UPI Fraud Wave Hits Thousands as New “Ghost Request” Scam Sweeps Across India

India’s Most Trusted Payment System Hit by a New Wave of Cybercrime

United Payments Interface (UPI) has long been celebrated as India’s digital payments revolution—fast, secure, and accessible. But over the past month, UPI users across the country have reported a sudden explosion of cyber scams unlike anything seen before. Police departments from Delhi to Bengaluru, Gurugram to Hyderabad, and Lucknow to Kochi have registered hundreds of First Information Reports (FIRs) linked to what investigators now call the “Ghost Request Scam.”

At its core, the scam exploits two weaknesses: user trust and advanced AI-powered impersonation tools. Criminals send fake “Collect Request” notifications, QR codes disguised as refunds, and voice-cloned calls pretending to be bank officials. Victims approve what they believe are legitimate requests—only to watch their bank accounts empty within seconds.

₹312 Crore Lost in Just 45 Days

A consolidated report from national cybercrime coordination units estimates that Indians have lost **₹312 crore between mid-October and 1 December 2025**. Officials warn that this figure may be much higher, as many victims do not file complaints out of fear, embarrassment, or helplessness.

The highest number of incidents were reported in:

• Mumbai Metropolitan Region
• Bengaluru urban zones
• Gurugram and Noida corporate corridors
• Tier-II cities such as Indore, Jaipur, Nagpur, and Surat
• Rural clusters using low-budget smartphones

Banking institutions have also flagged unusual transaction patterns, prompting urgent internal audits.

How the “Ghost Request” Scam Works

Cyber officers break down the scam into three stages:

1. The Fake Collect Request

Victims receive a UPI “Collect Request” notification that appears identical to official app requests. The alerts often cite:

• Refund of a cancelled order
• Security deposit return
• Cashback from a shopping platform
• Verification incentive

The amount is typically small—₹2 to ₹40—creating a false sense of safety.

2. AI-Generated Voice Spoofing

Within minutes, the victim receives a phone call from a voice that sounds exactly like a customer-care agent or even a bank relationship manager. Investigators confirm that scammers are using real-time voice-cloning AI tools downloaded from dark-web markets.

The caller urges the user to:

• “Approve the request to complete the refund”
• “Verify your UPI to avoid account suspension”
• “Click the link sent to you for KYC update”

Once approved, large amounts are transferred through layered accounts.

3. QR Code Manipulation

Some scammers send QR codes labeled “Refund QR,” “Cab Overcharge Return,” or “Delivery Fee Reversal.” Scanning these codes initiates a “Pay” request, not a “Receive” request—draining the victim’s account instantly.

Corporate Employees Among Top Targets

Cyber teams report that corporate workers are highly vulnerable due to frequent online payments, food deliveries, ride-hailing applications, and reimbursements.

In one major case reported in Gurugram, a 29-year-old tech employee lost ₹9.7 lakh after approving multiple fraudulent requests disguised as “salary bonus reconciliation.”

In Bengaluru, scammers cloned the voice of a delivery agent to trick an employee into authorizing a “return pickup deposit refund.”

Elderly Victims Hit Hardest

Senior citizens, who often depend on digital payments without full understanding of its rules, remain the most vulnerable group. Police registered over 900 cases involving citizens over the age of 55 in the past month alone.

Many were tricked through:

• Fake “bank verification” calls
• Fraudulent electricity bill payment warnings
• Medical insurance refund scams

Families are now urging banks to introduce special safety features for elderly users.

AI Makes Scams Frighteningly Convincing

What makes the new fraud wave particularly dangerous is the use of advanced AI systems:

• Voice cloning in under 15 seconds
• Deepfake audio messages
• Spoofed customer-care helplines
• Simulated bank interfaces
• AI chatbots posing as support agents

Investigators say the scams no longer resemble amateur phishing attempts—they now mimic professional call-center workflows.

RBI Issues Emergency Security Advisory

In response to rising losses, the Reserve Bank of India released a nationwide advisory urging users to:

• Never approve a UPI Collect Request from unknown persons
• Never scan QR codes sent by strangers
• Verify customer-care numbers only from official bank websites
• Enable UPI transaction limits
• Activate device-level security and biometric locks

Banks have also been instructed to strengthen fraud-monitoring systems and expedite dispute-resolution processes.

Police Crackdowns: 42 Arrested in Multi-State Raids

Cybercrime task forces conducted raids across Delhi, Gurugram, Faridabad, Noida, Ranchi, Pune, and Hyderabad, arresting 42 individuals linked to organized scam networks.

Seized materials include:

• 417 SIM cards
• 82 mobile phones
• Fake KYC documents
• UPI mule accounts
• QR-code templates

One syndicate operating from Jamtara reportedly handled over 10,000 calls per month.

Fintech Companies Introduce New Anti-Fraud Features

Leading UPI apps have announced immediate feature updates:

• Stricter warnings for Collect Requests
• Pop-up alerts when scanning suspicious QR codes
• AI-based fraud scoring
• Mandatory cooling period for first-time payees
• 24×7 emergency support buttons

Fintech analysts say these changes will significantly reduce instant-approval fraud scenarios.

Economic Impact: Trust in Digital Payments Tested

While UPI handles over 1,200 crore transactions monthly, the recent fraud wave has shaken public confidence. Consumers in Tier-II towns are especially hesitant, with some returning temporarily to cash transactions for safety.

Economists warn that if unchecked, cybercrime could undermine India’s globally admired digital-payments ecosystem.

Case Study: A Startling 18-Second Heist

In one of the fastest recorded cases, a 32-year-old app developer in Mumbai lost ₹72,000 in 18 seconds after scanning a QR code emailed from what appeared to be a legitimate e-commerce refund team.

The QR code redirected to a payment gateway configured to auto-withdraw funds through layered UPI chains.

Legal Challenges: Cybercriminals Move Across Borders

Several scam operations are suspected to run from neighboring countries using VoIP masking, making detection and extradition difficult. Enforcement agencies are now in talks with Interpol and regional cyber units for joint operations.

What Citizens Can Do to Stay Safe

Authorities recommend the following:

• Disable auto-pay approvals
• Use app-level fingerprints instead of PINs
• Verify every transaction twice
• Keep UPI limits low unless necessary
• Immediately report fraud to 1930 (National Cyber Helpline)

Users are also advised to avoid clicking links sent via SMS or WhatsApp.

Conclusion: India Must Brace for Smarter Cybercrime

The ongoing UPI fraud wave demonstrates how rapidly cybercriminals evolve, using new technologies to exploit trust, confusion, and digital dependency. While India leads globally in fintech innovation, the coming years will require stronger safeguards, legal frameworks, and public awareness to prevent financial crimes of growing sophistication.

For now, vigilance remains the only reliable defence as law enforcement races to contain a scam model that has already cost thousands their hard-earned money.