Short answer: The single most important rule for UPI safety is this: you never need to enter your UPI PIN to receive money. Your PIN is only for sending. Almost every UPI scam tries to trick you into entering your PIN or approving a request under the guise of a refund, payment, or prize. Never share your UPI PIN or OTP, never scan a QR code to “receive” money, and never install a screen-sharing app at anyone’s request.
UPI is fast, convenient, and largely safe, but scammers target the user, not the system. Here is how to protect yourself.
The one rule that stops most UPI fraud
Remember this and you defeat the majority of scams: money leaves your account only when you enter your UPI PIN. You never need your PIN to receive money.
Fraudsters make their living by disguising an outgoing payment as an incoming one. If anyone asks you to enter your UPI PIN, approve a request, or scan a code “to receive” money, a refund, or a prize, it is a scam. Full stop.
The most common UPI scams in India
Knowing the playbook makes these easy to spot:
- Collect request scam: a fraudster sends a payment “collect request” disguised as sending you money. Approving it debits you instead. (Note: person-to-person collect requests have been discontinued on UPI, which closes off one major version of this scam, but stay alert to any request to approve a payment.)
- QR code scam: you are told to scan a QR code to receive money, a refund, or cashback. Scanning and approving actually sends money out. Fraudsters also paste fake QR stickers over a shop’s real one to divert payments.
- Fake customer care scam: a fake “bank” or “app support” number or caller asks for your UPI PIN, OTP, or card details to “fix” an issue.
- Screen-sharing app fraud: you are persuaded to install a remote-access app (like AnyDesk or TeamViewer) so someone can “help”, then they watch you enter your PIN.
- Phishing and fake KYC links: a link claims your account or KYC will be blocked unless you act now, leading to a fake site that steals your details.
- Fake UPI apps: lookalike apps that ask for excessive permissions and harvest your information.
- Fake payment screenshot scam: a “buyer” sends a forged payment confirmation to a seller who has not actually been paid.
Notice the common thread: every one relies on urgency, impersonation, or confusion to get you to share a secret or approve a payment.
8 habits that keep your UPI safe
- Never share your UPI PIN or OTP with anyone. No bank, NPCI, or genuine company will ever ask for them.
- Never enter your PIN to receive money. Incoming payments and refunds are automatic and need no PIN.
- Never scan a QR code to receive money. Scanning is for paying, not receiving.
- Verify the name before you pay. Check the registered recipient name in the app before confirming any transfer.
- Decline unknown payment requests. If you did not initiate it, do not approve it.
- Never install screen-sharing or remote-access apps at the request of a caller claiming to be support.
- Ignore urgency and fear tactics. “Account blocked”, “KYC expired”, “last chance” are classic pressure tricks. Slow down and verify independently.
- Download apps only from official app stores, and set a strong device lock and separate UPI PIN.
What to do if you are defrauded
Speed is everything, because quick reporting improves the chance of recovery:
- Contact your bank immediately and block your account or UPI if needed.
- Report in your UPI app, using the report or raise-dispute option on the transaction.
- Call 1930, the national cybercrime helpline, and file a complaint at cybercrime.gov.in. Note the reference number.
- Keep all evidence: screenshots of the transaction, any chat or SMS, and the scammer’s details.
- Act within 3 working days. Under RBI rules, reporting an unauthorised transaction quickly limits your liability, and prompt action gives the bank the best chance to freeze the money before it is withdrawn.
Frequently asked questions
Do I need to enter my UPI PIN to receive money?
No, never. Your UPI PIN is only required to send money. Anyone asking you to enter it to receive funds is trying to scam you.
Can someone steal money using just my UPI ID?
No. Your UPI ID alone cannot debit your account. Money leaves only when you enter your UPI PIN, so keep your PIN secret and never approve unknown requests.
Is it safe to scan a QR code?
Scanning a QR code is for making a payment, not receiving one. Never scan a code that someone sends you claiming you will receive money, a refund, or cashback.
What should I do if I approve a fraudulent UPI payment?
Act immediately: contact your bank, report it in your UPI app, call 1930, and file a complaint at cybercrime.gov.in. Reporting within 3 working days helps limit your liability and improve recovery chances.
How do screen-sharing scams work?
A fraudster posing as support convinces you to install a remote-access app, then watches your screen as you enter your PIN or OTP. Never install such apps at anyone’s request.
With Jupiter: send and receive money via UPI on Payments and track every transaction in real time from your Savings Account, so anything unusual is easy to spot.
Bank with confidence
Most UPI fraud is preventable with awareness and a few firm habits. Managing your money in a single, secure app also helps you spot anything unusual fast. With Jupiter, you can track every transaction in real time and stay in control of your money. Jupiter is the 1-app for everything money.
This article is general information, not financial or legal advice. RBI liability rules and reporting timelines apply subject to conditions and are subject to change. Always report any fraud to your bank and the authorities without delay.
