beneficiary files a dispute through their own bank or app — the payer’s bank then contacts your bank formally. You are never required to manually transfer money back to a stranger who calls you. A real wrong-transfer situation requires no action from you at all.

Warning Signs

• An unexpected credit is immediately followed by a phone call.
• The caller is in a hurry and creates urgency: ‘My supplier is waiting,’ ‘I will lose the deal.’
• They ask you to send money to a different UPI ID than the one that credited you.
• They ask you to scan a QR code to ‘confirm the return’ — scanning a payment QR sends money out.
• They ask you to approve a ‘collect’ request, which again debits your account.
• After a small return, they call again asking for a larger amount.

What to Do if You Are Targeted

1. Do not transfer any money — no matter how convincing the story.
2. Do not share your UPI PIN or OTP, and do not scan any QR code from the caller.
3. Screenshot everything: the credit notification, the caller’s number, any messages.
4. Call your bank to flag the incoming transaction.
5. File at cybercrime.gov.in or call 1930. Karnataka residents can also contact the Karnataka State Police CEN Cell.
6. If you already sent money, report to 1930 within the hour — banks have a better chance of freezing mule accounts quickly.

A Note on QR Codes and ‘Collect’ Requests

In UPI, scanning a payment QR always results in money leaving your account, and approving a ‘collect’ or ‘pay’ request requires your PIN to authorise a payment from you. There is no UPI mechanism by which scanning a code or approving a request causes money to arrive. If someone tells you otherwise, they are lying.