The Golden Rule: Never Enter a PIN to Receive Money
This is the most crucial rule of UPI safety. You only need to enter your UPI PIN when you are sending money or making a payment. If anyone—a buyer, a seller, or someone claiming to be from customer support—tells you to enter your PIN to receive a refund,
cashback, or payment, it is a scam. Incoming payments are automatic and never require your PIN for authentication. Treating your PIN as a password for authorising payments, not for receiving them, is your strongest defence against the most common types of fraud.
Beware of Fake 'Request Money' Notifications
Scammers often send a 'collect request' or 'money request' instead of making a payment. They disguise the notification with notes like 'Your Diwali Bonus is ready' or 'Refund approved'. If you approve the request and enter your PIN, money will be debited from your account. Always read transaction notifications carefully. Unless you have personally initiated a request for money from someone, you should decline any unexpected collect requests, especially from unknown UPI IDs.
Verify Every QR Code and UPI ID
In crowded markets or even online, fraudsters can tamper with QR codes, replacing a merchant's genuine code with their own. Before you approve any payment, your UPI app will display the legal name of the account holder you are about to pay. Always take a moment to verify that the name displayed matches the merchant or person you intend to pay. Remember, scanning a QR code is always for making a payment, never for receiving one. If a seller asks you to scan a code to receive money, walk away.
Watch Out for Fake Shopping Websites and Offers
During festive sales, cybercriminals create fake websites that mimic popular e-commerce platforms like Amazon or Flipkart. These sites, often promoted through social media ads or WhatsApp messages, offer deals that seem too good to be true. They are designed to steal your financial details when you attempt to make a purchase. Always shop from official apps or by typing the website's address directly into your browser. Be wary of unsolicited links promising massive discounts or festive rewards, as they often lead to phishing portals.
Secure Your Phone and UPI App
Your first line of defence is your device. Enable a strong screen lock on your smartphone, using a pattern, PIN, or biometric authentication like a fingerprint or face ID. Most UPI apps also offer an additional app-level lock, which you should enable. Furthermore, avoid making payments over public or unsecured Wi-Fi networks, as hackers can use these to intercept your data. Stick to your personal mobile data or a trusted home Wi-Fi network for all financial transactions.
Never Share Your OTP or Personal Details
Fraudsters often impersonate bank officials, RBI representatives, or customer care executives to trick you. They create a sense of urgency, claiming your account will be blocked or KYC has expired, to pressure you into sharing sensitive information. No legitimate bank or payment app will ever call or message you to ask for your UPI PIN, One-Time Password (OTP), or card details. If you receive such a call, hang up and contact your bank through its official channels if you are concerned.
What To Do If You Suspect Fraud
If you realise you've been scammed, speed is critical. Immediately call the National Cyber Crime Helpline at 1930 to report the financial fraud. Then, contact your bank to report the unauthorised transaction and ask them to block your account or UPI ID if necessary. You should also file a formal complaint on the National Cyber Crime Reporting Portal (cybercrime.gov.in). Reporting the incident within the first few hours increases the chances of tracing and freezing the stolen funds.
