Instant payment systems — UPI, PIX, Zelle, FPS, SEPA Instant and others — move money between accounts in seconds, at any hour. That is genuinely useful, and it is also why fraud on these rails is so damaging: by the time you realise, settlement has already happened.
The single rule that prevents most of it
You never authorise anything to receive money. No PIN, no password, no biometric. If someone sending you money asks you to enter your PIN or approve a request "to receive the credit", they are collecting a payment from you. This one rule defeats a large share of instant-payment fraud on its own.
Common variants
- Collect requests disguised as refunds, cashback or a marketplace buyer paying you.
- An "accidental" transfer into your account followed by a plea to send it back — the original credit is often itself stolen or later reversed.
- A QR code presented as the way to receive payment. Scanning a QR sends money; it does not receive it.
- A support number found through a search engine rather than the official app, connecting you to a fraudster who walks you through authorising a payment.
What recovery actually depends on
There is no chargeback mechanism on these rails. Recovery depends on the funds still being present in the receiving account when the bank acts, which is why minutes matter. Professional operations move money onward within seconds, often through several accounts, which is why fast reporting genuinely changes outcomes and slow reporting rarely does.
What to do in the first hour
- Call your bank's fraud line and use the words "unauthorised payment, please attempt a recall".
- Record the transaction reference, timestamp, amount and the receiving handle or account number.
- File with your national cybercrime authority the same day — some countries operate a rapid reporting line specifically for financial fraud.
- Do not send anything further, including any amount described as necessary to reverse the first.