Memorise the Golden Rule of UPI
The single most important rule to remember is this: you never need to enter your UPI PIN to receive money. Your PIN is exclusively for authorising payments from your account. Scammers often exploit this gap in knowledge. They will send you a payment request
and claim you need to enter your PIN to accept the funds. This is a lie. Any request to enter your PIN to receive money, a refund, or a prize is a scam. Incoming payments are automatic and require no action on your part other than sharing your UPI ID. Remembering this one fact can single-handedly thwart a majority of UPI fraud attempts.
Treat 'Collect Requests' with Extreme Caution
A 'collect request' is a UPI feature that allows someone to ask you for money. While legitimate businesses use it, fraudsters have turned it into a primary tool for theft. They send a payment request disguised as a refund, a prize notification, or a payment for an item you're selling online. The notification on your app might look like money is coming in, but approving it and entering your PIN does the opposite. Always read the on-screen message carefully before approving any request. Does it say 'Pay' or 'Receive'? Are you expecting to pay this person or merchant? If you don't recognise the sender or the reason for the payment, decline the request immediately.
Scrutinise Every QR Code Before Scanning
QR codes are for paying, not for getting paid. If someone online—especially a supposed buyer on a marketplace platform—sends you a QR code and asks you to scan it to receive their payment, it is a scam. Scanning a QR code will always open a payment screen to send money from your account. Another common scam involves fraudsters pasting a fake QR sticker over a genuine one at a physical shop or restaurant. After scanning any QR code, always verify the recipient's name and UPI ID displayed on your app screen before entering your PIN. If the name doesn't match the merchant you're trying to pay, cancel the transaction.
Never Trust Unsolicited Links or 'Support' Calls
Phishing remains a popular method for fraudsters. They send SMS or WhatsApp messages with links that look like they are from your bank or UPI app, often citing an urgent need for KYC updates or account verification. These links lead to fake websites designed to steal your login details or PIN. Similarly, be wary of fake customer support numbers found online. Scammers post their own numbers as official helplines. If you call them, they might ask you to install a screen-sharing app (like AnyDesk or TeamViewer) to 'help' you, but their real intention is to watch you enter your PIN and take over your account. Your bank or UPI provider will never ask for your PIN or OTP, nor will they ask you to install third-party software.
Use Only Official and Updated UPI Apps
Fraudsters create fake UPI apps that mimic popular, legitimate ones and publish them outside of official app stores. These malicious apps are designed to steal your financial data the moment you install them. To stay safe, only download UPI applications from the official Google Play Store or Apple App Store. Before downloading, check the developer's name and read recent user reviews. Furthermore, always keep your UPI app and your phone's operating system updated. These updates often contain critical security patches that protect you from the latest vulnerabilities and types of fraud.
Regularly Monitor Your Transaction History
Make it a habit to regularly review your transaction history in your UPI app and your bank statements. Sometimes, small, unauthorised transactions can go unnoticed. By checking your history frequently, you can spot any suspicious activity early. Most UPI apps send you a notification for every transaction. Ensure these alerts are enabled. If you see a transaction you did not authorise, no matter how small, report it immediately. Promptly reporting fraud to your bank and the national cybercrime helpline (1930) increases the chances of blocking the transfer and potentially recovering your funds.
