Rule 1: Know the Golden Rule of UPI
This is the most important rule: you only need to enter your UPI PIN to send money, never to receive it. Fraudsters often exploit this confusion. They will send you a payment request and claim you need to approve it by entering your PIN to get money.
This is always a lie. If someone asks you to enter your PIN to receive a payment, a refund, or a prize, it is a scam. Decline the request immediately. Real payments will be credited to your account automatically without you needing to do anything.
Rule 2: Never Trust a Link Blindly
Phishing scams are a common tactic where fraudsters send fake links via SMS, WhatsApp, or email. These messages create a false sense of urgency, claiming your KYC needs updating, your account will be blocked, or a package is on hold. The links lead to websites that look identical to your bank's or UPI app's page but are designed to steal your PIN and other financial details. Before clicking, always inspect the URL. Look for spelling mistakes, strange characters, or domains that don't match the official website. When in doubt, type the official website address directly into your browser instead of clicking a link.
Rule 3: Beware of QR Code and Screen-Sharing Scams
Fraudsters are increasingly using QR codes to trick users. They might send you a QR code and ask you to scan it to receive money. However, scanning a QR code is used for making payments, not receiving them. Once you scan and enter your PIN, money is debited from your account. Another dangerous scam involves fraudsters, often posing as customer service agents, asking you to install screen-sharing apps like AnyDesk or TeamViewer. This gives them full access to your phone, allowing them to see your PIN and OTPs as you enter them, and take control of your accounts.
Rule 4: Verify the Sender's Identity
Scammers often impersonate bank employees, company representatives, or even friends and family. They might call you, create fake social media profiles, or use display names on messaging apps that seem legitimate. Remember that no bank or official UPI service provider will ever call or message you to ask for your UPI PIN, OTP, or other sensitive passwords. If you receive a suspicious request for money or personal information, always verify it through an independent and official channel. Call your bank's official customer care number, which you can find on their website, not from a number given in an SMS or found through a random web search.
Rule 5: Understand 'Collect Request' Fraud
One of the most common UPI frauds involves the 'Collect Request' or 'Request Money' feature available on most apps. Scammers use this when you are selling something online, for example. They will claim to have sent you the money and ask you to approve the 'collect request' to receive it. The notification on your app will clearly state you are about to 'Pay' money. Always read the on-screen prompts carefully before authorising any transaction. If it says 'Pay', you are sending money out. If you are expecting to receive money, there is no action or approval required from your side.
Rule 6: Use Only Official and Updated Apps
Always download UPI and banking applications from official sources like the Google Play Store or Apple App Store. Avoid third-party app stores or links sent by others. Fraudsters create fake, malicious apps that look like the real thing to steal your login credentials and financial data. Furthermore, keep your apps updated. Developers regularly release updates that include the latest security patches to protect you from new and emerging threats. Using an outdated app could leave you vulnerable to known security loopholes.
Rule 7: Know What to Do If You Are Scammed
If you suspect you have been a victim of fraud, time is critical. The first thing you must do is call the National Cyber Crime Helpline number, 1930, immediately. This helpline is integrated with banks to help freeze the fraudulent transaction quickly. Next, report the incident to your bank and ask them to block the transaction. You should also file a formal complaint on the National Cyber Crime Reporting Portal at cybercrime.gov.in. The sooner you report the fraud, the higher the chances of recovering your money, as per RBI guidelines which offer protection if fraud is reported within three days.
