The Golden Rule of UPI Safety
Before diving into specific scams, it's vital to understand the single most important rule of UPI: You only need to enter your PIN to send money, never to receive it. Almost every UPI scam is designed to trick you into breaking this rule. Scammers create
a sense of urgency or confusion to make you authorise a payment you didn't intend to make. If anyone asks you to enter your PIN to receive a payment, refund, or prize, it is always a scam. Remembering this one principle is your strongest defence against the most common types of UPI fraud.
Anatomy of a Phishing Attack
Phishing remains one of the most common UPI scams. Fraudsters send deceptive SMS messages or emails that appear to be from your bank, a payment app, or another trusted entity. These messages often contain urgent warnings about a blocked account, a required KYC update, or a failed transaction, urging you to click a link to resolve the issue. This link leads to a fake website that looks identical to the real one. Once you enter your UPI ID, PIN, or other banking details on this fraudulent page, the scammers capture your credentials and use them to drain your account. To stay safe, never click on suspicious links. Always verify the sender and check the website URL carefully before entering any information. Official apps and websites from banks will have secure connections (https).
The Deceptive QR Code Ploy
QR code scams exploit the trust users have in this convenient feature. A common trick, especially on online marketplaces, involves a scammer posing as a buyer. They will send you a QR code via WhatsApp or another chat app, telling you to scan it to receive payment for an item you're selling. However, scanning a QR code can only ever initiate a payment from your account. When you scan their code and enter your PIN to “authorise” the receipt, you are actually sending money to the fraudster. Another variation involves scammers pasting their own QR code sticker over a genuine merchant's code at a shop or petrol pump, diverting payments to their own account. Always double-check the recipient's name in your UPI app before completing any transaction.
Beware the 'Request Money' Reversal
Fraudsters also misuse the "Request Money" or "Collect Request" feature available on many UPI apps. They send a payment request to you, but the notification might be worded deceptively to make it seem like you are receiving funds. For example, a scammer might send a request for ₹5,000 with a note like "Payment for your old phone". Believing you are about to get paid, you might approve the request and enter your PIN. This authorises a debit from your account. Always be cautious with unsolicited payment requests. If you did not initiate a transaction or are not expecting a request, decline it immediately. Legitimate refunds and payments do not require you to approve a collect request.
Essential UPI Security Habits
Beyond avoiding specific scams, adopting a few key habits can significantly enhance your financial security. First, never share your UPI PIN or OTP with anyone, including individuals claiming to be from your bank or a customer support team. Second, avoid installing screen-sharing apps like AnyDesk or TeamViewer at the request of an unknown caller. Scammers use these to watch you enter your PIN. Third, only download UPI apps from official sources like the Google Play Store or Apple App Store to avoid counterfeit apps designed to steal your data. Finally, enable transaction alerts and regularly review your account statements to spot any suspicious activity immediately. If you suspect fraud, report it to your bank and the national cybercrime helpline (1930) without delay.
