Truecaller bug automatically registers Indians for UPI; company updates app version

Caller identification app Truecaller automatically started creating unified payments interface (UPI) accounts for Indian users without their consent, several users complained on Twitter on Tuesday.

UPI is a single mobile application for accessing different bank accounts of users and is managed by the National Payments Council of India (NPCI), a not-for-profit company that provides infrastructure to banks for physical as well as electronic payment systems.

The Swedish-based company created UPI accounts of their users with ICICI Bank, and it automatically started sending out UPI-linking requests after the recent update (10.41.6) to the app. 

The affected users received an SMS from ICICI Bank saying, "your registration for UPI app has started. If it was not you, report now to your bank. Do not share card details/OTP/CVV with anyone to avoid financial loss."

IMPORTANT: Uninstall @Truecaller immediately. They sent an unauthorized SMS from my phone to UPI registration. I repeat, this SMS has gone FROM my inbox. If possible uninstall your @ICICIBank_Care app as well immediately. And of course I'm going to follow up with @NPCI_NPCI pic.twitter.com/LXB9BlGkzO

— Shilpa Rathnam (@shilparathnam) July 30, 2019

Thread. I fell victim to a @Truecaller UPI scam this morning. @npci_npci @upi_npci.

— Dheeraj Kumar (@codepodu) July 30, 2019

Too late...ur intentions are debunked. Deleted my account and uninstalled the app.your services cannot be trusted and I will make sure the world knows of it. #ScamAlert

— avinash (@avinash_701) July 30, 2019

@NPCI_BHIM @ICICIBank @PMOIndia @CMOGuj @narendramodi I received this msg. What is this nonsense. They are using our messenger without our knowledge.
Pls take legal action against Truecaller pic.twitter.com/ut62NqNF6Q

— Krupal Raval (@KrupalRaval99) July 30, 2019

“We have discovered a bug in the latest update of Truecaller that affected the payments feature, which automatically triggered a registration post updating to the version,” an official statement from Truecaller said.

“This was a bug and we have discontinued this version of the app so no other users will be affected. We're sorry about this version not passing our quality standards. We've taken quick steps to fix the issue and already rolled out a fix in a new version. For the users already affected, the new version with the fix will be available shortly, however, in the meanwhile, they can choose to manually deregister through the overflow menu in the app."

Dilip Asbe, managing director and chief executive officer, NPCI, clarified that Truecaller’s bug has started the onboarding process but registration can’t be completed without a two-step process that requires an OTP and bank details, The Times of India reported. 

ICICI Bank is yet to issue a statement on the issue.

Truecaller has over 100 million users in India.