UPI Fraud Prevention for Merchants: Fake Screenshots, QR Swaps and Collect Request Scams

UPI is now the default way Indians pay shops, restaurants and small businesses. In September 2026 it processed 24.07 billion transactions worth Rs 29.37 lakh crore, an average of more than 800 million a day. Most UPI safety advice is written for the person paying. Merchants are targeted too, and the scams aimed at them work differently.

This guide covers the UPI frauds that target sellers, how to confirm that money has actually reached your account, which NPCI rule changes help, and what to do if your business is hit.

Quick answer: Most UPI fraud against merchants relies on fake proof of payment or a swapped payee. Never hand over goods based on a screenshot, a payer’s phone screen or a sound alone. Confirm every payment in your bank app, payment app or merchant dashboard, and match the UPI reference number for larger amounts. Use dynamic QR codes where you can, check printed QR stickers daily, never enter your UPI PIN to receive money, and treat any request to return an “extra” payment as a likely scam until the credit shows in your bank statement.

How big is UPI fraud in India?

The Ministry of Finance gave Parliament the following figures for UPI fraud in December 2025:

Fraud is small relative to total UPI value, but it is concentrated on individuals and small businesses who have no fraud team. A single fake payment of Rs 20,000 at a jewellery shop or an electronics store can wipe out a week’s margin.

What are the most common UPI scams targeting merchants?

Fake payment screenshots and spoof payment apps

The customer shows a screen that looks like a successful payment in a popular UPI app, or sends a screenshot on WhatsApp. The screen is fake, edited or generated by a spoof app that copies the look of the real one, including the tick mark and the amount. In November 2025, Kochi police arrested five people who used a fake UPI app at shops and hotels.

These scams work because staff are busy and the screen looks familiar. The defence is procedural: the only proof that counts is a credit in your own account.

Fake confirmation sounds

Payment soundboxes announce each credit aloud, and many shops rely on that announcement. Police in Hyderabad warned in 2025 that fake apps were producing false payment confirmations that sounded like real alerts. The exact method varies and is not well documented, so treat any audio alert as a convenience, not as proof. If the amount is significant or the customer is in a hurry, check the app or dashboard as well.

QR code sticker swaps

A fraudster sticks their own QR code over the shop’s printed code, so customers pay the fraudster without either side noticing. In January 2025, QR codes at 10 to 12 shops in Khajuraho, Madhya Pradesh, were replaced overnight. It came to light when a customer noticed that the payee name shown in the app had changed.

The same thing can happen from inside the business. In a case registered in Goa in March 2026, a pharmacy employee allegedly replaced the shop’s QR code with her own and diverted about Rs 49.68 lakh over several years. Our guide to QR code payment scams covers related tricks, and our article on insider threats explains why staff access needs the same controls as outside attackers.

Overpayment and “sent by mistake” refund scams

The fraudster claims to have paid more than the bill, often with a fake screenshot as proof, and asks for the difference back. In a case reported from Alappuzha, a caller sent a screenshot showing Rs 10,000 more than a hotel advance and asked for the excess. The owner checked the bank statement, found no such credit, and refused.

A newer variant sends a real but small amount and then pressures the merchant to “return” a larger sum, or to return money through a link or QR code that is actually a payment request. SBI issued an advisory on this pattern in October 2026. The rule is simple: only refund against a credit you can see in your statement, back to the same account, for the same amount. Our guide to refund fraud covers wider refund abuse.

Collect request scams

In the classic version, a “buyer” sends a UPI collect request, a request for the seller to pay, and tells the seller to enter their UPI PIN to receive the money. Entering the PIN approves a payment out of the seller’s account. This was common with online sellers on classifieds sites.

NPCI stopped person-to-person collect requests on UPI from 1 October 2025, which removed the main route for this scam. Collect requests from verified merchants continue, and fraudsters now use QR codes or payment links that ask the victim to “scan to receive”. The underlying rule has not changed: you never need to scan a code or enter your PIN to receive money. A UPI PIN only ever authorises money leaving your account.

Payments from mule accounts and account freezes

Some merchants are hurt by fraud that did not target them. Money stolen from a victim is spent at a shop, and when police trace the funds, the shop’s bank account can be frozen. In July 2026 the Andhra Pradesh High Court ordered a bank to unfreeze a wine shop’s account, frozen over a Rs 1,000 payment from an accused, holding that a vendor cannot be expected to verify the background of a UPI customer. Courts have also said banks should not freeze an entire account when police have asked for a specific amount to be held.

A merchant cannot screen every customer, but keeping clean records of each sale makes it much easier to show that a payment was a genuine purchase.

How do you verify that a UPI payment was received?

Different signals carry very different levels of trust:

For larger amounts, match the UPI transaction reference number shown on the customer’s app with the reference in your own app or bank statement. If the customer cannot wait, hold the goods until the credit appears. Real UPI payments usually settle within seconds, so a customer who insists on leaving before your app updates is a warning sign.

Static or dynamic QR: which is safer?

A static QR code is printed once and the customer types in the amount. A dynamic QR code is generated for each bill with the amount already filled in, usually on a billing screen, payment terminal or soundbox display.

• Dynamic QR codes are harder to swap because they are shown on a screen for one transaction, and the fixed amount removes typing errors and “I paid less by mistake” disputes.
• Static QR codes are cheap and work everywhere, but a printed sticker can be covered without anyone noticing.

If you use static codes, check them at opening and closing each day, keep a photo of the genuine code, and use tamper-evident lamination or a stand that sits behind the counter. Teach staff and regular customers to check the payee name shown in the app before paying.

Which NPCI rule changes help merchants?

Several changes since mid-2025 have closed common routes for fraud:

• Verified payee names. Since 30 June 2025, UPI apps must show the account holder’s name from the bank’s core banking system, not a name stored in the QR code or typed by the user. A swapped QR code now shows the fraudster’s real account name, which alert customers can spot.
• No more person-to-person collect requests. From 1 October 2025, P2P collect requests are no longer processed. Merchant collect requests continue for verified merchants.
• Limits on status checks. Since 1 August 2025, apps can check a transaction’s status at most three times, 90 seconds apart, which reduces the “pending payment” confusion fraudsters exploit.
• Higher limits for some merchant categories. Since 15 September 2025, payments of up to Rs 5 lakh per transaction are allowed in categories such as insurance, capital markets, travel, credit card bills and jewellery. Merchants in those categories handle larger tickets and should verify every high-value credit in the bank account.

Banks also use MuleHunter.AI, a model from the Reserve Bank Innovation Hub that flags suspected mule accounts. Twenty-three banks were using it by December 2025.

What should you do if your shop is hit by UPI fraud?

• Call the national cyber fraud helpline 1930 or file a complaint at cybercrime.gov.in as quickly as possible. Fast reporting improves the chance that funds can be held before they move on.
• Inform your bank and your payment app or aggregator, with the transaction reference, time, amount and any screenshots or messages the fraudster sent.
• For a failed or disputed transaction, raise it through the in-app dispute option, which uses NPCI’s UDIR system. Under RBI’s turnaround time rules, a UPI merchant payment debited from the customer but not confirmed to the merchant must be reversed by T+5, and a failed fund transfer by T+1, with compensation of Rs 100 a day after that.
• Report suspicious calls, SMS or WhatsApp messages through Chakshu on the Sanchar Saathi portal.
• If your bank does not resolve a complaint within 30 days, you can escalate to the RBI Ombudsman at cms.rbi.org.in.
• If your account is frozen, ask the bank in writing for the police reference and the amount involved, and raise a grievance with the investigating officer. A written record matters if the matter goes further.

Our payment fraud response plan explains how to prepare these steps before you need them.

UPI fraud prevention checklist for merchants

• Confirm every payment in your own app, dashboard or bank account. Never accept a screenshot.
• For payments above a set amount, match the UPI reference number before handing over goods.
• Use dynamic QR codes at the counter where possible.
• Check printed QR codes daily against a photo of the genuine code.
• Never scan a QR code or enter your UPI PIN to receive money.
• Refund only against a credit visible in your statement, to the original account, for the original amount.
• Give each staff member their own access to the merchant app, and remove it the day they leave.
• Reconcile UPI credits with sales daily so that diverted payments show up quickly.
• Keep 1930 and your bank’s fraud contact on display for staff.
• Train staff on these scams, including new ones like the small-credit refund trick.

For a wider view of fraud on instant payment systems, see our guides to real-time payments fraud and authorised push payment scams.

Frequently asked questions

Can a UPI payment screenshot be fake?

Yes. Screenshots can be edited, and spoof apps can show a convincing success screen without sending money. Only a credit in your own account confirms a payment.

Do I need to enter my UPI PIN to receive money?

No. A UPI PIN is only used to send money or approve a debit. Anyone asking you to enter your PIN or scan a code to receive money is attempting fraud.

Are UPI collect requests still allowed?

Person-to-person collect requests stopped on 1 October 2025. Verified merchants can still send collect requests to customers for purchases.

Is a soundbox announcement enough proof of payment?

For small, routine payments it is usually reliable, but fake apps have imitated confirmation sounds. For large amounts, check the merchant app or bank account as well.

What should I do if someone says they paid me extra by mistake?

Check your bank statement. If the credit is there, refund only that amount to the same account through your bank or payment app. Do not send money to a different number, scan a QR code sent by the payer, or click a refund link.

Is a dynamic QR code safer than a static one?

Yes, for most counters. A dynamic code is generated per bill with the amount filled in, so it is harder to swap and reduces amount errors.

Where do I report UPI fraud?

Call 1930 or file a complaint at cybercrime.gov.in, and inform your bank and payment app at the same time. Use the RBI Ombudsman if your bank does not resolve the complaint within 30 days.

Can my account be frozen if a customer paid with stolen money?

Yes, banks sometimes freeze accounts when police trace stolen funds. Courts have said vendors cannot be expected to verify customers’ backgrounds, and that freezes should be limited to the amount involved. Keep sales records and respond in writing.