Your phone froze after you clicked a link? It could be the start of a UPI scam

Your phone freezes.

You tap the screen again.

Nothing.

You press the power button. Still nothing.

At that moment, most of us do the same thing: panic for about 10 seconds, restart the phone and move on.

But what if someone wanted you to panic?

A new UPI fraud technique being discussed by cybersecurity experts uses exactly that moment of confusion as part of a larger social-engineering trap.

The important caveat: a frozen screen does not automatically mean you have been hacked. Phones freeze for plenty of innocent reasons. But if it happens immediately after you click an unfamiliar link or advertisement — and is followed by a suspicious call or request to install an app — that is when the alarm bells should ring.

Here is how the scam works.

How does the frozen-screen UPI scam work?

According to Harish Kumar, CEO of Quick Heal Technologies, the frozen screen may be less important than what happens around it.

Speaking to NDTV, Kumar said scammers can use the apparent technical problem to create panic and make victims more receptive to instructions from someone claiming to be customer support. The victim may then be persuaded to download an APK — an Android application installation file — supposedly to fix the problem, claim a reward or complete a verification process.

And that is where an apparently harmless technical problem can turn into something much more serious.

The scam is essentially a psychological sleight of hand:

Something appears to be wrong with your phone → someone offers to fix it → you give them access.

Why are scammers interested in your phone rather than UPI itself?

Because they may not need to “break” UPI at all.

Ruchin Kumar, vice-president, South Asia, at Futurex, told NDTV that attackers can instead target the ecosystem surrounding the transaction — including the device, banking credentials, authentication factors and the user's interaction with the payment.

That can include phishing pages, malicious apps, intercepted SMS messages, stolen credentials, accessibility permissions or screen-sharing tools.

In some cases, the victim may even authorise the transaction themselves, without realising what they are actually approving.

That makes the scam particularly sneaky.

There is no dramatic Hollywood-style “account hacked” moment.

You may simply be tricked into doing the final step yourself.

What happens if you install the fake APK?

This is where the scam can become dangerous.

A malicious app may ask for permissions that have little to do with whatever service it claims to provide.

Cybersecurity researchers have warned about fake utility and service applications requesting access to SMS, notifications and Android accessibility features.

According to NDTV's report, the India Cyber Threat Report 2026 by Seqrite Labs documents how such permissions can be abused to harvest sensitive information.

Accessibility permissions are particularly powerful because they can allow an application to interact with elements on a device's screen.

Give the wrong app too much access and you may have handed a stranger a remarkably useful set of keys.

Can scammers steal your OTP?

Potentially, yes — if they have managed to compromise the device or obtain the necessary permissions.

Ruchin Kumar told NDTV that attackers may intercept SMS-based OTPs, steal banking credentials through malicious applications or phishing pages, abuse Android accessibility features or use screen-sharing applications to watch a victim's activity.

But there is another route that requires considerably less technical wizardry.

They can simply persuade you to tell them.

That is the social-engineering part of the scam.

A caller claiming to be from your bank might say your account needs verification. Another might tell you the frozen screen indicates a failed UPI transaction. Someone else may offer to “help” you remotely.

The technology creates the opportunity.

The conversation does the rest.

Why does the UPI PIN still matter?

Because a scammer doesn't necessarily need to discover your PIN through some elaborate cyberattack.

They may simply manipulate you into entering it.

As Ruchin Kumar told NDTV, victims can unknowingly enter their own UPI PIN or approve a transaction after being manipulated by the fraudster.

This is an important distinction.

A UPI PIN is meant to authorise a payment, not to receive money or “verify” your account.

So if someone tells you that entering your UPI PIN will help you receive a refund, cashback, reward or reversal, stop.

That is a giant red flag.

Would your bank ever ask you to share your screen?

No.

A genuine bank or legitimate service provider should not ask you to install a remote-access application or hand over control of your phone to solve an ordinary UPI problem.

Ravindra Singh, managing director of Delcom Telesystems, told NDTV that scammers are increasingly exploiting people's trust in technology by manufacturing urgency around supposed technical problems and then persuading them to install remote-access, screen-sharing or verification applications.

So the rule is wonderfully simple:

If a stranger wants to see your banking screen, don't show them your banking screen.

What should you do if your phone suddenly freezes?

First, don't panic.

And don't immediately follow instructions from someone who calls claiming to know why it happened.

If the freeze occurred after clicking an unfamiliar link or advertisement, NDTV's cybersecurity experts recommend:

Disconnect mobile data and Wi-Fi.

Do not enter your UPI PIN, banking password or other credentials.

Do not install an APK sent by an unknown person.

Do not install remote-access or screen-sharing software at someone's request.

Check recently installed applications.

Review and revoke unnecessary Accessibility, notification and device-administration permissions.

Run a scan using a trusted security solution.

Check your bank account and recent transactions if you suspect anything is wrong.

And if you believe money has actually been stolen, contact your bank immediately and report suspected financial cyber fraud on 1930, India's cyber-fraud helpline.

So, is every frozen phone a scam?

Absolutely not.

This is perhaps the most important part of the warning.

Phones freeze. Apps crash. Networks fail. Screens hang.

A frozen screen by itself is not evidence of fraud.

The concern arises when the freeze becomes the opening act in a suspicious sequence: an unknown link, a sudden technical “problem”, a caller claiming to be support, a request to install an APK, a demand for screen access or an instruction to enter banking credentials.

That combination is very different from your phone simply having a bad day.

And as India's UPI habit grows, the scam industry's playbook is evolving too.

The old trick was: “Give me your OTP.”

The newer trick can be much more elaborate:

“Your phone has a problem. Let me fix it.”

Sometimes, the most dangerous person isn't the one trying to steal your password.

It's the one convincing you to hand it over.

(With inputs from yMedia and agencies)