The Golden Rule of UPI Safety
Before diving into specific scams, it's crucial to understand the single most important rule of UPI: you never need to enter your PIN to receive money. Your UPI PIN is a secret four or six-digit number used only to authorise payments leaving your account.
Scammers often build their entire deception around making you forget this fact. Any time someone asks you to scan a code, approve a request, or enter your PIN to get a refund, prize, or payment, it is a scam. Incoming transfers are automatic and require no action or PIN from the recipient. Remembering this one principle can help you defeat the vast majority of UPI fraud attempts.
Understanding the Fake QR Code Scam
The fake QR code scam is one of the most common methods fraudsters use. It preys on the misunderstanding of how QR codes work. Scammers might contact you pretending to be a buyer for an item you've listed online. They will agree to the price and send you a QR code via WhatsApp, telling you to scan it to receive the payment. However, when you scan their code and enter your UPI PIN, you are not receiving money; you are authorising a payment to them. Another version of this scam happens in public spaces. Fraudsters paste their own fake QR code sticker over a genuine one at a shop, petrol pump, or even a temple donation box. Unsuspecting users scan the code, think they are paying the merchant, but the money is diverted to the scammer’s account. Always verify the recipient's name on your UPI app's screen before entering your PIN to confirm the payment.
Other Common Scams to Watch For
Beyond fake QR codes, be aware of other prevalent fraud tactics. The 'Collect Request' scam involves a fraudster sending you a payment request, often disguised with an urgent message like “Approve to receive your refund of ₹5,000.” If you approve it and enter your PIN, you send them money instead of receiving it. Phishing scams use SMS or email links that lead to fake websites impersonating your bank or UPI app to steal your login details. Another common trick is the fake customer care scam, where fraudsters post fake helpline numbers online. When you call, they pose as support agents and persuade you to share your PIN or OTP, or to install a screen-sharing app like AnyDesk, which allows them to see your screen and capture your credentials as you enter them.
Your Proactive UPI Safety Checklist
Adopting a few simple habits can significantly enhance your security. First, never share your UPI PIN or OTP with anyone, including individuals claiming to be from your bank or a UPI provider. Second, always download UPI apps from official sources like the Google Play Store or Apple App Store to avoid malicious clones. Before authorising any payment, double-check the recipient's name and UPI ID displayed on the confirmation screen. Be wary of any transaction that creates a sense of urgency or pressure. Enable transaction alerts from your bank via SMS and lock your payment apps with a password or biometric authentication for an extra layer of security. Finally, if your bank allows it, consider setting a lower daily transaction limit to minimize potential losses in case of fraud.
What to Do If You Become a Victim
If you suspect you've been scammed, time is critical. The first thing you should do is call your bank's 24/7 fraud helpline to report the transaction and request that they block your UPI access immediately. The second step is to report the incident by calling the National Cyber Crime Helpline at 1930 or by filing a formal complaint on the National Cyber Crime Reporting Portal at cybercrime.gov.in. Keep all details handy, including the transaction ID, date, time, and the scammer's UPI ID or phone number. You should also report the fraudulent transaction within the UPI app you used, as this creates an additional record of the dispute. Acting on these steps within the first few hours increases the chances of tracing and potentially recovering the funds.
