P2P crypto scam India: what to do after a suspicious UPI payment

A P2P crypto scam in India can involve a misleading payment confirmation, a third-party bank transfer, a fake support account, or a buyer who disputes a transaction after asking for crypto to be released. Peer-to-peer trading links an order on an exchange with a separate payment between people. That makes it important to check the payment inside your own bank or UPI app, not from a screenshot sent by the other party.

India’s official cybercrime portal lists 1930 as the helpline for reporting online financial fraud. The Ministry of Home Affairs says the National Cyber Crime Reporting Portal and its financial-fraud reporting system are intended to help people report incidents promptly. If money has left your account or a transaction appears connected to a scam, contact your bank through its official app or phone number and report the incident at cybercrime.gov.in or by calling 1930. Reporting does not guarantee that funds will be recovered, but delay can make a time-sensitive report harder to act on.

Patterns to recognise before releasing an order

  • A payment screenshot instead of a confirmed credit: Screenshots, SMS previews, and forwarded receipts can be altered or refer to a different transaction. Verify the credit in your own bank or UPI history.
  • A sender name that does not match the order: A counterparty may say that a relative or unrelated account is paying. Do not treat a third-party payment as proof that the platform order is safe; follow the exchange’s current P2P rules and dispute process.
  • Pressure to move the conversation elsewhere: A request to leave the platform, use a private chat, or ignore the order’s dispute tools removes useful records and may expose you to impersonation.
  • A request to release crypto before settlement: Never rely on a promise, an “in progress” screen, or a payment reference alone. Confirm that the funds are actually credited and follow the marketplace’s instructions.
  • A later claim that a transfer was unauthorised: Preserve the order record and messages. Do not delete chats or create a new off-platform arrangement to resolve a dispute.

If a payment or crypto transfer looks suspicious

  1. Stop further movement. Do not send another payment, refund money to a different account, or share a one-time password to “verify” the order. Contact the bank and exchange through details found in their official apps or websites.
  2. Save the evidence. Keep the exchange order ID, counterparty profile, chat messages, UPI transaction reference or UTR, bank transaction ID, date and time, amount, screenshots, wallet address, and blockchain transaction hash if crypto was sent. Keep originals where possible and avoid editing the files.
  3. Contact the bank promptly. Use the bank’s official fraud-reporting route and ask for a complaint or service reference. Explain which account was debited or credited and whether the transaction was made through UPI, IMPS, or another channel.
  4. Report through Indian channels. Call 1930 for immediate cyber-financial-fraud reporting and use the National Cyber Crime Reporting Portal. Follow the portal’s instructions and keep the acknowledgement number. The official portal also lists state and union-territory contacts for follow-up.
  5. Open an exchange support case. Use the order’s dispute or appeal facility where available. Provide the order number and relevant transaction evidence, but never share passwords, private keys, recovery phrases, or OTPs.
  6. Secure affected accounts. Change credentials through official sites, revoke unknown active sessions, and review UPI mandates or linked devices with your bank. If a wallet seed phrase or private key was disclosed, treat the wallet as exposed and seek official wallet-provider guidance.

Build a clear incident timeline

Write down when the order opened, when the other person contacted you, when a payment was promised, what your bank actually showed, whether crypto was released, and when you contacted the bank and platform. Save each support case number and the response. A concise timeline helps a bank, exchange, or investigating authority understand which event happened first. Share evidence only through the official reporting forms or secure support channels; do not post full account numbers, identity documents, or transaction screenshots publicly.

Do not assume that a bank freeze, reversal, or account review proves that you are accused of a crime. Nor should you try to bypass a bank restriction by moving funds through another person. Ask the bank for its written process, keep the reference number, and respond through verified channels. For legal questions about a specific account restriction, use a qualified adviser familiar with the relevant facts.

Why P2P records matter

Authorities have described cases in which fraud proceeds were routed through cryptocurrency P2P transactions. That is case-specific information, not evidence that every P2P order is fraudulent. The Enforcement Directorate’s public release on a cyber-fraud investigation describes the use of P2P crypto transactions in the alleged movement of funds. The practical lesson for an ordinary user is to retain complete order and payment records and to avoid accepting or forwarding money whose origin you cannot verify.

Do not trust messages claiming that a fee, tax, or “account release charge” will unlock your money. Check any policy directly in the exchange app or on its verified help centre. A caller who knows an order number can still be an impostor; never reveal credentials or remote-access codes.

Official reporting and further reading

The National Cyber Crime Reporting Portal provides a route to report cyber incidents, and the government lists 1930 for online financial fraud. The Ministry of Home Affairs’ 2026 reporting update explains the national portal and financial-fraud system. The Enforcement Directorate’s public case release gives a specific example of P2P crypto appearing in a cyber-fraud investigation.

This guide explains recordkeeping and official reporting routes; it cannot determine what happened in an individual transaction or promise recovery. Review exchange-security and execution topics in the exchange guides hub, and visit the India English blog archive for more locally relevant crypto explainers.