India’s digital payment ecosystem continues to evolve rapidly, and cybercriminals are evolving their tactics just as quickly. In 2026, a new wave of WhatsApp and UPI scams is targeting users across India, where security experts and law enforcement agencies are urging users to be vigilant. Cybercriminals are no longer relying on basic phishing messages.. Instead, they are using social engineering, fake business names, malicious files, AI-crafted messages, and account impersonation to trick unsuspecting victims into revealing sensitive information or transferring money.

Recent incidents show that both individuals and businesses are increasingly falling victim to well-organized  scams that look authentic at first glance. The experts warn that users need to stay vigilant, double-check all payment requests and don’t rush.

New WhatsApp scam techniques have emerged in 2026.

One of the latest fraud techniques involves scammers impersonating company executives, employers, or family members on WhatsApp. The cybercriminals either establish fake profiles or gain unauthorized access to genuine WhatsApp accounts and send payment requests in a hurry, This tactic is commonly known as the “Boss Scam.”  Employees are instructed to make urgent UPI transfers for “confidential business reasons” and emotional messages are received to individuals saying that someone they know is in an emergency and needs money. Experts say these are messages crafted to induce panic to trick victims into not checking the request before wiring money.

  Dangerous ZIP File Scam Spreading Through WhatsApp

Another new scam by cybersecurity experts has emerged related to the delivery of ZIP files via WhatsApp. The message from the victim contains details such as invoices, salary information, updates for their KYC, courier information, or even business contracts.

When the victim downloads and opens the ZIP file, the malicious software may gain access to the victim’s device. In some of the documented cases of business fraud, attackers reportedly exploited this access to listen in, pretend to be high-level executives and request that employees make big financial transfers.

It’s best to not open any ZIP or APK files that have been sent through messaging apps unless they have been independently verified.

Fake UPI Payment Requests keep duping users. Scam emails using UPI keep tricking users.

UPI scams are still one of the most prevalent cyber frauds in India. Phishing scams are being conducted via fake screenshots of payments, QR codes, collect requests and payment links to obtain funds.

Common tactics include:

• Sending of fake payment confirmation screenshots.
• Requesting users to provide the UPI PIN to “receive money”.
• Distributing fake QR codes promising refunds to users.
• Impersonating customers’ service representatives.
• Producing bogus online marketplace listings.
• Sending fake KYC update message.

Experts in cyber constantly remind the users that entering a UPI PIN always gives authorization to a payment. No real receiver ever asks you for UPI PIN to deposit funds into your account.

 Fake Investment Groups on WhatsApp

A new trend is the creation of fake investment communities via WhatsApp and Telegram groups. Victim is invited to join groups that seem to be from a well known financial institution or financial market gurus.

Repeatedly, small profits can be demonstrated to establish trust. Victims are then asked to put in bigger sums, but are later told that the money can’t be retrieved.

The police in several states are still working on several of these investment frauds that are conducted via messaging apps.

Cybercrime is getting increasingly sophisticated thanks to AI.AI is driving the evolution of online scams.

Scammers are exploiting artificial intelligence to craft messages that are more natural, create more believable fake identities and create more professional-looking documents, the cybersecurity researchers say.

While some of the older scams had grammatical errors, many of the fraudulent messages look sophisticated and legitimate. AI-powered social engineering is increasingly making it harder for consumers to spot when they’re communicating with a scammer, experts say.

That’s why digital awareness and verification are still the best lines of defense.

There are a few warning signs users should watch out for:

Users are advised to be careful if they see any of these:

• Rushing for cash.
• Requests to keep transactions confidential, e.g., via email.
• Unauthorized persons calling to collect money on behalf of relatives/companies. Anonymous calls asking for money from relatives/companies.
• Requests to install APK or ZIP files.
• * Suspicious payment links.
• Promises of refunds on QR codes.
• OTP & UPI PIN requests.
• Unexpected KYC verification messages.
• Unbelievably good offers.

In case of any message that seems to put pressure to take action immediately, experts suggest confirming the sender by making a call before making any payment.

To protect yourself from WhatsApp and UPI fraud, you need to take some precautions. There are some steps you can take to prevent fraud with WhatsApp and UPI.

The following are precautions that Cybersecurity specialists suggest you take:

• Allow two-step verification for WhatsApp.
• Never provide your OTP, UPI PIN, CVV or banking password.
• Confirm payments by making a separate phone call.
• Don’t follow links in SMS and WhatsApp messages that seem suspicious.
• Do not install APK or ZIP files from untrusted sources.
• Before confirming UPI transactions, verify the recipients’ information.
• Update your phone apps and banking applications.
• Immediately report any suspicious accounts on WhatsApp.
• Prevent unauthorized calls attempting to get urgent payments from an unknown number.

There are some simple checks that can save big money.

If you find yourself a victim, follow these steps:

If you think you may have been scammed:

1.If your bank is contacted right away.
2. Block your UPI account if necessary.
3. Change important passwords.
4. Report the amount of fraud to the National Cyber Crime Reporting Portal.
5.Call the cybercrime helpline as soon as possible 5 – 1930
6. Keep screenshots, transaction ID and chat history available to investigate.

Speedy reporting improves the likelihood of blocking fraudulent transactions before money has been turned over.

Experts have appealed for digital vigilance.

As the Indian digital economy grows, so do the techniques employed by cyber fraudsters. As banks, payment companies and messaging providers roll out improved security, the experts stress that the first line of defense is the user.

It’s best to check all financial requests, to not share personal or financial information, and to be careful when clicking on unfamiliar links or downloading unknown files.

With the scammers getting smarter each year, it’s important to be informed to protect your money and personal data in 2026.