PhonePe Refund Scam — Why 'Accept Refund' Requests Debit You Instead
The PhonePe 'refund' scam explained: how scammers trick you into approving a UPI collect request that debits your account. Real examples + reporting steps for India.
How the scam actually works
- Scammer poses as customer support (Flipkart, Amazon, Meesho) and claims a refund is pending.
- They initiate a UPI 'collect' request to your PhonePe / GPay / Paytm — this looks like a payment notification.
- They pressure you to enter UPI PIN 'to accept the refund'. Entering the PIN authorises the debit, not a credit.
- Money leaves your account instantly. The scammer's UPI ID is usually a mule account that's emptied within minutes.
Red flags — what to look for
- Any 'refund' that requires you to enter UPI PIN — real refunds are credited automatically, no PIN needed on the receiving side.
- Urgency: 'approve in 2 minutes or the refund expires' — legitimate refunds don't expire.
- The caller knows your recent order details (they scrape from leaked databases and social engineer the rest).
- The 'support number' they call from is a random 10-digit mobile, not the brand's official landline.
How to report in India
- Call 1930 within 24 hours — every hour matters for chargeback.
- Screenshot the collect-request notification and the caller's number, then file on cybercrime.gov.in.
- Report the scammer's UPI ID (VPA) to PhonePe / GPay / Paytm inside the app — they can flag it for the mule account.
- Tell the actual brand (Flipkart / Amazon) so they can warn other customers via their support channels.
How to protect yourself going forward
Prevention is boring but works. Enable UPI transaction alerts on SMS + email (both, not just one). Set a daily UPI cap of ₹10,000 unless you actively need more — you can raise it back in 30 seconds when required. Add a separate low-balance current account for online payments and keep the salary account off UPI entirely. Lock your Aadhaar biometric at resident.uidai.gov.in — that alone stops most eKYC-based downstream fraud even if your OTP is leaked. Finally, tell one family member every time you get a suspicious message. Fraud thrives on isolation.
What actually helps recovery
Time. The single strongest recovery factor is reporting to 1930 within the first hour. RBI's Turnaround-Time framework requires banks to freeze beneficiary accounts within specific windows and the 1930 number is plugged directly into that flow. After 24 hours, freeze probability drops sharply. After 72 hours, recovery is rare. Screenshot everything: the SMS, the caller number, the UPI ID, and the debit alerts. All of these become evidence on cybercrime.gov.in.
Frequently asked questions
How is a real refund credited on UPI?
Automatically. The merchant initiates the refund from their end and it appears in your account within 3-7 working days. You never need to 'accept' or enter a PIN to receive money on UPI.
Why does PhonePe show a 'pay' screen when I approve a refund?
Because it isn't a refund — it's a UPI collect request the scammer sent. The 'pay' screen is telling you it's a debit. Cancel it immediately.
Can PhonePe reverse the transaction?
PhonePe can flag and freeze the beneficiary UPI ID, but the actual reversal has to come from your bank + the beneficiary bank. Report to 1930 first — that triggers the coordinated freeze.
How do scammers get my order info?
Leaked e-commerce databases sold on dark-web forums, plus courier-company insiders. This is why cross-checking through the official app (not the caller's number) is critical.
Is enabling UPI Lite safer?
UPI Lite has a lower per-transaction cap (₹500) and doesn't need a PIN for small payments — which limits scam damage but also removes the PIN check. It's a tradeoff, not a fix.