Victims may remain unaware that their UPI account has been taken over on another device as the attack happens silently, as per researchers.