New UPI fraud trend: Fraudsters spamming UPI IDs with multiple collect requests; one careless approval means money gone from bank a/c

The Unified Payment Interface, or UPI, has greatly simplified online payments with its QR code and UPI ID system. However, the downside is that scammers who have your UPI ID can flood you with collect money or autopay requests. If you mistakenly approve these requests, you'll end up paying the fraudster, enabling them to use your money for their purchases.

How easily the 'UPI collect money fraud' can happen

This scam operates on a simple principle-you are deceived into believing a false story or are caught off guard and approve an unknown UPI collect money or autopay request. You might wonder why you would approve such unfamiliar requests. The reason is that you may not be able to distinguish between a genuine request and a fraudulent one. It's important to note that the collect money or autopay request itself is valid, but the person initiating these requests is a fraudster.

See the image below: It shows an autopay request for Netflix. Can you tell if this is a real request sent by Netflix for your account or if it is a request sent by fraudsters for their Netflix account? This is a real UPI Autopay request initiated by a fraudster from his/her Netflix account. So, if by mistake you end up approving this request thinking it is your own Netflix subscription, you will essentially pay money for the Netflix subscription of the fraudster. This is exactly how the fraudsters may attempt to rob you off your money if they know your UPI ID.

(The image above is shared by a user who does not use Netflix)

"UPI IDs are generally expressed as phone numbers followed by the UPI provider extension. This is exploited by scamsters. Phone numbers and details are soft targets since phone numbers are shared often and are quoted at multiple places - e-shopping, restaurants, malls, parking places and so on. Given that it's easy to crack UPI IDs, customers using the same for online and digital transactions need to be well aware of the risks. There have been a number of fraud cases in the past where customers have approved transactions thinking it's a receipt but have ended up transferring money from their account," says Vikram Babbar, Partner, EY Forensic & Integrity Services - Financial Services. He is also the chairperson of Association of Certified Financial Crime Specialists (ACFCS) India chapter.

A UPI user, who did not wish to be named, shares her experience: Over the past few weeks, she has been getting many UPI collect money and autopay requests from Netflix, Google Pay, etc in her Paytm account. However, none of these collect money or autopay requests have been initiated by someone she knows, and she does not have a Netflix subscription or a Google Pay account.

The image below, shared by the user, shows real UPI collection money requests received from unknown people.

"Since UPI IDs are essentially an extension of phone numbers, they can be easily duplicated or generated in various formats. This makes it simple for spammers to create multiple fake IDs and bombard users with requests," says Sheetal R Bhardwaj, executive member of ACFCS MENA chapter.

What should you do to prevent this fraud from happening with you?

"Senior citizens are vulnerable to frauds and are considered as "mule accounts". They should avoid direct linkage of their bank accounts to the UPI ID and use a wallet with limited balance. This will help avoid high value frauds. They should consult family members in case of any suspicion," says Babbar from EY India.

Babbar informs that UPI service providers have themselves taken additional measures to create customer awareness. "In some cases, for example, high value transactions outside the normal pattern, customers are warned before entering the UPI PIN that it is a payment transaction and not a receipt transaction," he says.

Bhardwaj, shares some tips for senior citizens to safely use UPI:

• Higher Risk of Scams: Senior citizens may be less familiar with digital payment systems and the potential for fraud, making them more vulnerable to scams. So always verify the UPI address and double check with the intended recipient or service provider about the genuineness of it.
• Emotional Manipulation: Scammers often use emotional tactics, such as pretending to be a family member in distress. Seniors may be more likely to respond to these manipulative tactics, leading to potential financial loss. Stay aware of these tactics and do not give in to such requests.
• Education and Awareness: It is crucial for seniors to be educated about the risks associated with UPI transactions and to understand how to recognize legitimate requests. Encouraging them to consult trusted family members or friends before accepting such UPI requests can also help.

"Many seniors may not have immediate access to technical support or resources to help them verify suspicious requests. This can leave them isolated and more vulnerable. As people age, they may experience cognitive changes that affect their ability to critically analyse requests. This can lead to a higher likelihood of mistake or oversight when assessing the legitimacy of a transaction," says Bhardwaj.

What experts suggest the government and other companies do

According to Shobhit Goyal, Founder & CEO, BeFiSc, "NPCI should create or mandate any UPI wallet to create a layer of security for sending Autopay requests. UPI ID should not have 10-digit mobile number, instead they can add name or initials of name so auto generation of UPI ID can be stopped. There can be multiple other technical solutions, but the point is NPCI should acknowledge and start considering this as a big problem to resolve. Unfortunately, there is no service available if users want to disable autopay requests permanently though they can decline the request. NPCI should come up with this feature."

Bhardwaj informs that many UPI platforms may not have stringent measures to verify the authenticity of collect money or autopay requests. "This absence of robust verification allows spammers to exploit the system more easily," she says.