The National Payments Corporation of India suspended 14,200 UPI handles tied to fraudulent Diwali coupon and cashback sites that lured users into approving high-value collect requests, the largest single festive-season enforcement action the retail payments switch has disclosed, according to an advisory circulated to member banks on Wednesday.
How the scam worked
Attackers advertised limited-time gift vouchers on social media and messaging apps, directing victims to cloned brand pages. After a small "verification" payment, users received collect requests labelled as refunds or prize credits that actually drained accounts when approved. Many handles rotated through payment service providers within hours, exploiting onboarding gaps before risk scores updated.
NPCI's fraud team clustered transactions by device fingerprint and beneficiary account graphs, then shared hot lists with banks for account freezes. CERT-In concurrently flagged more than 180 phishing domains mimicking major retailers.
Bank and wallet response
Large private banks pushed in-app warnings when users opened collect requests from unknown handles. PhonePe and Google Pay said they accelerated manual reviews for merchants whose names contained festival keywords. Cooperative banks in Gujarat and Uttar Pradesh reported upticks in helpline calls from shopkeepers whose personal QR stickers were spoofed in printed flyers.
User protection steps
NPCI reiterated that legitimate cashback never requires approving inbound collects from strangers. Customers should verify merchant names inside the official app, disable collect notifications when not shopping, and set default UPI transaction limits ahead of festival spending spikes.
Policy context
The RBI has been tightening payment-aggregator oversight and pushing banks to rotate fraud hotline numbers. Wednesday's action shows the switch operator willing to publish scale metrics—a shift from earlier years when handle counts stayed confidential. Payment lawyers expect follow-on penalties for acquirers that onboarded repeat offenders.
What merchants fear
Legitimate kirana stores running festival promotions worry that aggressive filtering will block their newly issued dynamic QR codes. NPCI said whitelisting remains available for documented campaigns, but requires sponsor-bank attestations—a paperwork burden small traders dislike.
Outlook
Enforcement will continue through November as scam templates shift from coupons to fake electricity bill discounts. For consumers, the practical lesson is unchanged: if a Diwali deal needs you to approve a collect request to a personal handle, it is not a deal.
Reporting channels
Banks asked customers to use in-app dispute flows rather than social-media threads that scammers monitor for follow-up phishing. NPCI said aggregated weekly handle statistics will publish on its transparency page starting mid-October so researchers can track seasonal fraud waves.