Law & Safety
UPI Fraud in Gaming Apps: How to Stay Safe and Get Money Back
Collect requests, fake payout screens, screen-sharing tricks and "unlock fees". How UPI fraud happens in gaming apps, and the steps that give you the best chance of recovery.
By Yono Games Editorial TeamUpdated 5 min read
UPI made payments instant, and that speed is exactly what fraudsters exploit. Gaming apps, especially sideloaded rummy, teen patti and 777 APKs shared on Telegram and WhatsApp, are one of the most common routes. The money usually leaves your account in seconds and is moved on within minutes, so knowing the tricks in advance and acting fast afterwards are what make the difference.
The 3 rules that stop most UPI fraud
- You never need your UPI PIN to receive money. Entering your PIN always sends money out. Anyone saying "enter PIN to receive your winnings" is stealing.
- Never share an OTP or install a screen-sharing app (AnyDesk, TeamViewer, QuickSupport or a "support" APK) at someone else's request.
- Never pay to unlock a withdrawal. A "tax", "GST", "verification fee" or "channel charge" before you can withdraw is the classic gaming-app scam.
How the scams work
Collect requests disguised as payouts
You are told your winnings are being sent, and a request pops up in your UPI app. It is actually a collect request: approving it with your PIN pays the scammer. Read every UPI screen: "Pay" or "Debit" means money is leaving you.
QR codes for "receiving" money
Scanning a QR code is for paying, not receiving. A QR code sent in chat to "claim a bonus" will debit your account.
Deposits to personal UPI IDs
Many unregulated apps route deposits to individuals' UPI IDs, often a different one each time. These are usually mule accounts, rented bank accounts used to move fraud money. Once your payment lands there it is hard to trace. If the payee name is a person and not a company, stop.
The withdrawal trap
You win, the balance grows, and the withdrawal is "pending" until you deposit more or pay a fee. The balance on the screen is just a number in the app; the operator never intended to pay it. Our real-or-fake checklist lists the other warning signs.
Malicious APKs
Some gaming APKs ask for SMS, Accessibility or device-admin access. With those, an app can read your bank OTPs or act on your screen. Learn how to check an APK before installing.
Recovery scams
After a loss, "recovery agents", fake police officers or "cyber lawyers" contact you offering to get your money back for a fee. They are a second scam. Real police and banks never charge a fee to process your complaint.
What to do if you lose money: step by step
- Call 1930 immediately. The National Cyber Crime Helpline can alert banks to put a hold on the money while it is still in the chain.
- File a complaint at cybercrime.gov.in under financial fraud. Note the acknowledgement number; you will need it.
- Call your bank's fraud line and block UPI on the affected account if you shared a PIN or OTP. Use the number on the bank's official website or the back of your card.
- Collect evidence: UPI transaction IDs (UTR numbers), payee UPI IDs, screenshots of the app, chats, Telegram channel names and the APK file name.
- Change your UPI PIN and passwords, uninstall the app and run Google Play Protect.
- Report the number or link on the government's Sanchar Saathi portal (Chakshu) to help get it blocked.
Will the bank refund you? The RBI rules
The Reserve Bank of India's rules on customer liability for unauthorised electronic transactions depend on whose fault it was and how quickly you reported it:
| Situation | Your liability |
|---|---|
| Fraud caused by the bank's own failure | Zero, whenever you report |
| Third-party breach, not your fault, reported within 3 working days | Zero |
| Third-party breach, reported in 4 to 7 working days | Limited (capped, depending on account type) |
| You shared your PIN, OTP or password | You bear the loss until you report it to the bank |
The important catch: if you authorised the payment yourself, for example by depositing into a gaming app or approving a collect request, the bank usually treats it as an authorised transaction, so the refund route above does not apply. Your recovery then depends on the police freezing the money in the receiving accounts, which is why the 1930 call matters so much.
If your bank does not resolve a complaint within 30 days, or you are unhappy with the reply, you can escalate to the RBI's Integrated Ombudsman at cms.rbi.org.in.
Protect yourself before anything happens
- Set a low daily UPI limit in your UPI app for everyday spending.
- Keep a separate bank account with a small balance linked to UPI.
- Turn on SMS and app alerts for every debit.
- Install apps only from the Play Store, and keep Play Protect on.
- Never join Telegram or WhatsApp groups that promise guaranteed winnings or "prediction" tips.
Frequently asked questions
How can I get my money back from a fake gaming app?
Call 1930 as fast as possible and file a complaint at cybercrime.gov.in with your UPI transaction IDs. Police can ask banks to freeze money still sitting in the receiving accounts. Also inform your bank. The sooner you report, the better the chance of recovery.
Do I need my UPI PIN to receive money?
No. You never need a UPI PIN to receive money. Entering your PIN always authorises a payment out of your account.
Will my bank refund money I deposited into a gaming app?
Usually not through the bank alone, because you authorised the payment. Refunds under RBI's liability rules apply to unauthorised transactions. For authorised payments to fraudsters, recovery depends on a quick police complaint through 1930 or cybercrime.gov.in.
What is the cyber crime helpline number in India?
The National Cyber Crime Helpline is 1930. Complaints can also be filed online at cybercrime.gov.in.