UPI Scammer Checker: Check a UPI ID, Your Reporting Deadline and Your Complaint in One Place

What this checker can — and cannot — tell you

Let's be honest about one thing first, because your money depends on it. No website, app or "scammer database" can look at a UPI ID and tell you for certain whether the person behind it is honest. UPI IDs are created in seconds, fraudsters rotate through them daily, and the accounts behind them are often rented from people who have no idea what their account is being used for.

What a UPI ID can do is give itself away. Fraudsters need their IDs to look official, urgent or rewarding, and that pressure leaves fingerprints: a bank's name stitched to the word "help", a "refund" that asks you to pay, a broker who isn't using SEBI's validated handle, a handle that is one letter away from a real one. Those patterns are what this checker reads.

There is one official place to check whether an identifier has already been reported: Report and Check Suspect on cybercrime.gov.in, the Ministry of Home Affairs' database of phone numbers, UPI IDs, bank accounts and other identifiers that people have reported for cyber crime. Its entries come from public reports, so a clean result does not prove an ID is safe. Use it alongside this checker.

Everything you type on this page is processed inside your own browser. Nothing is uploaded, logged or stored — close the tab and it is gone.

Tool 1: Check a UPI ID or payment link for red flags

Paste the UPI ID you were asked to pay (for example name@bank), or the full payment link that a QR-code scanner shows you (it starts with upi://pay). The checker breaks it into parts and explains every warning sign it finds.

Have the QR code only as a picture — a screenshot from WhatsApp, or a photo of a sticker or poster? Give the picture to the checker below. It reads the code on your device, tells you whether it is a payment request, a website link or just text, and checks it the same way.

How to read the result

• High risk — do not pay. The ID or link contains a pattern that genuine banks, regulators and businesses do not use. Stop the conversation and verify through a number you find yourself.
• Be careful. Something is unusual — an unfamiliar handle, a bank name in the username, a QR code that opens a website instead of a payment. It may be harmless, but slow down and confirm the payee's name.
• No structural red flags. The ID is built the way normal IDs are built. That is not proof the payee is genuine; it means the warning signs we can see from the text are absent.

What the checker looks for

• Whether the text is a valid UPI ID at all: one @, a name made of letters, digits, dots, hyphens or underscores, and a handle made of letters and digits only.
• Whether the handle after the @ belongs to a well-known app or bank, is a near-copy of one (such as an extra letter or an added word), or is a SEBI validated handle.
• Words that impersonate authority (RBI, NPCI, SEBI, police, court, customs, Aadhaar), promise money (refund, cashback, prize, lottery), or fake a service desk (KYC, helpdesk, customer care) — including when they are glued together, like sbikycupdate.
• For upi:// links: the amount the link will ask you to pay, the payee name it claims, and notes such as "refund" that try to convince you money is coming in. A pre-filled amount on its own is normal on shop and bill codes, so it is flagged only when the code also pretends to send money to you.
• For QR codes that open a website: whether the link downloads an app file (.apk), hides where it leads behind a link shortener, or borrows a bank's name without being on the .bank.in domain that only regulated banks can register.
• For BharatQR merchant codes (the long codes that start with 000201): the UPI ID and amount stored inside, which then go through the same checks.
• Look-alike characters from other alphabets, which are invisible to the eye but change where money goes.

The handle list comes from official sources; the warning-word lists are our own, built from common fraud patterns, so treat them as an experienced second opinion rather than an official verdict.

What a QR code can hold, and what each kind means

A QR code is just text drawn as squares. The same pattern of dots can carry a payment request, a website address or a plain message, and you cannot tell which by looking at it. When you give Tool 1 a picture, it reads that text and sorts it into one of four kinds:

• A UPI payment request (upi://pay?…). Scanning it in a UPI app and entering your PIN sends money from you to the UPI ID inside it. The amount may already be filled in — on shop and bill codes that is normal. What is never normal is being told that scanning will put money into your account: a QR code can only take money out.
• A BharatQR merchant code (a long string that starts with 000201). This is the shared format behind many shop-counter codes, readable by UPI and card apps alike. The checker pulls out the UPI ID, the merchant name and any amount, and checks the UPI ID as above.
• A website link (https://…). This is not a payment at all: it opens a web page, which can be a copy of a bank's login page, just like a link in a fake SMS. An Indian bank's own website now ends in .bank.in, a domain that only regulated banks can register. Even so, the safest habit is to open your bank's app or type its address yourself; our guide to phishing links and look-alike addresses shows how to read any web address.
• Plain text, such as a phone number or a message. Reading it moves no money; treat any instruction in it the way you would treat a message from a stranger.

The picture never leaves your phone or computer. The checker reads it with your browser's built-in QR reader where there is one, and otherwise with jsQR, an open-source reader served from this site. Nothing is uploaded, and the picture is gone when you close the tab.

How a UPI ID is built — and why it can't prove who you're paying

A UPI ID (also called a Virtual Payment Address, or VPA) has two halves joined by an @. Understanding each half takes the mystery out of every "official-looking" ID a fraudster sends you.

The name before the @

This part is usually chosen by the account holder or generated by the app — a mobile number, a name, a shop name or a random string. Anyone can type almost anything here, subject to the app's availability check. That is the whole problem: sbi.helpdesk, rbi.refund or customs.clearance are just letters someone typed. They give the owner no connection to the bank, regulator or department they name.

The handle after the @

The handle identifies the app and bank that issued the ID — the "payment service provider". It is a short, fixed word such as ybl or okaxis. Handles are not invented by users; each one belongs to a bank partnered with an app, under the National Payments Corporation of India (NPCI), which runs UPI. So a handle tells you which app created the ID, never who owns it.

Checked against NPCI’s list of third-party UPI apps, SEBI’s list of UPI apps and the apps’ and banks’ own help pages in October 2026. Apps keep adding bank partners, so new handles appear; Tool 1 recognises 76 confirmed handles.

Why a convincing ID proves nothing

Because the name half is free text and the handle only names an app, a perfectly ordinary ID can belong to a fraudster, and an odd-looking random ID can belong to the honest tea stall on your street. The checker catches the IDs that over-reach. The payee name in your app — fetched from the receiving bank — is what confirms the rest.

SEBI's @valid handles: paying a broker or mutual fund safely

Fake trading apps and "SEBI-registered" WhatsApp advisers are behind some of the biggest UPI losses in India. SEBI's answer is a special UPI ID that only registered intermediaries can get. Since 1 October 2025, every SEBI-registered intermediary that collects money from investors — stock brokers, mutual funds, investment advisers, research analysts, portfolio managers and others — must offer one. Using UPI is your choice; but if you do pay an intermediary by UPI, SEBI requires that payment to go to its validated ID.

The structure of a validated handle

A validated ID has three parts: a readable name, a short category code, and a handle that joins @valid to the name of the intermediary's bank. SEBI's own examples are abc.brk@validhdfc for a stock broker and xyz.mf@validicici for a mutual fund. Real IDs sometimes carry an extra segment in the middle, but the category code always sits just before the @. The handle is never a bare @valid: SEBI's circular describes it as "@valid" combined with the bank's name, allocated by NPCI. Handles confirmed in use include @validhdfc, @validicici and @validaxis; more than 50 banks are eligible, so you may meet others.

The green thumbs-up and SEBI Check

When you pay a validated ID, your UPI app shows a white thumbs-up inside a green triangle on the confirmation screen, and the intermediary's QR code carries the same icon. SEBI says the absence of that icon should warn you that you may be paying an unauthorised entity. To double-check, use SEBI Check at siportal.sebi.gov.in or in the SEBI Saarthi app. Type the UPI ID, scan the QR code, or enter a bank account number with its IFSC, and SEBI Check tells you whether it belongs to a SEBI-registered intermediary.

In August 2026 SEBI went a step further and asked intermediaries to link every bank account that collects money from individual investors to a @valid ID, so that SEBI Check can confirm the account even when you pay by NEFT, RTGS or IMPS.

Spotting a fake "@valid" ID

• A bare @valid, or a misspelling such as @val1d or @vaild, is not the official format.
• A broker-style name ending in .brk or .mf on an ordinary handle such as @ybl or @okaxis is a warning sign: a registered intermediary collecting by UPI must use its validated ID.
• No green thumbs-up on the confirmation screen, or no match on SEBI Check, means do not pay.

Seven UPI scams, and the exact moment to stop each one

Almost every UPI fraud works on one of two feelings: greed ("you've won", "earn from home") or fear ("your account will be blocked", "you are under arrest"). Here is how the seven most common versions play out, and the point at which each one can be stopped.

1. The fake customer-care number

You search online for a bank, courier or airline helpline and call the first number you see. The "agent" is friendly and quick, then asks you to pay a small "verification" or "refund processing" fee to an ID like bank.care@…, or to install a screen-sharing app. Stop point: the moment a helpline asks for money or an app install. Take numbers only from the official website you typed yourself, or from inside the official app.

2. The refund or cashback that asks you to pay

A message promises a refund, a cashback or an electricity-bill adjustment, with a payment link or request attached. The note says "credit" or "refund", but the screen says "Pay". Stop point: any time you are asked for a UPI PIN to receive money. A PIN only ever sends money out.

3. The QR code from a "buyer"

You list a sofa or a phone on a marketplace. A buyer agrees instantly, never haggles, and sends a QR code "to transfer the advance". Scanning it and entering your PIN pays them. Stop point: scanning any QR code in order to receive money. To get paid, you share your own UPI ID or show your own QR code.

4. The "digital arrest" call

A caller claims to be from customs, the police, the CBI or a court, says a parcel or a bank account in your name is linked to crime, and keeps you on a video call for hours. You are told to transfer your savings to a "verification account" that will be "refunded after investigation". Stop point: the first word "arrest" on a phone or video call. Indian agencies do not arrest people over video calls, and they never ask you to move money to prove your innocence. End the call, tell a family member and call 1930.

5. The investment or "task" group

A WhatsApp or Telegram group pays you ₹50 for liking a few videos, then invites you to a "VIP" round: invest ₹1,000, get ₹1,500 back. The first payouts are real, which builds trust. When you send a large amount, the group vanishes. Stop point: any request to deposit money in order to earn money. A genuine SEBI-registered broker or mutual fund takes UPI payments only through its validated @valid handle — see Tool 1.

6. The electricity or KYC deadline

"Your power will be cut at 9:30 pm tonight. Update your bill now." "Your KYC has expired; your account will be blocked today." A link or a small payment of ₹10–₹15 is the hook; the real aim is your card details, OTP or a remote-access app. Stop point: any message that combines a deadline with a link. Open your electricity board's or bank's own app instead.

7. "I sent you money by mistake"

You receive a call and a convincing "credited" SMS, then a plea to return the money. Often nothing was credited at all — the SMS was typed by the fraudster. Stop point: before returning anything, open your own bank app and check your balance. If money really did arrive by mistake, let your bank handle the reversal.

Tool 2: Your RBI reporting-deadline countdown

You may have heard that RBI gives you "24 hours" to report a fraud. It doesn't — and believing it can cost you money, because the real rules count in working days or calendar days, and your clock may already be running. Here is what actually applies:

• Right now: call 1930. Banks can only hold money that hasn't been withdrawn yet, so the first hours matter most.
• Within 24 hours of that call: complete your complaint on cybercrime.gov.in using the acknowledgement number the helpline gives you. This is the Home Ministry's reporting process — and the real origin of the "24-hour rule" people talk about.
• For transactions up to 31 December 2026: report to your bank within 3 working days of the bank's alert for zero liability in a third-party breach.
• For transactions from 1 January 2027: report to your bank within 5 calendar days of the fraud — and to 1930 or the portal as well, to stay eligible for RBI's new small-fraud compensation under RBI/2026-27/167.

Enter when the money left (or when your bank's alert arrived), and the countdown shows every window that applies to you, live.

How the countdown works

• Working days skip Sundays and the second and fourth Saturdays, which are bank holidays across India. RBI counts them by your home branch's calendar, so a state holiday can bring your real deadline closer. The countdown cannot know your state's holidays — one more reason to report today.
• Under the current rule, RBI counts from the day after the bank's alert reached you; the day of the alert itself is excluded. The countdown does the same.
• The 2027 directions count five calendar days "from the date of its occurrence" but do not say whether the day of the fraud itself counts. The countdown uses the earlier, safer reading: the day of the fraud is day one.
• A clock turns red in its last 24 hours. A passed deadline does not mean you lose everything — report anyway. After the window, your bank's board-approved policy decides how much you get back.

The RBI rule from 1 January 2027 (RBI/2026-27/167)

On 24 June 2026 the Reserve Bank of India issued revised directions on customers' liability in fraudulent electronic banking transactions. For commercial banks the circular is RBI/2026-27/167; matching circulars, issued the same day, cover small finance, payments, local area, regional rural and co-operative banks. They apply to transactions made on or after 1 January 2027.

Five calendar days to report

If a fraud happens because of a breach elsewhere in the system — neither your fault nor your bank's — you get zero liability and a reversal when you report it to your bank within five calendar days of the fraud. Report later, and your bank's policy decides. If the bank itself was negligent, you owe nothing whenever you report. Any loss after you report falls on the bank, and the burden of proving that you were liable lies on the bank, not on you. Banks must also send an instant SMS for every electronic transaction above ₹500, acknowledge your complaint immediately with a number and a timestamp, and decide domestic fraud complaints within 45 calendar days (60 for cross-border frauds).

Compensation for small frauds: 85%, up to ₹25,000

The biggest change is for people who lost money through their own lapse — for example, an OTP or PIN that a fraudster talked out of them. Under the old rule they carried the whole loss until they reported it. Now a bona fide victim can receive a one-time compensation if:

• you are an individual (sole proprietors included);
• the gross loss is ₹50,000 or less;
• you reported the fraud to your bank and to the National Cyber Crime Helpline 1930 or cybercrime.gov.in within five calendar days of the fraud;
• your bank establishes, under its policy, that the loss is genuine.

The amount is 85% of your net loss (the loss minus anything recovered) or ₹25,000, whichever is less — once in your lifetime. A ₹20,000 loss with nothing recovered would bring ₹17,000; a ₹40,000 loss would bring ₹25,000. The bank must pay within five calendar days of receiving your application. RBI funds most of it, and your bank and the receiving bank share the rest. The scheme covers only frauds that happen up to one year from 1 January 2027; the directions do not say what follows after that.

Until then: the three-working-day rule

For transactions up to 31 December 2026, RBI's 2017 framework (circular DBR.No.Leg.BC.78/09.07.005/2017-18, now part of RBI's consolidated directions) still applies. Report a third-party breach within three working days of the bank's alert and your liability is zero. Between four and seven working days, it is capped at ₹5,000, ₹10,000 or ₹25,000 depending on the account or card. After seven working days, the bank's board-approved policy decides. If you shared your PIN or OTP, you bear the loss until you report it. The bank must credit the disputed amount provisionally within ten working days of your report and resolve the complaint within 90 days.

Tool 3: Draft your bank and cyber-crime complaints

Under stress, people forget the details that matter most — the transaction reference, the exact time, the ID they paid. This generator turns what you know into two ready-to-send drafts: a formal letter to your bank, and a short incident description to paste into the National Cyber Crime Reporting Portal at cybercrime.gov.in. Choose English, Bengali or Hindi for the output, whatever language this page is in.

Before you send it

• Read the draft once and correct anything that isn't exactly right. A complaint with a wrong date or amount slows everything down.
• Attach screenshots of the debit SMS or app entry, the fraudster's messages, call logs and the payment page. Keep the originals on your phone.
• Send the bank letter through the bank's official complaint channel — its app, its website, its email address, or by hand at your branch — and ask for a complaint number in writing.
• Note the date and time you reported. Under RBI's rules, the timing of your report decides how much of the loss you may have to bear.

If money has already left your account: the order that matters

1. Call 1930 or file at cybercrime.gov.in. The report goes to the banks along the payment chain, which can put a hold on money still sitting in the first accounts it reached. If you called, finish the online complaint within 24 hours using the acknowledgement number.
2. Call your bank on the number printed on your card or shown in its official app. Block UPI, cards and net banking, report the transaction as fraud and note the complaint reference.
3. Complain inside your UPI app too. NPCI's dispute process starts with the app you paid through, then the app's bank, then your own bank.
4. Send a written complaint to your bank (Tool 3 drafts it), with your evidence attached.
5. Escalate if needed. If your bank does not reply within 30 days (or the longer period RBI allows for some complaints), or you are not satisfied with the reply, complain under the RBI Integrated Ombudsman Scheme, 2026 at cms.rbi.org.in, or call 14448 for guidance. File within 90 days of the bank's last reply or of that period running out, whichever is later.

Beware the second scam: "recovery" agents

Victims of fraud are often contacted again — by "lawyers", "cyber-cell officers" or "recovery agencies" who promise to get the money back for a fee. Genuine police and banks do not charge to investigate a complaint. Anyone who asks for an advance to recover your money is running the same scam a second time.

Protect the phone itself

Most UPI fraud is persuasion, not hacking — but a compromised phone makes persuasion unnecessary. Malicious apps sent as APK files can read your SMS and steal OTPs; screen-sharing apps let a stranger watch you type your PIN.

Free, official protection first

• Google Play Protect is built into Android and switched on by default — check it under Play Store → your profile → Play Protect. In India, Google has been piloting a block on apps installed from outside the Play Store that ask for SMS, notification or accessibility access, which are exactly the permissions OTP-stealing apps need.
• CERT-In's Cyber Swachhta Kendra lists free security tools at csk.gov.in, including C-DAC's M-Kavach 2 and the eScan Smartphone Safety Toolkit for Android, and free bot-removal tools for Windows computers.
• Sanchar Saathi at sancharsaathi.gov.in lets you report fraud calls, SMS and WhatsApp messages through Chakshu, block a lost or stolen phone, and see the mobile connections issued in your name.
• Keep your phone's software and your banking apps updated, use a screen lock, and never install an APK file that arrives over WhatsApp or SMS.

Antivirus and VPN apps: what they do and don't do

A reputable mobile security app can block known malicious apps and phishing pages, which is useful for anyone who installs apps from outside the Play Store or shares a phone with children. A VPN encrypts your connection on public Wi-Fi, so someone running a fake hotspot at a station or café can't read what you send. Neither one can stop you from approving a payment you have been talked into — that defence is still the pause, and the payee name.

If you decide to buy one, choose a well-known brand from the official app store, avoid "free VPN" apps that demand wide permissions, and never install any security app because a caller told you to.

Questions people ask

Can a UPI ID tell me if someone is a scammer?

Not by itself. A UPI ID can reveal warning signs — and Tool 1 shows you all of them — but an ordinary-looking ID can still belong to a fraudster. The name your app shows before you enter your PIN, and whether you are being rushed, matter more.

Is it safe to share my own UPI ID?

Yes. Your UPI ID lets people send money to you. Nobody can take money from your account with your UPI ID alone; every debit needs your PIN. What you must never share is your PIN, OTP, card CVV or your screen.

Can scanning a QR code take money from my account?

Not by itself. A UPI QR code only fills in a payment; nothing leaves your account until you confirm that payment in your app. A QR code that opens a website is a different risk: the page may ask for your bank details or offer an app to install. If you are unsure what a code does, check a photo or screenshot of it in Tool 1 before you scan it with a payment app.

I entered my PIN after being tricked. Will the RBI rule protect me?

Under today's rules, a bank can treat a payment you approved yourself as authorised by you, so report it to 1930 and your bank at once — a quick freeze is your best chance. For frauds on or after 1 January 2027, RBI's revised directions add a one-time compensation for small losses (a gross loss of up to ₹50,000) caused by a customer's own lapse or by coercion, provided you report to your bank and to 1930 or cybercrime.gov.in within five calendar days. See the RBI section above.

How do I check a stock broker's or mutual fund's UPI ID?

Look for a validated handle ending in @valid followed by a bank name, the green thumbs-up icon in your UPI app, and confirm it on SEBI's "SEBI Check" facility before paying.

Someone wants me to install an app "to process my refund". What should I do?

Refuse and hang up. No bank, wallet or government office needs remote access to your phone to give you a refund.

What if I only lost a small amount?

Report it anyway. Small test debits often come before a larger theft, and every report helps police link accounts and block numbers. From 2027, small losses may also be eligible for RBI's one-time compensation — but only if you report in time.

Official sources

1. SEBI circular, 11 June 2025 — standardised, validated and exclusive UPI IDs for SEBI-registered intermediaries
2. SEBI press release, 1 October 2025 — validated UPI handles and SEBI Check roll out
3. SEBI Check — verify a UPI ID, QR code or bank account of a SEBI-registered intermediary
4. RBI/2026-27/167, 24 June 2026 — revised customer-liability directions for commercial banks (from 1 January 2027)
5. RBI press release, 24 June 2026 — revised framework for fraudulent electronic banking transactions
6. RBI circular, 6 July 2017 — limiting liability of customers in unauthorised electronic banking transactions
7. RBI — Integrated Ombudsman Scheme, 2026: frequently asked questions
8. RBI press release, 28 August 2015 — second and fourth Saturdays as bank holidays
9. RBI circular RBI/2025-26/28, 22 April 2025 — migration of banks’ websites to the exclusive .bank.in domain
10. Press Information Bureau (Ministry of Home Affairs), 17 June 2021 — helpline 1930 and the 24-hour online-complaint step
11. Press Information Bureau (Ministry of Home Affairs), 22 July 2026 — National Cybercrime Response Mechanism: more than ₹11,158 crore saved to 30 June 2026
12. Press Information Bureau (Ministry of Home Affairs), 10 December 2024 — alert on "digital arrest" fraudsters posing as police, NCB, CBI or RBI officers
13. NPCI — fraud awareness (entering a UPI PIN is only for making payments, not for receiving money)
14. NPCI MyUPI — raise a UPI complaint or check a transaction status
15. National Cyber Crime Reporting Portal (Ministry of Home Affairs) — cybercrime.gov.in
16. Sanchar Saathi (Department of Telecommunications) — Chakshu
17. CERT-In Cyber Swachhta Kendra — free security tools
18. Google Play Help — Google Play Protect