Under the Radar: Phishing Websites Masquerading as UPI Gateways to Secretly Steal Customer Data

Many threat actors are moving away from utilizing brand logos or impersonating phishing websites as their top phishing tactics. Their  methods to steal information in mass quantities is constantly advancing, and they’re learning to operate discreetly to bypass typical AI detection systems.

India’s BFSI sector is a primary target for scammers due to its extensive customer base. The existing knowledge disparity makes this base especially susceptible.

In a study, the Bolster Research team uncovered several phishing pages that appeared similar and offered UPI Gateway and recharge services. These pages also pitched Retailer and Dealership opportunities to Indian clientele. However, the disguised process of account registration included the illicit acquisition of personal details, including email, phone number, PAN, and Aadhaar Card numbers. This data can pave the way for a spectrum of fraudulent undertakings.

In recent reports, several scammers have been caught illicitly acquiring and selling the PAN & Aadhaar cards of numerous users. It’s plausible to believe that this exposed phishing campaign could be one method they utilized to accomplish this.

Under the Radar Phishing Campaign

In the recent wave pf cyber scams, malicious actors have set their sights on UPI payment channels, especially after NPCI unveiled the UPI Plug-in service in July 2022.

This innovation empowered banks to seamlessly connect their apps with merchant interfaces, eliminating the need for intermediary vendors such as GooglePay and PhonePe.

Historically, we’ve seen scammers masquerade by designing fake sites that impersonate logos and brand names from legitimate companies. While these counterfeit sites were identifiable using AI tools that analysed logo patterns, text resemblances, or utilised computer vision hashing, the current widespread campaign is showing a shift in tactics.

Instead of mimicking recognised brands, these threat actors now act directly as businesses, persuading consumers to disclose personal identifiers: Aadhaar Card Numbers (a unique identifier for Indians), PAN Numbers, Business Names, Email Addresses, and Phone Numbers. Once in possession of this information, these fraudsters can launch a series of manipulative social engineering attacks on each individual.

A Deeper Dive into Phishing Websites

The Bolster research team discovered some revealing trends in phishing websites that show evolving scam techniques.

Key findings

We found the following trends in our research:

• These scams predominantly target small businesses and local vendors who are keen on transitioning to digital transactions but are unfamiliar with payment gateway services.

• At the time of writing this report, there were over 150 active phishing websites, all using one of three templates, offering similar services.

• The majority of these phishing websites operate on a subscription model and steals PII information during registration process. Since they’re generated from the same template, their pricing structures are often similar.

• Some of these sites provide services like QR code generators for digital transactions, requiring the payee’s UPI ID.

• During the analysis we have discovered a few phishing websites associated with old scam campaigns similar to Aadhaar printing scam and UPI reward scam.

• We identified a phishing-kit that was employed to craft a specific type of phishing website during our investigation.

Modus operandi

In this campaign, scammers are employing more sophisticated and genuine-looking websites to t users into divulging their personal information, despite the tactic not being entirely new.