The Golden Rule of Receiving Money
The single most important rule to remember is this: you never need to scan a QR code or enter your UPI PIN to receive money. Scammers exploit the common misunderstanding that an action is required to accept a payment. If anyone, whether a supposed buyer,
customer service agent, or friend, asks you to scan a code or approve a “collect request” to get paid, it is a scam. A request to scan a QR code is always a request to send money from your account. To receive money, you only need to provide your UPI ID or the mobile number linked to your account.
Decoding the QR Code Scam
Fraudsters create fake QR codes that, when scanned, either initiate a payment to their account or lead to malicious websites designed to steal your information. These scams are prevalent on online marketplaces where a fake "buyer" sends you a QR code to "receive" payment for an item you're selling. In physical locations like shops or parking lots, scammers may paste a sticker with their fraudulent QR code over the merchant's legitimate one. Before scanning any QR code, visually inspect it for tampering, such as being a sticker placed over another code. After scanning, always verify that the recipient's name displayed in your UPI app matches the intended merchant or person before entering your PIN.
Identifying Phishing Links and Messages
Phishing involves deceptive emails, SMS, or WhatsApp messages that appear to be from a legitimate source like your bank or a trusted company. These messages create a sense of urgency, asking you to click a link to verify your account, claim a refund, or update your KYC details. The link directs you to a fake website that looks identical to the real one, designed to trick you into entering your UPI PIN, OTP, or other banking credentials. Always be sceptical of unsolicited links. Never enter sensitive information on a page you reached via a link in a message. Instead, type the official website address directly into your browser or use the official app.
Secure Your UPI App and Device
Your first line of defence is securing the device you use for UPI. Always use a strong screen lock on your phone, such as a PIN, pattern, or biometric authentication. Keep your phone's operating system and your UPI apps updated to the latest version, as updates often include critical security patches. Only download UPI apps from official sources like the Google Play Store or Apple App Store, and be wary of apps that ask for excessive permissions. Similarly, avoid using public or unsecured Wi-Fi networks for financial transactions. NPCI guidelines also mandate that UPI apps must prevent functioning if screen mirroring apps are active in the background to stop remote surveillance by fraudsters.
The Dangers of Sharing Your PIN and OTP
Your UPI PIN and any One-Time Passwords (OTPs) you receive are confidential keys to your bank account. Never share them with anyone, under any circumstances. Scammers often impersonate bank employees, police officers, or customer service agents to trick you into revealing this information. They might create panic by saying your account is at risk or lure you with a prize. Remember, no legitimate bank, company, or government agency will ever call or message you to ask for your PIN or OTP. If you receive such a request, it is a fraud attempt.
What to Do If You Get Scammed
If you suspect you've been a victim of UPI fraud, you must act immediately. The first and most crucial step is to call the National Cyber Crime Helpline at 1930. Next, contact your bank to report the fraudulent transaction and request that they freeze the transaction or block your account. You should also report the fraud within your UPI app itself and file a formal complaint on the National Cyber Crime Reporting Portal at cybercrime.gov.in. The faster you report the incident, the higher the chances of potentially recovering the lost funds.
