From buying morning tea at the local tapri to paying monthly house rent, digital payments using the Unified Payments Interface (UPI) have become a natural part of daily life for millions across India. But police cybercrime cells and online safety experts in major metros are issuing urgent warnings about a fast spreading cyber scam that preys directly on this digital habit fake UPI cashback apps and malicious download links designed to empty bank accounts before you even realize what happened.
The fraud usually starts with a random WhatsApp message, an SMS alert, or a sponsored social media ad promising guaranteed ₹500 instant cashback or exciting scratch card rewards on popular payment apps. When curious users click the link, they are taken to a fake web page or asked to install an unofficial app file (APK) that mimics trusted banking and wallet interfaces.
Once the user opens the fake app to claim their reward, a prompt asks them to scan a QR code or enter their confidential UPI PIN. Scammers rely on a very common public misunderstanding many people still do not know that entering a secret PIN is only required when sending money, never when receiving it or claiming cashbacks. The second the user enters their PIN, a hidden malicious script in the app automatically triggers a high value transfer, moving money out of their bank account and quickly routing it through shell accounts into untraceable cryptocurrency wallets.
As scammed citizens share their shocking stories across platforms like X and Reddit, cybersecurity professionals share one golden rule to stay safe: you never need to type your PIN to receive money. If an online reward demands your PIN, block the number immediately, it is a scam.
