From Digital Arrest to UPI Traps: Inside India’s rising digital payment scams 

Digital payments were designed to simplify life. With a tap, scan, or swipe, money moves faster than we imagined. But the same convenience has opened a new arena for fraudsters. In less than a decade, India has become one of the world’s fastest-growing digital payments markets. With UPI, mobile wallets, and instant net banking, transactions have been made simpler and accessible to millions. However, this convenience comes with the threat of online payment fraud. 

Cybercriminals are now exploiting behavioural shortcuts and exploiting user trust through social engineering techniques, turning everyday digital interactions into potential traps like phishing, fake merchant apps, and SIM swaps to deceive even the most vigilant users. As India increases its reliance on online payments, it becomes essential to create awareness against evolving scams. 

Evolving digital fraud

Scams are not new. For years, fraudsters used deception to manipulate individuals into handing over money or sensitive information. Traditionally, scams involve persuading victims to willingly make payments under pretenses, whether through fake investment schemes, nonexistent e-commerce sites, or fabricated romantic relationships. 

But scams now occur when victims unknowingly give fraudsters access to their accounts by sharing login or card details. Advances in artificial intelligence (AI), generative technology, and automation have lowered the entry barrier for cybercrime. AI tools can instantly generate millions of personalized phishing emails, fake websites, and fraudulent messages. Digital arrest is becoming the latest form of psychological cybercrime where fraudsters impersonate law-enforcement agencies, threaten victims through video calls, and extort money under fabricated accusations. Once a victim clicks a link or responds to a call, fraudsters guide them toward sharing personal information or logging into a fake webpage designed to steal credentials. 

According to a report, nearly twenty lakh cybercrimes were reported in 2024, and the Indian Cybercrime Coordination Centre (I4C) predicts losses may exceed INR 1.2 lakh crore this year. Let’s discuss some scams that dominate the landscape:

1. UPI scams: Fraudsters send “request money” alerts using excuses like refunds, prize winnings, or emergencies. Fake QR codes are also widely used to scan them and debit money instead of crediting it. Many users still assume that QR codes work only for receiving payments, making them easy targets.

2. Fake merchant or payment apps: Lookalike apps imitate popular platforms such as Google Pay or PhonePe. They steal sensitive information and often appear in unofficial app stores or misleading ads. Verifying the app developer and downloading only from trusted stores is imperative.

3. Phishing via SMS, email & WhatsApp: Deceptively crafted messages mimic banks, government agencies, or payment providers. They lead users to fake login pages where credentials are compromised with one click.

4. Fake / Dubious Payment Pages : Fraudsters create lookalike payment pages to trick users into entering card details, OTPs, or UPI PINs. They use compromised payment details for unauthorized purchases or to exploit vulnerabilities in payment systems. 

5. Merchant Onboarding Scams: Scammers pose as legitimate merchants and onboard with fake documents to process fraudulent transactions or launder money through the payment gateway. Common scams include identity theft to pose as a legitimate business, bust-out fraud where accounts are used to make fraudulent purchases before disappearing, and transaction laundering to hide the high-risk nature of their operations.

6. Digital arrest: In this scam, victims receive calls, mostly video chats, from fraudsters posing as law enforcement  officers, ,. They are told they are being investigated for crimes such as money laundering, drug trafficking, or tax fraud. The scammers then coerce them into transferring funds with the assurance of getting a clean chit. The scale of this crisis is staggering. Data from the National Cybercrime Reporting Portal (NCRP) reveals that 39,925 such cases were reported in 2022, involving losses of INR 91.14 crore. By 2024, this number had surged to 1,23,672 cases, with reported losses ballooning to INR 1,935.51 crore. 

How to stay safe

Safety in the digital payments era starts with understanding how fraudsters use human vulnerability. Scammers lure users with offers of unrealistic returns, persuade them to click on dubious websites and share personal details, or even use intimidating tactics by impersonating authorities to create panic. Such fear-driven manipulation has increased digital arrest scams, where victims have been compelled to transfer money by being threatened with legal action. This calls for awareness and a combination of good proactive digital habits to protect oneself. 

If you receive a suspicious call, message, or video chat; disconnect and contact your bank or report it on the National Cyber Crime Reporting Portal immediately. 

Enhance your digital hygiene by enabling two-factor authentication, not clicking on unsolicited links, regularly monitoring your bank statements, and using strong, unique passwords that you change frequently. Further, many leading payment security providers offer risk-based authentication, multi-layered security and AI-powered fraud detection to ensure secure online payments. 

Educate yourself with the communication only from reliable sources such as official bank websites and merchant websites, verified customer support helplines and emails, etc. 

In summary, India's digital economy is a global success story, but it has paved the way for cybercriminals to play with human vulnerabilities. It is now essential for consumers to remain vigilant and informed in their approach to digital payments. With scammers becoming more sophisticated, digital awareness and responsible usage are the only ways to develop a strong digital payment ecosystem.

The author is Chief Risk Officer, PayU