The Golden Rule of UPI Safety
Let's be perfectly clear: you never need to enter your UPI PIN to receive money. Not for a refund, not for a prize, not from a buyer, and not for a cashback offer. The UPI PIN is a 4 or 6-digit number that you create to authorise payments leaving your account.
It functions like a digital signature that tells your bank, "Yes, I approve this debit." Entering your PIN is the final step for sending money, not receiving it. To get paid, you only need to share your UPI ID or have someone scan your QR code. That's it. Any request that asks you to enter your PIN to receive funds is a fraudulent attempt to steal your money.
How the 'Receive Money' Scam Works
This scam preys on trust and a misunderstanding of how UPI's "Request Money" or "Collect Request" feature functions. The fraudster sends you a payment request through a UPI app. On your screen, it will look like a notification to approve a transaction, and the fraudster will try to convince you that approving it will credit money to your account. They use social engineering to make their story believable. For example, they might pose as a buyer for an item you've listed online and say they are sending you an advance. Or they might claim to be from a company processing a refund or a cashback reward. Under a sense of urgency, you might focus on the message that says "refund" and ignore the button that says "Pay." When you enter your UPI PIN to approve this request, you are not receiving money; you are authorising a payment from your account to the scammer.
Understanding the Technology: Pay vs. Request
The UPI system, developed by the National Payments Corporation of India (NPCI), has two primary functions for individuals: sending money (a "push" transaction) and requesting money (a "pull" or "collect" transaction). When you want to pay someone, you initiate a push transaction. You enter their UPI ID, scan their QR code, enter the amount, and finally, enter your secret PIN to authorise the debit. When someone requests money from you, they initiate a pull transaction. Your app shows you a request, and if you approve it by entering your PIN, the money is sent from your account. Scammers exploit this 'pull' feature. They send a request and lie about its purpose, turning your approval into an unauthorised debit from your account.
Red Flags: How to Spot a UPI Scam
Vigilance is your best defence. Scammers often leave clues, and recognising them can prevent financial loss. Be suspicious of anyone asking you to enter your PIN to receive a payment. This is the most significant red flag. Be wary of unexpected refunds, lottery wins, or cashback offers from unknown sources that require you to approve a request. Another common tactic is a buyer on an e-commerce platform who insists on using a QR code or a payment link sent via WhatsApp to pay you; scanning a QR code is for paying out, not receiving money. They often create a false sense of urgency, claiming the network is slow or that they are in a hurry, to pressure you into acting without thinking. If a notification message says "refund" but the action button on your UPI app says "Pay," always trust the button.
What to Do If You've Been Scammed
If you realise you've fallen for a scam, time is critical. The first thing you must do is call the National Cyber Crime Reporting Portal helpline at 1930. This can help in trying to freeze the transaction before the money is moved further by the fraudster. Next, immediately report the fraudulent transaction to your bank and your UPI service provider (like Google Pay, PhonePe, or Paytm) through their in-app complaint feature or customer service helpline. You should then file a formal complaint on the National Cyber Crime Reporting Portal at cybercrime.gov.in. Make sure to save all evidence, such as screenshots of messages, transaction details, and the scammer's phone number or UPI ID, as this will be crucial for the investigation.
