The Golden Rule: Never Enter a PIN to Receive Money
This is the single most important rule of using UPI. You only need to enter your UPI PIN when you are sending money or checking your account balance. You never, under any circumstances, need to enter your PIN to receive money from someone. Scammers often
exploit this confusion. They might call you, send a payment request, or a QR code, and tell you to enter your PIN to accept a payment, a refund, or a prize. This is always a lie. Approving a request with your PIN authorises money to be debited from your account. Legitimate banks and companies will never ask for your PIN over a call, message, or email.
Understanding Malicious QR Codes
QR codes are a convenient way to pay, but they are also a tool for fraudsters. A common scam involves a fraudster sending you a QR code and instructing you to scan it to receive a payment. However, scanning a QR code is exclusively for making payments, not for receiving them. When you scan the scammer's code and enter your PIN, you are actually sending money to them. Another tactic, sometimes called 'quishing,' involves fraudsters placing fake QR code stickers over legitimate ones at places like restaurants or parking meters. When you scan the fake code, it may lead to a malicious website designed to steal your payment information. Always be cautious and verify the payment details on your screen before authorising a transaction.
Beware of Social Engineering and Urgency
Many UPI scams don't rely on hacking; they rely on psychological manipulation, also known as social engineering. Scammers create a sense of urgency or panic to rush you into making a mistake. They might pose as a bank official claiming your account will be blocked, an army officer wanting to buy a product you listed online, or someone who has mistakenly sent you money and desperately needs it back. They will often sound convincing and use a friendly tone to lower your guard before creating a fake emergency. A common trick is sending an SMS that looks like a real bank credit alert, followed by a frantic call asking you to 'return' the money by scanning a QR code. Always take a moment to think. A legitimate transaction rarely requires such haste.
The Dangers of Unverified Links and Apps
Fraudsters often use phishing tactics to steal your information. They send deceptive links via SMS, WhatsApp, or email that lead to fake websites designed to capture your UPI PIN or other banking details. These messages may claim you need to update your KYC details or that there's a problem with your account. Another significant threat comes from fake UPI applications or remote access tools. Scammers might trick you into downloading a fraudulent app that mimics a real one or a screen-sharing app like AnyDesk. Once installed, these apps can record your PIN as you type it or give the scammer direct control over your device, allowing them to authorise transactions without your knowledge. Only download UPI and banking apps from official sources like the Google Play Store or Apple App Store.
Simple Habits for Strong Security
Beyond avoiding specific scams, adopting good digital hygiene is crucial for UPI safety. Always use your phone's screen lock (biometric or pattern) to protect your apps if your device is lost or stolen. Never share your UPI PIN or OTPs with anyone, no matter who they claim to be. Regularly review your bank statements and transaction history for any unauthorised activity. Be wary of using public or unsecured Wi-Fi networks for financial transactions, as hackers can intercept your data. If a deal looks too good to be true, it probably is. And if you receive a 'collect request' from an unknown person, your UPI app will often flag it with a spam warning—pay attention to it.
