Frozen-Screen UPI Scam: How A Technical 'Glitch' Can Drain Your Bank Account

A phone that suddenly freezes after clicking a social media advertisement or unfamiliar link may appear to be a routine technical glitch. However, in a growing form of digital fraud, the frozen screen can be used as a distraction to create panic, manipulate users, and ultimately gain access to sensitive financial information.Cybersecurity experts warn that such incidents are increasingly moving beyond conventional phishing. Fraudsters are combining malicious applications, social engineering, remote-access tools and Android permissions to compromise devices and manipulate users into authorising fraudulent transactions.According to Harish Kumar, CEO, Quick Heal Technologies, the frozen screen is often "not the real event, but the distraction." Scammers may use fake error messages, advertisements or calls posing as customer support representatives to convince victims that there is a problem with their phone, banking application or UPI account. "Victims may then be persuaded to download an APK disguised as a reward, cashback, verification or service application," Kumar told NDTV.Once installed, malicious applications can abuse accessibility, notification and other permissions to monitor activity, read OTPs, control elements of the screen and potentially simulate user actions. Kumar points to the India Cyber Threat Report 2026, prepared by researchers at Seqrite Labs, which documents how fake service and utility applications can request SMS, call and notification access to harvest sensitive information.The sophistication of these attacks also means that fraudsters do not necessarily need to defeat UPI's underlying security mechanisms. Ruchin Kumar, Vice President - South Asia, Futurex, told NDTV that attackers typically seek to compromise the device, credentials, authentication factors or transaction flow surrounding the payment rather than "break" UPI encryption."This could involve intercepting SMS-based OTPs, stealing banking credentials through fake applications or phishing pages, abusing Android accessibility permissions, or using screen-sharing applications to observe the victim in real time. In some cases, social engineering does much of the work, with the victim unknowingly entering their own UPI PIN or approving a transaction," Ruchin added.This makes the resulting transaction particularly difficult to distinguish from a legitimate payment. The victim may have technically authenticated the transaction, even though the authentication was obtained through manipulation or device compromise.The problem, however, is not limited to banking applications or cybersecurity software. Ravindra Singh, Managing Director, Delcom Telesystems, emphasises that the device, applications and user are all part of the security chain. "Fraudsters are increasingly exploiting trust in technology by creating urgency around a supposed technical issue and then persuading users to install remote-access, screen-sharing or verification applications," Singh told NDTV.How To Stay ProtectedTherefore, the immediate response after a suspicious freeze is critical. Users should disconnect mobile data and Wi-Fi, avoid entering banking credentials or UPI PINs, and refrain from following instructions from unsolicited callers claiming to provide technical support. Suspicious applications should be removed, unnecessary accessibility and device-administration permissions revoked, and the device scanned using a trusted security solution.If financial information may have been compromised, users should contact their bank through an official channel, check recent transactions, change relevant credentials from a clean device and report suspected financial fraud through helpline number 1930.As digital payments become increasingly embedded in everyday life, the security of a transaction depends on more than authentication alone. Strong device security, secure applications, fraud monitoring and informed user behaviour must work together. The simplest warning sign may therefore be the most important one: a genuine bank or service provider will not ask a customer to install a remote-access application or share their screen to resolve a routine UPI issue.