The fake mutual fund SIP cancellation scam has been growing quietly through 2025 and into 2026, and it targets a specific group: people who actually invest. If you have a running SIP with any fund house — SBI Mutual Fund, HDFC MF, Mirae Asset, Axis, Nippon — you're on their radar. These fraudsters don't pick randomly. They go after people with real money in real accounts.
The trigger is panic. Specifically, the fear that your SIP will be permanently cancelled and your investments disrupted unless you act right now, in the next two hours.
What this scam is and who is running it
Simply put: scammers pose as representatives of your mutual fund company, AMFI, SEBI, or your bank. They contact you about a fake "cancellation notice" for your SIP mandate, then trick you into approving a UPI transaction or sharing an OTP that drains money from your account.
Kotak Mutual Fund had to publicly warn investors in 2026 about fake social media accounts and individuals impersonating their staff and fund managers. They're not alone. HDFC, SBI MF, Axis, and others have issued similar advisories through the year. In one high-profile operation, UP Police arrested 12 people across 6 states running a pan-India cyber investment scam network. These aren't lone wolves. They're organised, they have your data, and they know exactly how to sound convincing on a call.
How do they get your details? Leaked databases from smaller fintech apps, data brokers selling investor lists, and phishing pages disguised as AMC login portals. Sometimes it's as simple as a public social media post where someone mentions starting a SIP with a specific fund house. That's all they need to open the conversation. (Sketchy, honestly, how little data it takes.)
How the scam unfolds, step by step
The sequence is depressingly consistent once you know it.
Step 1. You get a call — sometimes WhatsApp, sometimes a regular number — from someone who introduces themselves as being from your AMC's "investor services team" or "mandate management unit." They use your name correctly. They mention the specific fund house you're invested with.
Step 2. They tell you your SIP is scheduled for cancellation within 24 to 48 hours. The stated reason varies: a new SEBI compliance rule, an RBI auto-debit mandate update, an expired bank mandate, a KYC mismatch. The specific excuse doesn't matter. The urgency is the whole point.
Step 3. To "save" your investment, they ask you to verify your identity by sharing an OTP sent to your phone. That OTP is actually from your bank for a UPI or net banking transaction they have already initiated on another device. The moment you read it out loud, money leaves your account.
Step 4. Alternatively, they send a UPI collect request or a QR code — framed as a "Rs 1 verification charge" or a "nominal Rs 10 processing fee" to re-register your mandate. You approve what looks like a trivial charge. What actually gets deducted is far more. Or they use that approved request to link your UPI to their account and initiate multiple withdrawals over the following days.
Step 5 — the follow-up attack. Some victims get called back days later by a "senior fraud investigation officer" who says the earlier transaction triggered a security flag and they need to transfer money to a "safe account" for verification. This second-round attack targets people who were already fooled once, counting on them being confused and scared enough to comply again.
Warning signs you're being targeted
These aren't subtle once you know what to look for.
- Any call claiming your SIP is being urgently cancelled. Real AMCs communicate mandate issues via registered email, official app notifications, or written letters — not panicked phone calls with a 48-hour deadline.
- Requests for OTPs, UPI PINs, or net banking passwords during a call. No legitimate financial institution will ever ask for these over the phone. Full stop.
- UPI collect requests from unknown IDs, especially for suspiciously small amounts like Rs 1 or Rs 10.
- The caller knows your name and fund house but then asks you to "confirm" your SIP amount, bank account number, or PAN. That's data collection for a larger fraud, not verification.
- Pressure language: "your mandate expires in 2 hours," "you'll permanently lose your corpus," "this is your last window to save your SIP."
- Any request to install a screen-sharing app like AnyDesk, QuickSupport, or TeamViewer to "check your account." Once they see your screen, your OTPs and banking apps are live in front of them in real time.
- WhatsApp messages with AMC logos linking to "re-register your mandate" pages — those links lead to phishing sites built to steal your login credentials.
The Economic Times reported a related UPI scam variant where fraudsters transfer Rs 200 to a victim's account, claim it was an error, then ask them to return Rs 20,000. Same psychology: fabricate an official-sounding problem, offer a simple solution, take money. The SIP cancellation scam is exactly that formula applied to mutual fund investors. And I think that's why it works so well — people who invest are already primed to take financial communication seriously. That's the instinct being exploited here.
How to protect yourself and your investments
Almost all of this comes down to slowing down. Urgency is the core weapon here. Take it away and the scam falls apart on its own.
- Hang up and call back officially. If anyone calls about your SIP, end the call and contact your AMC's customer care yourself. Find the number on amfiindia.com or the fund house's official website — never from a Google search result that might surface a paid scam ad. Do not redial the number that called you.
- Check your actual SIP status yourself. Log into MF Central (mfcentral.com), your AMC's official app, CAMS Online, or KFintech. If your SIP was genuinely at risk, you'd see it there. In almost every reported case of this scam, the investor's SIP was perfectly fine. The cancellation story was pure invention.
- Never share OTPs over a call about your investments. Not for Rs 1. Not for "verification." Not for any reason. This single rule prevents this scam entirely.
- Decline unknown UPI collect requests immediately. If you don't recognise the UPI ID, reject the request. You can check who sent it in your UPI app history before approving anything — take those ten seconds.
- Set per-transaction and daily UPI limits in PhonePe, GPay, or Paytm. Keep them calibrated to your actual usage. If a fraudulent request somehow gets through, lower limits mean lower damage.
- Never install remote access apps on a stranger's instruction. This is the same mechanism behind WhatsApp screen mirroring fraud — full access to your phone, your OTPs, your banking apps, all of it handed over voluntarily.
The RBI has directed all banks to integrate DoT's Fraud Risk Intelligence (FRI) technology to detect suspicious transaction patterns. Your bank may send you alerts about unusual UPI activity. Don't dismiss those. And if you're investing through a SEBI-registered distributor or advisor, their contact details are on the AMFI portal. Verifying your financial contacts through official registries is a habit worth building. (Annoying extra step, I know, but it pays off.)
Honestly, the single most useful thing you can do is treat any unsolicited call about your investments as suspicious by default, no matter how official the caller sounds. Real AMCs send emails. They send app notifications. They don't call you in a panic on a Tuesday afternoon demanding OTPs to prevent an imminent catastrophe.
If you have already been scammed, move immediately
Call 1930 right now. That is India's national cybercrime helpline. Reporting within the first few hours can sometimes get a transaction flagged before it clears, giving your bank a window to reverse or freeze it. Every hour matters here.
File a complaint at cybercrime.gov.in. Even if you've already called 1930, do this too. A written complaint creates a formal record that supports your bank's fraud dispute process and any police investigation that follows.
Call your bank's fraud helpline and ask them to flag the specific UPI transaction or put a temporary hold on outgoing transfers. Most banks have a dedicated escalation path for UPI fraud — ask for it specifically, not just general customer care.
Document everything before you do anything else: screenshots of WhatsApp messages, the UPI transaction ID from your bank statement or UPI app history, the phone number that called you, and a clear timeline of what was said and when. This documentation is what determines whether a fraud recovery claim succeeds — without it, disputes are significantly harder to win. In my experience, people who skip this step end up stuck. Banks need specifics, not just a complaint.
CERT-In at cert-in.org.in publishes regular cybersecurity advisories on investment fraud patterns targeting Indian users. Worth checking if you invest through mobile apps. And verify your actual SIP status on MF Central right after any suspicious interaction. In almost every documented case, the SIP itself was untouched. The damage was entirely to the victim's bank account, not their investment portfolio.
One more thing. If you've helped a parent, sibling, or colleague start their first SIP recently — tell them about this scam. First-time investors are often less familiar with how AMCs actually communicate. A five-minute conversation could save them a real loss. Understanding how UPI investment fraud works in India is part of being a reasonably safe investor in 2026, and the more people around you who know this, the harder it gets for these scams to keep running.
