The Golden Rule: Never Enter Your PIN to Receive Money
This is the most important rule of UPI usage. You only need to enter your UPI PIN when you are sending money or checking your balance. You never need to enter it to receive money. Scammers often exploit this by sending a payment request and tricking you into
believing you must enter your PIN to get a refund, prize, or payment. The moment you enter your PIN on a 'collect request', you authorize a payment from your account to theirs. Remember, legitimate incoming payments will simply appear in your account without any action required from you.
Rule 2: Never Share Your PIN or OTP with Anyone
Your UPI PIN and any One-Time Passwords (OTPs) sent to your mobile are confidential keys to your bank account. No legitimate entity—not your bank, not a UPI app representative, not a government official—will ever call or message you to ask for them. Fraudsters often use a technique called 'vishing' (voice phishing), where they pose as customer service agents to create a sense of urgency and trick you into revealing this information. Treat any unsolicited request for your PIN or an OTP as a scam attempt.
Rule 3: Beware of Phishing and Fake Links
Phishing remains one of the most common UPI fraud tactics. Scammers send SMS messages or emails with links that look like they are from your bank or UPI provider. These links lead to fake websites designed to steal your login credentials or UPI PIN. Before clicking any link, verify the sender's details. A legitimate bank or UPI service will not ask you to update sensitive information via a random link. Always download UPI apps from official sources like the Google Play Store or Apple App Store, not from links sent to you.
Rule 4: Scrutinize QR Codes Before Scanning
QR codes are convenient, but they can be easily manipulated by fraudsters. A common scam involves scammers sending you a QR code and claiming that scanning it will credit money to your account. However, scanning a QR code is only ever used for making a payment, not receiving one. When you scan a fraudulent code and enter your PIN, you send money to the scammer. At a merchant's shop, ensure the QR code has not been tampered with or pasted over with a fake one. Always verify the merchant's name on your UPI app screen before confirming the payment.
Rule 5: Verify the Recipient's Identity
Before you press 'send' on any transaction, your UPI app will display the verified name of the account holder you are paying. Make it a habit to always check this name carefully to ensure it matches the intended recipient. Scammers sometimes use UPI IDs that look very similar to legitimate ones to trick you. A moment of inattention can lead to your money going to the wrong person. This simple verification step is a powerful defence against mistaken or fraudulent transfers.
Rule 6: Use Your App's Built-In Security Features
Modern UPI apps are equipped with multiple security layers. Ensure you have a strong screen lock (password or biometric) on your phone to prevent unauthorized access if it's lost or stolen. Additionally, enable two-factor authentication (2FA) wherever possible. Many apps also show spam warnings for suspicious payment requests; pay attention to these alerts. Do not install screen-sharing apps at the request of an unknown person, as they can use this to see your PIN and other sensitive data in real-time.
What to Do If You Get Scammed
If you suspect you've been a victim of UPI fraud, speed is critical. Immediately call the National Cyber Crime Helpline at 1930. Next, report the fraudulent transaction to your bank and request them to block the payment if possible. You should also file a formal complaint on the National Cyber Crime Reporting Portal (cybercrime.gov.in) and report the transaction within your UPI app's support section. Preserving all evidence like transaction details and messages from the scammer is also crucial.
