Frozen screen UPI scam explained: How fraudsters can access your phone and how to stay safe

A phone screen that suddenly freezes or a banking app that displays an error may be used by cybercriminals to trick users into giving them access to their devices.

Fraudsters may pose as customer support representatives, offer to fix the problem and persuade users to install malicious applications or grant remote access, potentially putting their banking information and money at risk.

The scam may begin with a suspicious link, fake warning or unresponsive screen. A caller then claims to represent the bank or payment service and asks the user to download an application, including an Android Package Kit (APK) file, or install a screen-sharing tool.

Once access is granted, malicious software may exploit permissions to read SMS messages and notifications, monitor activity or interact with applications. Depending on the access obtained, this could expose sensitive information, including one-time passwords (OTPs), and facilitate fraudulent transactions.

Harish Kumar, CEO of Quick Heal Technologies, an Indian multinational cybersecurity software company, said scammers use fake error alerts and frozen screens to create urgency. He cautioned that malicious applications disguised as service, verification, cashback or utility tools may misuse Android’s Accessibility, SMS and notification permissions.

Why can the scam work even when UPI security is intact?

Fraudsters may not need to breach the UPI payment infrastructure. Instead, they can manipulate users into revealing information, granting device access or authenticating transactions themselves. A payment may consequently appear to have been authorised through the normal process even though the user was deceived.

Ravindra Singh, managing director of Delcom Telesystems, an ISO-certified enterprise system integrator and technology solutions provider, said the scam highlights the need to look beyond payment platforms when assessing digital security. Devices, applications, connectivity and user behaviour all form part of the security chain, he said, adding that unsolicited requests to install applications or grant remote access should be treated with caution.

Artificial intelligence (AI) can make such impersonation attempts more convincing.

Ankush Tiwari, CEO and founder of pi-labs, an AI-native deep-tech and cybersecurity company, said fraudsters can use cloned voices, deepfake video calls and polished messages in local languages to target people at scale. He also flagged the possibility of users finding fraudulent customer-care numbers through online searches or AI assistants.

Tiwari said users should verify identities and contact details independently rather than relying on a familiar voice, a convincing video call or a number returned by a search. He also pointed to the need for banks and platforms to improve fraud detection and speed up mechanisms to freeze suspicious transactions.

How to protect yourself

• Do not install unverified applications: Never download an APK file or another application at the request of an unsolicited caller claiming to fix a banking problem.
• Do not grant remote access: Avoid screen-sharing or remote-control requests from unknown callers. Never disclose your UPI PIN, OTP or banking credentials.
• Review app permissions: Check which applications can access Accessibility services, SMS, notifications and device-administration features. Remove suspicious apps and revoke unnecessary permissions.
• Verify customer-care numbers: Use the contact details in your bank’s official app, on its verified website or on the back of your bank card. Do not rely on numbers supplied by callers or unverified search results.
• Do not rush: A frozen screen does not automatically mean your account has been compromised. Avoid clicking unfamiliar links or following instructions designed to create panic.

Kaushal Bheda, director of Pelorus Technologies, an Indian technology company, said users may inadvertently give fraudsters the access needed to carry out a scam. He advised users to end unsolicited support calls and contact their bank using independently verified details.

He also suggested that families help older relatives review daily transaction limits and check unexpected offers of technical assistance with a trusted person.

What to do if you suspect fraud

If you have installed a suspicious application or granted remote access, stop interacting with the caller. If you suspect the device is being controlled remotely, disconnect it from the internet and use another trusted device to contact your bank.

If money has been debited, call 1930 immediately and report the incident through the National Cyber Crime Reporting Portal at cybercrime.gov.in.

Contact your bank to secure the affected account or payment facilities and check recent transactions. Remove suspicious applications, revoke unnecessary permissions and change banking and email credentials from a clean device. Preserve transaction details, messages and other relevant evidence.

Bheda cautioned that fraudulently obtained funds may be transferred through multiple accounts before a complaint is filed. Prompt reporting can help banks and authorities attempt to trace or freeze funds, although recovery is not guaranteed.