Last verified: 21 May 2026. This is general safety guidance, not financial advice.
UPI has made paying for things in India effortless — and that same effortlessness is exactly what scammers exploit. Here is the single most important thing to understand: the UPI system itself is secure. Almost every UPI fraud works by tricking you into approving a payment yourself. Scammers do not break into banks. They convince you to hand over money or your PIN. Once you internalise that, most scams become easy to spot.
The one rule that stops most scams
You never need to enter your UPI PIN to receive money.
Read that again, because it is the heart of nearly every UPI scam. Money leaves your account only when you enter your PIN. Receiving money — a refund, a payment from a friend, a “prize” — requires nothing from you. So any time someone asks you to enter your PIN or approve a request “to get money”, it is a scam, with no exceptions.
The common scams
The “collect request” trick
This is the most common UPI scam. Instead of sending you money, the scammer sends a collect request — a request for you to pay them. They tell you it is a refund, a prize, or a payment you are owed. If you approve it and enter your PIN, money leaves your account instantly. Always read a UPI request carefully: if it asks for your PIN, money is going out, not coming in. Decline anything unexpected.
Fake customer-care numbers
You search online for a company’s helpline, call the number at the top of the results, and reach a scammer. They “help” with your problem — and in the process get your card details, OTP, or get you to approve a payment. Only ever use customer-care numbers from the official app or the company’s own website, never from a random search result or social media.
Screen-sharing and remote-access apps
A caller claiming to help with a refund or a technical issue asks you to install a screen-sharing app like AnyDesk or TeamViewer. Once it is running, they can see everything on your screen — OTPs, balances, PIN entry. No genuine bank or payment service ever needs remote access to your phone. If anyone asks you to install such an app, hang up.
Phishing links (“your KYC will expire”)
An SMS or WhatsApp message warns that your account or KYC will be blocked unless you click a link and “verify”. The link leads to a fake site that looks like your bank. Anything you type there goes straight to the scammer. Banks do not block accounts over a text link. Do not click; if in doubt, open your banking app directly or type the bank’s address yourself.
QR code scams
A QR code is for paying, not receiving. A scammer (often posing as a buyer on a resale platform) sends you a QR code and says “scan this to receive the money”. Scanning it and approving sets up a payment from you. You never scan a QR code to receive money.
AI voice-clone and “relative in trouble” calls
A newer tactic: scammers use AI to clone a familiar voice and call pretending to be a relative in urgent trouble, pressing you to send money immediately. If a call creates sudden panic and a demand for money, pause. Hang up and call the person back on their known number. Ask something only the real person would know.
The habits that protect you
- Never share your UPI PIN or OTP with anyone — not “bank staff”, not “support”, not family-of-a-friend. No legitimate party ever needs them.
- Read every payment request before approving. If it needs your PIN, you are sending money.
- Use biometric or app locks on your UPI app so a lost phone is not an open wallet.
- Download payment apps only from official app stores.
- Avoid UPI transactions on public Wi-Fi.
- Check your transaction history regularly so you catch anything unexpected quickly.
- Treat urgency and fear as red flags. Scammers manufacture panic — a threat, a deadline, a “your account will be blocked”. Genuine institutions give you time.
If you think you have been scammed
Act fast — quick action improves the odds of recovering money.
- Call your bank immediately and report the unauthorised transaction; ask them to freeze or flag the account if needed.
- Report to the national cybercrime helpline, 1930, and file a complaint at the National Cyber Crime Reporting Portal, cybercrime.gov.in.
- Keep evidence — screenshots, transaction IDs, the caller’s number, any messages.
- If you entered your PIN into a scam request but the transaction failed, change your UPI PIN immediately as a precaution and review recent transactions.
The bottom line
UPI is safe technology. The weak point is human — urgency, trust and a moment of inattention. Remember the one rule (never a PIN to receive money), be suspicious of anyone who creates panic, and verify before you tap. A few seconds of caution is the whole defence.
This is general safety guidance, not financial advice. Reporting channels and procedures can change — confirm current details with your bank and the official cybercrime portal.
