The Golden Rule: Never Enter Your PIN to Receive Money
This is the single most important rule to remember and the one that stops the majority of UPI scams. Your 4 or 6-digit UPI PIN is a secret key used only for authorising payments from your account. You never need to enter it to receive money, get a refund,
or accept a cashback offer. If anyone—a buyer, a caller claiming to be from a bank, or a message promising a prize—asks you to enter your PIN to get money, it is a scam. Fraudsters exploit the false belief that a PIN is needed for both sending and receiving. Remember: a PIN prompt means money is about to leave your account.
Beware the QR Code Trick
QR codes are designed for one primary function: to make payments quickly. You should only scan a QR code when you intend to pay a person or a merchant. Scammers exploit this by sending you a QR code via WhatsApp or email, claiming that scanning it will credit money to your account for a refund or a lucky draw. This is false. Scanning a QR code and entering your PIN will always debit money from your account. Be especially cautious of physical QR codes in public places like parking lots or shops; fraudsters sometimes paste their own fake QR code sticker over the merchant's legitimate one to divert your payment to their account.
Decline Unknown 'Collect Requests'
A 'collect request' is a feature that allows someone to request money from you. Scammers misuse this by sending you a request disguised as a payment notification. For example, the notification might say, "You have received Rs 10,000. Enter your PIN to accept." The note is written by the scammer, but the action is a debit. If you approve the request and enter your PIN, you are authorising a payment to the scammer, not receiving money from them. Always read the on-screen prompt carefully. If it says "Pay," it means you are sending money out. Decline any collect requests from unknown or unverified UPI IDs.
Guard Your PIN and OTP Fiercely
Your UPI PIN and any One-Time Passwords (OTPs) you receive are confidential credentials. Never share them with anyone, regardless of who they claim to be. Fraudsters often create a sense of urgency, pretending to be from your bank or a payment app's customer support, and claim there's a problem with your account that requires immediate verification. They will then ask for your PIN or an OTP to "fix" the issue. No legitimate bank, company, or the National Payments Corporation of India (NPCI) will ever call or message you to ask for your UPI PIN or an OTP.
Verify Before You Pay
Before you hit 'Pay' and enter your PIN, every UPI app shows you the legal name of the person or merchant receiving the money. Take a moment to verify this name. This simple check can prevent you from sending money to the wrong person or a fraudster using a UPI ID that looks similar to a legitimate one. Scammers often rely on you being in a hurry and not double-checking the details. Don't rely on screenshots as proof of payment from others; always check your own bank account statement or transaction history within your app to confirm you have received funds.
Use Official Apps and Support Channels
Only download UPI apps from official sources like the Google Play Store or Apple App Store. Fraudsters create fake, lookalike apps that can steal your data. Furthermore, if you need customer support, never search for helpline numbers on Google or social media. Scammers plant fake customer care numbers in search results and social media comments. When you call these numbers, they may ask you to install screen-sharing apps like AnyDesk or TeamViewer to "help" you, which gives them full control of your phone to view your PIN and drain your account. Always use the official help section within your UPI app or on the bank's official website.
