UPI collect-request impersonation

On 11 October 2026 at about 14:20, the complainant R. Mehta (synthetic) of Navrangpura, Ahmedabad received a call from +91 90000 41207. The caller said he was an officer from "Demo Bank" refunds department and that a refund of ₹2,300 was pending. He asked the complainant to approve a UPI collect request to receive the refund. The complainant approved a request from the handle refund.help@okdemo and ₹48,500 was debited, transaction reference UTR 6281 0042 7731. The caller then asked for an OTP, which the complainant did not share. A follow-up SMS came from the same number with a link to demo-refund-help.example.com.

• Investigation Intelligence

  Every case starts from the complaint: entities, timeline, summary and related cases are drawn from its text.

• Cyber / Network Forensics · added manually

  Digital payment details may yield indicators (handles, numbers, links). Optional — packet analysis is not applicable without a capture.

• Bank nodal officer request drafted; awaiting response on beneficiary account (synthetic).

  13 Oct 2026, 11:00

Category

UPI / payment fraud

Location

Navrangpura, Ahmedabad

Incident time

11 Oct 2026, 19:50

Context

—

Created

12 Oct 2026, 10:00

Updated

15 Oct 2026, 16:40

• PCAP / PCAPNG capture — packet analysis cannot run without one · Cyber

1. Case created from synthetic sample

   12 Oct 2026, 10:00