ICICI Bank, one of India’s leading financial institutions, has issued a cautionary alert to its customers, urging them to protect their bank balances from an emerging UPI app scam. The bank revealed that fraudsters are exploiting malware to orchestrate unauthorized transactions through UPI.
How the Scam Operates:
The scam involves the use of custom SMS forwarding apps that send a UPI device-binding message to the mobile number linked to the bank customer’s account. This message prompts the recipient to register, initiating the fraudulent activity. Criminals then use WhatsApp to send malicious apk files, designed to install apps on mobile phones. These files use sophisticated compression techniques to evade antivirus scans. The fraudsters proceed to initiate a UPI registration using the compromised device.
ICICI Bank has cautioned customers against installing suspicious apps or files received via SMS or instant messaging apps, emphasizing that the bank never sends messages via SMS or WhatsApp requesting information, calls, or file downloads.
Tips to Avoid Phishing and Fraud:
ICICI Bank shared essential best practices to ensure the safety of customers’ bank accounts:
- Keep mobile devices updated with the latest security patches and operating systems.
- Refrain from installing apps from third-party or questionable links. Download apps only from trusted sources like Google Play Store or Apple App Store.
- Install a reputable antivirus software to protect devices and data.
- Check app permissions before granting access.
- Avoid clicking on suspicious links.
- Keep sensitive information such as OTP, PIN, and passwords confidential, and never share them with anyone.
- Report any instances of cyber fraud or phishing immediately to the National Cyber Crime Portal.
Secure Way to Make UPI Payments:
ICICI Bank recommends using its official app, iMobilePay, for secure mobile-based payments via UPI. Customers can download the app from Google Play Store or Apple App Store to:
- Make payments to any number or QR code.
- Transfer funds to accountholders of other banks.
- Link any bank account to their UPI ID.
