Table of Contents
Fake payment links are the fastest-growing digital scam in India. They load quickly, look convincing, and reach you through channels you trust — SMS, WhatsApp, even Google search results. The technology behind them is simple. What makes them effective is a single moment of inattention. This guide gives you the seven warning signs that expose every fake link, a breakdown of what fraudulent pages actually ask for, and a 10-second checklist you can run before clicking anything.
7 Signs
Expose every fake payment link
10 Seconds
Is all the checklist takes before clicking
1 Character
In the URL is all that separates real from fake
Here’s what makes fake payment links so dangerous: they don’t look fake. A well-made phishing page replicates the logo, colour scheme, and layout of a real bank or payment platform almost perfectly. The only reliable difference is in the URL — and most people never check it before entering their details.
This guide walks through every layer of the problem: what the URL gives away, what fake pages actually ask for (and why each item is a fraud indicator), the seven warning signs that work every time, where these links come from, and what to do within 30 minutes if you’ve already clicked one. Work through it once, share the checklist with your family, and you’ll be prepared for the most common form of financial fraud targeting Indians in 2026.
01 URL Warning Signs — The Single Most Reliable Giveaway
The URL is the single most reliable indicator of a fake payment page, and fraudsters can’t fully hide it. Every fraudulent link deviates from the official domain in at least one way — a misspelling, an extra word, a wrong top-level domain, or a long suspicious subdomain. The patterns repeat because they work, and learning to spot them takes under a minute.
| Fake URL Pattern | Fraud URL Example | Real Official Domain |
|---|---|---|
| Misspelled brand name | paytm.net / phonepe-support.com | paytm.com / phonepe.com |
| Extra words added | gpayhelp.net / icicibanksecurepay.com | pay.google.com / icicibank.com |
| Fake refund/support subdomain | paytmrefunddesk.in / sbirefund.co.in | paytm.com / sbi.co.in |
| Wrong top-level domain (.net / .co) | hdfcbank.net / axisbank.co | hdfcbank.com / axisbank.com |
| Numbers substituted for letters | amaz0n.in / fl1pkart.com | amazon.in / flipkart.com |
| Hyphenated brand names | razorpay-payment.com / upi-verify.in | razorpay.com / npci.org.in |
| Long random subdomain | secure.pay-verify-hdfc-login.com | netbanking.hdfcbank.com |
Before entering any payment or personal details, look at the URL bar carefully. The official domain for any Indian bank or payment platform is short, clean, and matches exactly what’s printed on their official app or website. If you’re unsure, close the page and navigate directly to the official site by typing the URL yourself — never through a link.
Pro Tip
02 What Fake Pages Ask For — and Why Each Request Is Always a Scam
Legitimate payment gateways in India have a narrow, well-defined set of inputs: your card number at checkout, and an OTP on your bank’s own 3D Secure page. That is the complete list. Any page that asks for anything beyond this is either fraudulent or dangerously misconfigured. Here’s why each common request is a red flag:
| What the Fake Page Asks For | Why It’s Always a Scam | What Legitimate Pages Actually Ask |
|---|---|---|
| UPI PIN | UPI PIN authorises money leaving your account. It is never needed to receive money or verify identity | Nothing. You receive money by sharing your UPI ID only |
| OTP for ‘verification’ | An OTP authorises a transaction. Entering it on a fake page completes a payment you never intended | OTP is entered only on your bank’s own 3D Secure page — never on a merchant page |
| Full card number + CVV + expiry | Together, these three fields are sufficient to make an online purchase anywhere in the world | Card number at checkout only. CVV is never stored or re-requested by legitimate sites |
| Net banking username and password | These credentials give full access to your account — balance, transfers, everything | You log in to your bank’s own app or website. No payment link should ever ask for these |
| Small ‘verification fee’ of ₹1–10 | A real payment to verify your account. Once you approve, larger collect requests follow | No legitimate company charges a fee to verify your account, process a refund, or update KYC |
| Aadhaar or PAN number | Used for identity theft, SIM-swap attacks, and fraudulent loan applications in your name | Identity verification is completed through your bank’s official KYC process, not a payment link |
A payment page that asks for your UPI PIN, OTP, and card CVV on the same screen is always a fraud page — no exceptions. Legitimate payment flows never combine these inputs on one screen. The 3D Secure OTP page is hosted by your bank, appears after you’ve already submitted card details on the merchant site, and only asks for the OTP — nothing else.
03 Seven Warning Signs — Any One Is Enough to Stop
Any single one of the following signs is sufficient reason to stop and verify before proceeding. You don’t need multiple red flags to appear simultaneously. One is enough — and acting on the first sign you spot is the habit that keeps you safe.
| # | Warning Sign | What It Looks Like in Practice |
|---|---|---|
| 1 | URL does not match the official domain exactly | Any variation in spelling, punctuation, subdomain, or top-level domain is a different website. One wrong character is enough — it sends your details to a different server entirely. |
| 2 | You were not expecting this payment or request | Genuine payments arrive after you initiated a purchase. Unsolicited payment requests — for refunds, KYC, delivery, verification — are almost always fraud. |
| 3 | Page asks for your UPI PIN or OTP to ‘receive’ money | Receiving money requires zero action from you. If a page asks for your PIN or OTP to credit your account, it is charging your account, not crediting it. |
| 4 | Amount shown is a payment, not a receipt | You expected to receive ₹500 but the page shows ‘Pay ₹500’. You are looking at a fraud link disguised as a receipt confirmation. |
| 5 | Extreme urgency or countdown timers | ‘Your refund expires in 4 minutes.’ ‘Account blocked in 10 minutes.’ Legitimate financial processes have no countdown. Urgency is manufactured to prevent you from thinking clearly. |
| 6 | Fake payment confirmation screenshots | A fraudster sends a doctored screenshot showing ‘Payment Successful’ and asks you to ‘verify’ via a link. Always verify inside your own UPI app — never through a link someone sent you. |
| 7 | Link arrived via WhatsApp, SMS, or unknown number | Genuine payment links come from verified platforms at checkout. If a payment link arrives unsolicited via WhatsApp or SMS from an unknown number, treat it as fraud by default. |
#6 — the fake payment confirmation screenshot — deserves particular attention. It is the most effective technique used in OLX, Facebook Marketplace, and peer-to-peer sale fraud across India. A buyer sends a screenshot showing payment completed and asks you to ‘confirm receipt’ via a link. The link charges you. Always verify incoming payments inside your own UPI app or bank app. A screenshot proves nothing.
Warning sign
04 Where Fake Links Come From — Five Active Distribution Channels
Understanding where fraudulent payment links originate helps you apply the right level of scepticism to each channel. The same link sent through two different channels carries very different risk profiles — and knowing the source tells you a lot about intent.
| Source Channel | How to Identify the Fake | Safe Alternative |
|---|---|---|
| WhatsApp from unknown numbers | No legitimate bank or payment company sends payment links via WhatsApp from personal numbers | Open your bank app directly. Never pay via a WhatsApp link |
| Fake customer care on Google | Fraudsters pay to place fake helpline numbers in Google search results for Indian bank names | Find helpline numbers only from your bank’s official app or the back of your card |
| SMS pretending to be your bank or NPCI | Check the sender ID. Banks use registered short codes — not personal mobile numbers | Banks never send payment links via SMS. Ignore and delete |
| Social media — fake brand accounts | Fake accounts with near-identical names reply to complaints with ‘help’ links. Check for the verified tick | Go directly to the official website. Verify accounts before trusting any link |
| Fake OLX / marketplace buyer | A fake buyer sends a ‘payment link’ to ‘send’ you money for goods. The link charges you instead | As a seller, you receive money by sharing your UPI ID or QR code only — no links needed |
If you’re selling something online and a buyer sends you a payment link to ‘send your payment’, that link is almost certainly a fraud attempt. As a seller, you receive money by sharing your UPI ID or QR code. You never click a link, enter a PIN, or approve a request to receive payment. The moment a buyer sends you a link and asks you to ‘confirm your account’, end the transaction immediately.
Pro Tip
05 The 10-Second Checklist — Run This Before Every Payment Link
Run through these six questions before acting on any payment link. The entire check takes under 10 seconds. If any answer triggers the response in the right column, follow that response without exception — this is not a grey area.
| # | Ask Yourself | If the Answer Triggers → Do This |
|---|---|---|
| 1 | Do I know the sender of this link personally or from a verified platform? | “No” or “I’m not sure” → Do not click. Verify directly with the sender through a known channel. |
| 2 | Does the URL match the official domain exactly, character by character? | “No” or “I can’t tell” → Do not proceed. Type the official URL directly into your browser instead. |
| 3 | Is the page asking for my UPI PIN, OTP, CVV, or net banking password? | “Yes” → Leave immediately. This is always a fraud page. No legitimate payment requires these on a link. |
| 4 | Does the page show a payment amount when I was expecting to receive money? | “Yes” → This is a scam. You are being asked to pay, not receive. Close the page immediately. |
| 5 | Am I being rushed with a countdown timer or urgency message? | “Yes” → Stop completely. Urgency is manufactured. Take time to verify independently first. |
| 6 | Did this link arrive unsolicited via WhatsApp, SMS, or social media DM? | “Yes” → Treat as fraud by default. Go directly to the platform or bank to verify the claim. |
Save this checklist as a screenshot on your phone right now. Before clicking any unexpected payment link, open the screenshot and run through the six questions. The habit of pausing for 10 seconds is the single most effective defence against fake payment link fraud — more effective than any technical tool available.
Pro Tip
06 What to Do If You Clicked a Fake Link or Made an Unintended Payment
If you’ve already clicked a suspicious link and entered details, or approved a payment you didn’t intend, act immediately — every minute reduces your recovery chances. Do not wait for confirmation that fraud has occurred. Act on suspicion.
Step 1
Stop immediately — do not enter any more details
Close the page right now. Do not make any further payments on the same link, even if the page asks you to ‘complete’ the process to get a refund. That’s the next layer of the scam.
Step 2
Report the transaction immediately. Ask them to block your card and UPI access temporarily. Under RBI’s Zero Liability Policy, prompt reporting gives you the best chance of a full refund — the sooner you call, the better.
Step 3
Change your UPI PIN, net banking password, and email password from a secure device — your home network, not a public connection.
Step 4
This creates the legal record needed for formal fraud recovery. 1930 is the national cybercrime helpline, available 24×7. Filing promptly significantly improves recovery outcomes.
Step 5
This creates the legal record needed for formal fraud recovery. 1930 is the national cybercrime helpline, available 24×7. Filing promptly significantly improves recovery outcomes.
Save these two contacts in your phone right now, before you ever need them: your bank’s 24-hour fraud helpline (find it in your banking app), and 1930 (national cybercrime helpline). In a stressful moment, searching for these numbers costs precious minutes that directly affect how much you can recover.
Pro Tip
Quick Reference: Key Portals and Helplines
| Item | Where to Go |
|---|---|
| Cybercrime Helpline (call) | 1930 — national helpline, 24×7 |
| Report payment link fraud online | cybercrime.gov.in — National Cyber Crime Reporting Portal |
| NPCI UPI/IMPS dispute | npci.org.in — raise dispute under Payments / UPI |
| RBI Ombudsman (unresolved disputes) | cms.rbi.org.in — RBI Complaint Management System |
| SBI fraud helpline | 1800-111-109 (toll-free, 24×7) |
| HDFC fraud helpline | 1800-202-6161 |
| ICICI fraud helpline | 1800-200-3344 |
| Axis Bank fraud helpline | 1800-419-5959 |
| Verify a suspicious UPI ID | Open your UPI app → type the ID → confirm the registered name before sending |
Fake payment links are effective because they are cheap to build, easy to distribute, and difficult to distinguish at a glance. The defence is not technical skill — it is a consistent three-point habit: check the URL character by character; confirm what the page is asking for; and ask yourself whether you were expecting this request. If the URL is not the official domain exactly, do not proceed. If the page asks for your UPI PIN, OTP, or CVV, leave immediately. If you were not expecting this payment request, verify directly through a known channel. And if something feels urgent — slow down. That urgency is the fraud. One wrong click costs seconds to make and potentially everything to undo. Ten seconds of checking prevents it entirely.
