The UPI Fraud Kill Chain: How Fake-APK Scams Defeat India's Payment Controls
UPI is protected by device binding, a UPI PIN, daily limits and NPCI's fraud engines — and fake-APK scams still drained ₹805 crore in FY26. This is the step-by-step kill chain of how a challan-APK beats each control, and the single defence that breaks each step.
On this page
UPI is, by any measure, a triumph. In November 2025 it processed 20.47 billion transactions worth ₹26.32 lakh crore in a single month, up roughly a third year on year. It's also protected by a genuinely thoughtful security model: a mobile number bound to one device, a UPI PIN as a second factor, daily transaction limits, and NPCI fraud engines scoring transactions in real time.
And yet, in FY26 (through November), UPI-linked fraud still came to ₹805 crore across 10.64 lakh incidents, per figures the Finance Ministry gave Parliament.
The uncomfortable truth is that almost none of that was a break in UPI's cryptography. It was social engineering plus one Android app, chained together to defeat each control in turn. If you build or defend payments in India — which, after a decade of these scams, is a lot of people — the useful thing is to see the whole chain at once, and know exactly where each link can be cut.
At a glance
UPI-linked fraud reported to Parliament (fiscal year, April–March):
| Fiscal year | Amount | Incidents |
|---|---|---|
| FY 2021-22 | ₹242 cr | — |
| FY 2022-23 | ₹573 cr | — |
| FY 2023-24 | ₹1,087 cr | 13.42 lakh |
| FY 2024-25 | ₹981 cr | 12.64 lakh |
| FY 2025-26 (to Nov) | ₹805 cr | 10.64 lakh |
The fraud that drives a large share of this is the fake-APK scam: a message about a traffic challan, KYC update or gas bill, leading to an Android app that the victim installs by hand. I've broken that ecosystem down before in The APK Is the Exploit; this piece is about the mechanics of how it beats the payment stack.
The kill chain
The UPI fraud kill chain and where it breaks
1. Lure and sideload
A believable, urgent message — an overdue challan, a bank-KYC deadline, a gas disconnection — carries a link to an .apk. The victim installs it themselves.
What breaks it: keeping the app off the phone. Play Protect on, never installing from a link, and one rule drilled into every relative: a government department or a bank never sends you an app to install.
2. Grab SMS permissions
The app requests READ_SMS, RECEIVE_SMS and SEND_SMS, often hides its launcher icon, and sets itself to survive in the background.
What breaks it: starving it of SMS. Modern Android restricts SMS access for sideloaded apps, and MDM policy on managed devices can block it outright. The whole chain downstream depends on this permission.
3. Intercept the OTP
A background receiver reads incoming bank OTPs before the user sees them, and forwards them to an attacker-supplied number. The bank's SMS second factor is now the attacker's.
What breaks it: not relying on SMS OTP. App-based or push approval bound to the device can't be read out of an SMS inbox. And the behaviour itself is detectable — an OTP being read programmatically and a transfer completing seconds later is a strong fraud signal.
4. Capture the UPI PIN
The app shows a fake ₹1 "verification" payment and a counterfeit UPI PIN screen. The victim, believing they're confirming a refund, types their PIN.
What breaks it: one piece of user knowledge. You only ever enter a UPI PIN to send money, never to receive it. A screen asking for your PIN to get a refund is theft, full stop. Legitimate apps also never collect the UPI PIN inside a webview — the PIN is entered in the NPCI common library, not a page the app drew.
5. Hijack the device binding
This is the step people miss, and it's the clever one. UPI ties your number to one device by having the app send an outbound SMS from your SIM — a possession proof that only the holder of that number can produce. But an app that can read and send SMS controls that possession factor. With it, the attacker can complete the binding flow for the victim's number on the attacker's own device, standing up a working UPI app as the victim.
What breaks it: trusting new devices less. NPCI caps binding attempts (three per day per account), and the moment that actually matters — a number binding to a new device — is exactly where a step-up challenge, SIM-swap and SIM-age checks belong. A brand-new SIM or a number that just moved devices, followed immediately by high-value transfers, should never sail through.
6. Cash out through mules
Funds move to a network of mule accounts and then out, often via ATMs, deliberately broken up to stay under limits and to sever the trail between victim and beneficiary.
What breaks it: scoring the money as it moves. This is where NPCI's AI/ML monitoring, first-time-payee risk scoring, velocity limits, beneficiary cooling-off periods and mule-account detection do their work. Even when every earlier step succeeds, the transaction pattern — new payee, new device, rapid drain — is the last place to catch it.
The pattern behind every step
Read the chain top to bottom and one thing stands out: the strongest controls are defeated by the weakest link, which is almost always SMS. SMS OTP is read. SMS is what completes device binding. Starve the malware of SMS, or stop trusting SMS as a factor, and most of the chain collapses.
The second pattern is that the controls that do hold are behavioural, not cryptographic. UPI's cryptography was never broken here. What catches the fraud — when it's caught — is noticing that a number just bound to a new device, that a PIN was entered in the wrong context, that money is flowing to a first-time payee at machine speed. That's risk scoring, not maths.
If you build or defend payments
A checklist aimed at the people who can actually move the needle:
- Treat SMS OTP as compromised by default for this threat model. Push the second factor into an app-approval flow bound to the device, and move high-value actions behind something phishing-resistant.
- Make new-device binding a high-friction, high-scrutiny event. Step-up authentication, SIM-age and recent-SIM-swap signals, and velocity checks on what that freshly bound device does next.
- Score the first transaction, not just the account. New payee + new device + rapid high-value transfer is the signature; a short beneficiary cooling-off period buys the time to catch it.
- Instrument the tells on-device where you can. An OTP read programmatically and a transfer within seconds; an app with SMS permissions active alongside a banking flow.
- Invest in mule-account detection. The cash-out network is the shared infrastructure behind every one of these campaigns, and the one most reused.
The takeaway
The fake-APK scam is not a UPI vulnerability. It's a chain of ordinary steps, each one defeating a real control, held together by social engineering and SMS. That's good news for defenders, because a chain is only as strong as its weakest link — and here the weak links are well known: don't let the app onto the phone, don't trust SMS as a factor, make new-device binding earn trust, and score the money as it moves. Cut any of those and the chain breaks.
India has built the most-used payment rail on earth. Keeping it safe is now much less about the rail and much more about the phone in the user's hand, and the risk engine watching the money.
This article reflects public information as of 16 October 2026. Fraud figures are from the Finance Ministry's reply in Parliament (Dec 2025); malware mechanics are drawn from CYFIRMA and Cyble analyses.
Sources
Related research
More deep dives →
