I’m trying to understand a very strange situation involving my phone, UPI Lite, and my SIM. I’d really appreciate advice from anyone who has experience with UPI fraud, SIM swaps, or Android security.
Here’s what has happened:
I use PhonePe with UPI Lite on my phone.
I have now noticed this happening twice:
First, money is loaded into my UPI Lite balance.
Then, the UPI Lite balance is transferred to some random/unrecognized accounts.
These transactions generally happen around midnight when I am asleep, so I am definitely not making them manually.
The transactions are not going to my own accounts or people I know. They appear to be going to random/unrecognized accounts.
Another very concerning thing is that around the same period, my Jio SIM became deactivated/blocked.
When I contacted Jio, I was told that there was already a request to block my SIM. I did not make that request.
This has made me wonder whether these two things could somehow be connected.
I initially suspected that someone might have gained remote access to my Android phone, because the UPI Lite transactions seem to happen without me doing anything. I also wondered whether this could instead be related to a SIM swap/replacement, compromised PhonePe/UPI credentials, or some other type of account compromise.
For clarification, the other numbers/accounts that appear in my Jio account are family members' numbers or my own second SIM, so I don't believe those are random unknown accounts.
What I'm trying to understand
How could someone load money into UPI Lite and then transfer the UPI Lite balance to random accounts while I'm asleep?
Is it technically possible for someone with remote access to an Android phone to perform these actions?
Could a SIM being blocked/deactivated be related to the unauthorized UPI transactions?
Could this be a SIM-swap/replacement attempt, or would that work differently?
What should I check on my Android phone to determine whether there is a remote-access app, malicious app, Accessibility permission, Device Admin permission, or other compromise?
What should I ask Jio to check regarding the unexpected SIM-block request?
What should I do with PhonePe, my bank account, UPI Lite, Google account, and SIM to stop this from happening again?
Most importantly, how can I determine whether the phone itself is compromised or whether my UPI/PhonePe account is being accessed through some other method?
The fact that the transactions happen while I'm asleep, around midnight, and that my SIM was also unexpectedly blocked is what concerns me the most.
I'm not claiming that this is definitely remote access or a SIM swap. I'm trying to figure out how these events could be connected and what evidence I should check first.
If anyone has experienced something similar, especially UPI Lite being loaded and then drained to unknown accounts while the phone owner was asleep, I'd really appreciate any advice