When Ads Turn Predatory: Tracing UPI Scams on Meta Platforms.

As ₹805 crore in UPI frauds pile up this financial year, scammers are weaponising Meta Ads to push fake government payouts.This OSINT investigation traces how AI-generated ads in eight regional languages redirect users to fraudulent payment traps—revealing the scale, coordination, and gaps in platform oversight.

The parliament announced on December 15, 2025, that during the current financial year (FY2025-26) up to November 2025, India has reported UPI frauds amounting to ₹805 crore.

On December 15, 2025, we published a report exposing scammers who exploit Meta Ads to target users with a ₹5,000 lure, falsely invoking government schemes such as the Pradhan Mantri Rojgar Yojana and the Pradhan Mantri Mudra Yojana. 

Meta provides advertisers with features such as tailored audience targeting, various ad formats, and specific placements to enhance their reach. Unfortunately, some scammers are producing Meta ads with AI-generated content, leading to links directing users to fraudulent websites that are frequently associated with fake investment calls and UPI-related scams.

This in-depth OSINT-based investigation, a follow-up to our previous report, examines a similar but ongoing scam that has widened its reach, targeting people in eight Indian regional languages, including Malayalam

What did we find?

While exploring the Meta Ad Library, we came across a Facebook page under the name Todays-winnersz. The page as on December 17, 2025, has 353 followers. The page lists the email address as “todaysss.winnners@gmail.com” and provides the address as “Delhi, Delhi, India, 110021”.

The transparency section of the page denotes that the page was created on November 19, 2023, in the name Chameli and changed its name to Todays-winnersz on November 26, 2025.

We found that the advertisement is currently running on Meta in eight Indian regional languages—Malayalam, Telugu, Tamil, Odia, Kannada, Bengali, Hindi, and Gujarati—and features an image of Prime Minister Narendra Modi along with the logos of PhonePe and Paytm.

What does the Ad in Malayalam say?

The Malyalam text on the advertisement read,”പുതുവത്സരാഘോഷ വേളയിൽ എല്ലാ ഇന്ത്യക്കാർക്കും പ്രധാനമന്ത്രി നരേന്ദ്ര മോദിയിൽ നിന്ന് 2000 രൂപ വരെയുള്ള സമ്മാനങ്ങൾ ലഭിക്കും. ഓഫർ നേടുക” ക്ലിക്ക് ചെയ്ത‌് ഇപ്പോൾ തന്നെ നിങ്ങളുടെ ബാങ്ക് അക്കൗണ്ടിലേക്ക് അയയ്ക്കുക.” which translates to,”On the occasion of New Year’s Eve, all Indians will receive gifts worth up to ₹2000 from Prime Minister Narendra Modi. Click “Get Offer” and get it sent to your bank account now.”

The Facebook page started the ad on December 16 and as on December 17, is active for 10 hours on both Facebook and Instagram. With the amount spent between ₹300-₹399, the estimated audience since is more than one million.

Under the “About the disclaimer” section, we identified that the advertiser submitted key information such as Phone number as “+919064938384,” email address as “surya.singh.20072001@gmail.com,” and address as “North West Moti Bagh, Delhi”.

The section “About the advertiser” indicates that the advertiser also has an Instagram account with 32 followers.

Ad using the PM’s voice

Another advertisement from the same advertiser uses Prime Minister Narendra Modi’s voice to urge viewers to click the “Get Offer” button, promising ₹5,000 credited directly to their PhonePe account on behalf of the BJP government.

The advertisement ran from December 15 to December 16, reaching an estimated audience of over one million people. We couldn’t independently verify, but the voice of the Prime Minister is, in all likelihood, a deepfake.

Website attached to the ads:

Website associated with the Malayalam Advertisement:

OBC found that the ad’s link redirects users to language-specific webpages under the domain “winnerz-todayz-now.live.” Regardless of the language, all pages share the same layout, displaying images of Prime Minister Narendra Modi, the BJP logo, the PhonePe and Paytm logos, and a New Year 2026 greeting. The content urges visitors to take advantage of an opportunity to receive up to ₹5,000 directly from the Prime Minister.

The Whois report, a widely used Internet record listing that identifies who owns a domain, of the domain revealed that it was registered on October 31, 2025, expires on October 31, 2026, and was last updated on November 5, 2025.
Maintaining operational security, we safely accessed the website and discovered that clicking anywhere prompted a pop-up inquiring if we would like to receive the payment via PhonePe or Paytm.

To understand the pop-up, we examined the webpage’s backend code and identified a script designed to trigger a payment from the visitor’s PhonePe or Paytm account.

Screenshot of the redacted script highlighting key aspects.
We analysed the script and noticed that it contains two functions, one for PhonePe and the other for Paytm, which facilitates a peer-to-peer transaction of ₹958 from the victims Unified Payments Interface (UPI) ID to the UPI ID “collect.now.upto.2000@okicici”. After the payment is successful, the victim will also see a prompt that says “Send To Your Bank”, making the victim believe that the amount is credited to their bank account.

Website associated with the ad featuring PM’s voice:

We identified that the link associated with the ad redirects to a webpage under the domain “win-offers.live“ and it doesn’t have the logo of any payment app. Like the Malayalam advertisement, it also showcases the Prime Minister, the BJP logo, and Hindi text to attract targets with a ₹5000 offer.

The domain was registered On November 29, 2025, expires on November 29, 2025, and was last updated on December 9, 2025. We analysed the website similar to the Malayalam one and found that in the backend, the website contains a JavaScript that initiates a payment from the victim’s PhonePe app.

We noticed that a part of the script is Base64-encoded and
initiates a peer to peer transaction of ₹1478 from the victim’s PhonePe account to another UPI ID.

We analysed the Meta Ad Library of Todays-winnersz and found that the page has run several similar advertisements since November 26, 2025, and all of them feature PM Narendra Modi and exhibit a certain amount as bait. As on December 17, seven ads are active.