Reserve Bank ombudsman offices logged a sharp rise in September complaints about borrowers tricked into entering UPI PINs at counterfeit loan-settlement counters, a scam pattern that consumer groups warn will intensify as Vijayadashami shopping and year-end EMI deadlines collide.
How the fraud works
Victims typically receive WhatsApp or SMS messages claiming their personal loan or credit-card delinquency can be waived for a one-time "processing fee." Callers posing as bank recovery agents send a collect request or QR code labelled as a settlement receipt. When the borrower enters a UPI PIN thinking they are authorising a small charge, the app debits a much larger sum to a mule account.
Ombudsman summaries reviewed by banking lawyers show many complainants are salaried workers in tier-two cities who fell behind after festive spending in 2025. Fraudsters exploit the shame associated with default, pressuring targets to act before a fictional "legal notice" arrives.
Why regulators are alarmed
Unlike card chargebacks, authorised UPI pushes are harder to reverse once money leaves within minutes. The NPCI's dispute window still exists, but success rates drop when customers admit they entered a PIN voluntarily, even under deception.
The RBI's consumer education cell reissued guidance on Monday reminding users that no legitimate lender demands PIN entry to "verify" identity. Settlement discussions belong on registered helplines printed on bank websites, not Telegram channels.
Bank and fintech defences
Several lenders now flag first-time payees above ₹50,000 with additional friction, and wallet apps have expanded warnings when a collect request description includes words such as "foreclosure" or "CIBIL repair." These measures are voluntary, leaving gaps between institutions.
Payment aggregators must file weekly fraud telemetry with NPCI under October compliance rules, which should help map mule accounts faster. Cyber police in Maharashtra and Karnataka said they are freezing accounts within six hours when banks share IOC hashes quickly enough.
What borrowers should do
If contacted about settlement, hang up and dial the number on the back of your card. Ask for a written foreclosure quote with loan account numbers matching your statements. Never scan QR codes sent by unknown numbers.
Victims should file complaints on the National Cyber Crime Reporting Portal and alert their bank within minutes, even if embarrassment makes delay tempting. Ombudsman data suggest recovery odds fall sharply after 24 hours.
Policy horizon
Consumer advocates want mandatory cooling periods for first-time large UPI debits to new beneficiaries, similar to NEFT high-value holds. Banks resist friction that could slow legitimate merchant payments during Diwali.
Until rules change, the best defence is treating UPI PINs like ATM pins: enter them only when you initiated a payment you understand. The ombudsman's rising caseload shows that lesson is still expensive for thousands of households each month.