Truecaller signs up users for UPI account without their knowledge, says its a bug

UPDATE: We reached out to the National Payments Corporation of India (NPCI) and a spokesperson told us in an emailed statement: “There was an issue in the app observed today. We have been updated that last night’s migration had resulted in a bug in the workflow. We understand that it is being fixed and till then user onboarding has been stopped in this app. NPCI ensures to take action if found non-compliant”. Truecaller is in the middle of what users are calling a ‘UPI scam’ in making! This morning, Truecaller users on Android woke up to the app automatically creating UPI accounts for ICICI Bank, without their consent. Apparently, this issue has been noticed after the recent app update to the version 10.41.6. To recall, in 2017, **Truecaller had partnered ICICI Bank** to launch its UPI-based mobile payment service. [caption id=“attachment_6840541” align=“alignnone” width=“1024”]  Truecaller app on Android.[/caption] Among the many Truecaller users who raised this complaint was  Twitter user Dheeraj Kumar (@Codepodu), who shared a detailed thread on the said “UPI scam”. We reached out to Kumar, who told us that he was first suspicious when he received a message from ICICI bank saying that his UPI account had been activated. Notably, Kumar does not have an account with an ICICI Bank. When he looked through his inbox, he saw that Truecaller had covertly sent an encrypted SMS from his phone to an unknown number to get the service activated.

More from News & Analysis

What is the US HIRE Bill and why is India’s $250-billion IT sector worried? Is the internet dead? What's this theory that OpenAI's Sam Altman says might be true?

Kumar says that he reached out to National Payments Corporation of India (NPCI) about the same, and was told that they are investigating into the matter. He even reached out to Truecaller and ICICI Bank, but he told us he hadn’t heard back from them.

@Truecaller
Dear Truecaller without my permission how can u register my bank for UPI.

This is totally unauthorized step you did.@CyberDost pls look into this.

— Neelkamal 🇮🇳 (@Neelkamal_India) July 30, 2019

I too got a message like this today.

— பாலா... (@brubala) July 30, 2019

@TruecallerHelp @Truecaller latest Android version 10.41.6 automatically sends SMS from my SIM to register my UPI Bank A/C to Truecaller pay without my consent the moment I updated to the latest version of the app.
This is quite unacceptable & serious breach of privacy policy.

— Shuvodeep Ash (@geeky_ash) July 30, 2019

We reached out to Truecaller to know more about this and a company spokesperson told us: “We have discovered a bug in the latest update of Truecaller that affected the payments feature, which automatically triggered a registration post updating to the version. This was a bug and we have discontinued this version of the app so no other users will be affected. We’re sorry about this version not passing our quality standards. We’ve taken quick steps to fix the issue, and already rolled out a fix in a new version. For the users already affected, the new version with the fix will be available shortly, however, in the meanwhile, they can choose to manually deregister through the overflow menu in the app." Basically, we were told that Truecaller has pulled back the affected version so that no new users face the issue. However, for users have already upgraded to the version 10.41.6, they will remain on the same version of the app but Truecaller has delisted them from the UPI requests. The company is apparently working on a fix for this and will roll out a new version soon. At the time of writing the story, when we checked the Play Store, we noticed that the app has been taken back to version 10.40.7.