Embrace the Golden Rule: Your PIN Is for Paying Only
This is the most critical habit to build. Your UPI PIN is a secret code that authorises money to leave your bank account. You only need to enter it when you are sending money or making a payment. You never, under any circumstances, need to enter your PIN to receive
money. Scammers often create a sense of urgency, telling you to enter your PIN to accept a refund, claim a prize, or receive a payment from a buyer. This is always a trap. If an app or a person asks for your PIN to credit money to your account, it is a scam. Treat your UPI PIN with the same secrecy as your ATM PIN—it is a key that only you should use.
Scrutinise Every 'Request Money' Notification
One of the most common scams involves exploiting the 'Request Money' or 'Collect Request' feature. Fraudsters send a payment request disguised as a credit notification, often with labels like "Refund Approved" or "Tap to receive ₹5,000". Unsuspecting users, believing they are accepting an incoming payment, approve the request and enter their PIN, only to find that they have just sent money to the scammer. The habit to develop here is to read every notification carefully. A request to 'Pay' means money will be debited. A genuine payment being sent to you requires no action on your part; the funds will simply appear in your account. Always decline collect requests from unknown individuals.
Treat QR Codes with Healthy Suspicion
QR codes have simplified payments at shops, but they are also a tool for fraud. Remember that scanning a QR code is exclusively for making a payment, never for receiving one. Scammers exploit this by sending you a QR code on WhatsApp or another messenger, claiming you need to scan it to receive money. In reality, scanning the code opens a payment screen on your app, often with the amount and recipient already filled in. Another common tactic involves fraudsters placing their own QR code sticker over a legitimate one at a physical store or fuel pump. Before you pay, always verify that the name displayed on your screen after scanning matches the intended merchant.
Always Verify Before You Authorise Payment
Scammers often create UPI IDs that look very similar to those of legitimate businesses or people. A simple moment of inattention can cause you to send money to the wrong account. Before you enter your PIN, make it a habit to pause and verify the recipient's name and UPI ID on the confirmation screen. Every UPI app displays the legal name of the account holder you are about to pay. If the name doesn't match the person or merchant you expect, cancel the transaction immediately. This simple check is one of your strongest defences against misdirected payments and impersonation scams.
Reject All Unsolicited 'Help' and Screen Sharing
If you face a failed transaction or another issue, you might search online for a customer care number. Fraudsters are aware of this and plant fake helpline numbers on social media and websites. When you call, they pose as support agents and trick you into revealing your PIN or OTP, or ask you to install a screen-sharing app like AnyDesk or TeamViewer. Once they can see your screen, they can capture your confidential details as you type them. The safest habit is to never call a number found in a random search and never install an app at the direction of a support agent. Only use the official customer support channels provided within your UPI app or on your bank's official website.
Practice Good Digital Payment Hygiene
Beyond individual transactions, a few background habits can significantly improve your security. First, regularly review your transaction history in your banking and UPI apps to spot any unauthorised debits early. Second, ensure that you only download and use official UPI apps from the Google Play Store or Apple App Store, and keep them updated to benefit from the latest security patches. Finally, make sure SMS and email alerts for all your bank transactions are enabled. These alerts provide an immediate record of account activity and serve as an early warning system if something goes wrong, allowing you to report any fraud to your bank and cybercrime authorities immediately.
