User receives a link via SMS. On clicking on the link they are redirected to an installed UPI app on your phone and their money is deducted from their bank account.
User receives a link via email/SMS which is a phishing website, asking them to update PAN/Aadhar instantly otherwise their account will be blocked. They click on the link and enter their credentials; post which their account is debited.
The user is asked to scan the QR code to make a payment (Paytm/GooglePay). By scanning the user unknowingly gives them access to their app and their account gets debited and they lose their money.
Someone steals the user's card details and uses it without their knowledge.