The Golden Rule of UPI Payments
The single most important rule to remember is this: you never need to enter your UPI PIN to receive money. A PIN is only required when you are sending money from your account. Fraudsters often exploit this confusion. They might send you a payment request
and claim you need to enter your PIN to get the cash, but doing so actually authorises a debit from your account. This is a common tactic in various scams, so internalising this one rule provides a powerful first line of defence against many forms of UPI fraud.
Beware of Phishing Links and Fake Calls
Phishing remains one of the most common ways scammers steal information. You might receive an SMS, email, or a message on a social media app with a link that looks legitimate. These links often lead to fake websites designed to look like your bank or UPI app's login page, tricking you into entering your PIN or other sensitive details. Another variation is 'vishing,' or voice phishing, where fraudsters call you pretending to be from your bank or a tech company. They create a sense of urgency, perhaps claiming your account is at risk, to pressure you into revealing your PIN or One-Time Passwords (OTPs). Remember, legitimate banks and UPI providers will never call you to ask for your PIN.
The Danger of Malicious QR Codes
Fraudsters are increasingly using QR codes to trick people into sending money. A common scam involves a fraudster, often posing as a buyer on an online marketplace, sending you a QR code. They will claim that scanning it will allow you to receive payment. However, UPI QR codes are only used for making payments, not receiving them. When you scan the malicious code and enter your PIN, you are actually authorising a payment to the scammer's account. Always be suspicious of anyone who asks you to scan a QR code to receive money. Double-check the details displayed on your screen after scanning, as it will always show the recipient's name before you approve the transaction.
The 'Request Money' and Fake Refund Ploy
Most UPI apps have a feature that allows you to request money from another user. Scammers abuse this by sending a payment request disguised as a refund, cashback offer, or payment confirmation. An unsuspecting user might see a message that says “You have received a payment of ₹5000” but the buttons will say “Pay” or “Decline.” If you are in a hurry, you might approve the request thinking you are accepting money, but you will end up sending it instead. Always read the pop-up messages on your UPI app carefully before entering your PIN. If it says “Pay,” you are sending money out.
Remote Access and Screen-Sharing Scams
A particularly invasive scam involves tricking you into downloading a screen-sharing or remote access application. Fraudsters may call pretending to be from customer support and guide you through a process to 'fix an issue,' which involves installing a specific app. Once installed, these apps give the scammer complete control over your phone. They can see everything you do, including when you open your banking app and enter your PIN. This allows them to access your accounts and transfer funds without your knowledge. Never install any app at the behest of an unknown caller, no matter how convincing they sound.
What to Do If You've Been Scammed
If you suspect you have fallen victim to a UPI fraud, time is critical. The first step is to immediately report the fraudulent transaction to your bank and your UPI service provider (such as Google Pay, PhonePe, or Paytm) through their in-app help section. You should also file a complaint on the National Cybercrime Reporting Portal by calling the helpline number 1930 or by visiting cybercrime.gov.in. The sooner you report the incident, the higher the chances of blocking the transfer and potentially recovering your money. The Reserve Bank of India's guidelines offer protection if the unauthorised transaction is reported within three days.
