Cyber-criminals target UPI payment system

Sanjay Kumar is a Delhi-based professional who does not consider himself very tech-savvy. But when he wanted to put up a refrigerator for sale, he turned to a classifieds site advertises heavily on TV, urging people to get rid of their superfluous goods.

Within hours of putting up the ad, he was contacted by an ‘interested buyer’, who first negotiated the price down. He then asked Kumar if he could receive money using UPI, whether he had a UPI ID and so on.

Realizing that Kumar did not seem to be very familiar with the payment platform, the ‘buyer’ moved to the next stage. He said he would like to pay in advance, and urged Kumar to create a UPI account on Google Pay, a popular platform.

Kumar did so, and shared his UPI ID with the buyer.

In Kumar’s own words: “Then he said – ‘I’m sending you some money, you please click on ‘yes’ to accept’. Sure enough, I saw a prompt on my app immediately, and I clicked on ‘yes’ and entered my PIN number.”

What the cyber criminal did was to send a ‘collect request’ to Kumar’s UPI ID. Kumar, who wasn’t familiar with the finer details of how UPI worked, clicked on ‘yes’ to the collect request, and the amount was transferred from his account to that of the criminal.

This process was repeated several times, but due to Kumar’s fumbling, only two transactions could go through. In the end, Kumar lost Rs 5,000 in the whole ordeal.

As indicated by the UPI ID, the person who received the money was using Paytm (see photo).


If what happened online was unfortunate, what happened when Kumar tried to register a complaint was enraging.

Kumar first dialed police complaint number 8800199955 for NOIDA.

“The helpline guys told me that I have to go and register this at the cyber crime office at the UP Police SSP office at Surajpur.”

So instead of going to work, Kumar went to the SSP Office today morning.

“They said, cyber crime division does not take cases directly. You have to register at your the [NOIDA] Phase 2 police station.”

Kumar soon reached the police station.

“There, one officer told me that they don’t take complaints directly. I have to go through the local chowki (outpost). Another lady said, this police station is not equipped to receive cyber-cell complaints, and I should register the complaint at Sector 24 police station.”

“By then, I realized that it was impossible to get the case registered. I know Sector 24 station would tell me to go back to Sector 22 as my residence comes under Sector 22’s jurisdiction. I also know that complaints police outposts are not where you register FIRs about such matters,” he adds.

Interestingly, the person who received the money continues to be available on the phone number. “I spoke to him today morning. He seemed perfectly chilled out.”

Kumar also called ICICI Bank to complain.

“Even before I finished my narrating the details, the lady completed it for me. She said there have been many such cases,” he says.

More than getting the Rs 5,000 back, Kumar is worried about all the others who are being cheated by such unscrupulous elements.

“In my case, I know people in the government who can help me track this case, but what about ordinary people? Where will they go,” he asks.

PS: We have asked PayTM if there is any way to get more information about the recipient of the amount. We shall update this story if we hear from them.