Teen flags flaws in UPI apps after father loses Rs 20,000 in online fraud

Ankit Thakur, a B.Tech student specializing in Computer Science from Haryana, has uncovered several critical vulnerabilities in the UPI (Unified Payments Interface) applications, which could potentially be exploited by cybercriminals. This discovery stems from a personal tragedy; in 2020, his father, a professional driver, fell victim to an online scam that cost him Rs 20,000. This incident spurred Thakur to investigate the mechanics of UPI apps and identify any weaknesses that fraudsters might leverage. Since June 2025, Thakur has been reporting these security flaws to Google's security team. His efforts have not gone unnoticed, as Google confirmed the acknowledgment of these vulnerabilities and implemented necessary fixes by February 2026. The flaws he discovered include the Chrome Intent Vulnerability, Authentication Bypass, and a particularly concerning issue known as Audio Hijack. The Chrome Intent Vulnerability allows malicious websites to access UPI applications without user consent, effectively creating an open gateway for scammers. The Authentication Bypass threat compromises the initial security measures, such as app locks and biometric authentication, which are essential to safeguarding UPI transactions. Thakur emphasized that both Google Pay and Paytm have recognized his findings and have addressed these issues. Perhaps the most alarming of the vulnerabilities is the Audio Hijack. Thakur explained that this flaw prevents UPI apps from properly securing audio focus during transactions. As a result, a deceptive app running in the background could play audio that misleads users into thinking it’s coming from the legitimate payment app, thereby increasing the risk of fraud. It’s important to note that Google conducts thorough assessments before validating the seriousness of reported flaws. Once confirmed, they issue critical updates to enhance the security of their Android ecosystem, underscoring the necessity for smartphone users to keep their devices updated with the latest security patches and app versions.