Last updated: October 2026.
Photo by Markus Winkler on Unsplash
UPI makes paying anyone in India take a few seconds, and fraudsters use that speed against you. Most UPI scams do not break into the system at all; they trick you into approving a payment, sharing a PIN or OTP, or handing over control of your phone. This guide explains the most common tricks, gives you a short safety checklist, and lists exactly what to do in the first few minutes if you have been cheated.
The one rule that stops most UPI scams
You never need to enter your UPI PIN, or scan a QR code, to receive money. NPCI, which runs UPI, states this plainly in its safety advice: the PIN is only for money leaving your account. If anyone says "enter your PIN to receive the refund" or "scan this to get your cashback", it is a scam, every time.
Common UPI scams and how they work
1. Collect request scams
A "collect request" is a pop-up in your UPI app asking you to approve a payment. Scammers posing as buyers used to send these saying "approve this so I can pay you"; approving it sent money to them.
From 1 October 2025, NPCI stopped person-to-person collect requests, but merchants (such as a shopping or ticket-booking app) can still send them. Approve only a request you started yourself for a purchase you are making right now.
2. QR code scams
A "buyer" sends you a QR code on WhatsApp and asks you to scan it to receive payment for something you are selling. Scanning it opens a payment screen, and entering your PIN pays the scammer. Remember: scanning a QR code is only ever for paying. Also check the name shown after scanning a shop's QR code, since stickers can be pasted over the real one.
3. Fake customer-care numbers
Scammers post fake helpline numbers for banks, UPI apps, courier companies and airlines on search results, social media and review sites. When you call about a failed payment, the "agent" asks for your PIN, an OTP, or asks you to install an app. Get support numbers only from the official app or website. The government's Sanchar Saathi portal also has a "Trusted Contact Details" section to check official contact details of banks and financial institutions.
A useful extra signal: TRAI has directed RBI-regulated banks and other financial firms to make their service and transaction calls from numbers in the 1600 series, with deadlines in early 2026. A caller claiming to be your bank from an ordinary 10-digit mobile number deserves extra suspicion, but caller ID can be faked, so never rely on it alone.
4. Screen-sharing and remote-access apps
The caller asks you to install a screen-sharing or "support" app, or an app that forwards your SMS. Once installed, they can watch you type your PIN, read your OTPs and sometimes control the phone. NPCI specifically warns against installing such apps at a stranger's request. No real bank or UPI app support team needs to see your screen.
5. Fake payment screenshots and fake credit SMS
A buyer shows you a screenshot of a "successful" payment, or you get an SMS that looks like a bank credit alert, and you hand over the goods. Screenshots are easy to edit and SMS can come from any sender. Before releasing goods or cash, open your own UPI app or bank app and confirm that the money has actually reached your account.
6. "Accidental transfer" refund requests
A message says money was credited to you, then a caller begs you to return it. Often nothing was sent (just a fake SMS). Check your real balance in the bank app. If a genuine wrong credit arrived, do not send money to a new number or QR code; ask the sender to go through their bank, and inform yours.
7. KYC, OTP and "account blocked" fraud
An SMS or WhatsApp message says your bank account, SIM or wallet will be blocked unless you "update KYC" through a link or by calling a number. The link leads to a fake login page, or the caller asks for an OTP. RBI has repeatedly warned customers about fraud in the name of KYC updation. Banks do not ask for your PIN, password or OTP over calls or messages. If you think your KYC really needs updating, contact your branch or use the official app.
Quick UPI safety checklist
- Enter your UPI PIN only inside your UPI app's PIN screen, and only when you are paying.
- Never share your UPI PIN or any OTP, not even with someone claiming to be from your bank.
- Check the receiver's name before confirming any payment.
- Decline any payment request you did not start yourself.
- Do not install apps that someone on a call or chat tells you to install.
- Take helpline numbers only from official apps and websites, not search ads or social media comments.
- Confirm every incoming payment in your own bank or UPI app, not via screenshots or SMS.
- Do not click links in SMS or WhatsApp messages about KYC, refunds, rewards or blocked accounts.
- Keep a screen lock on your phone and your bank contact details updated so you get every alert.
What to do immediately if you have been scammed
Speed matters: the sooner you report, the better the chance the money can be frozen while it is still moving between accounts.
- Call 1930. This is the national cyber crime helpline for financial fraud, run under the Ministry of Home Affairs. Keep your transaction ID (UTR), date, amount, your bank and UPI app details, and the scammer's number or UPI ID ready. You should get an acknowledgement number by SMS; save it.
- File a complaint on cybercrime.gov.in. The National Cyber Crime Reporting Portal is where you register the full complaint. If you called 1930 first, follow the instructions in the acknowledgement SMS to complete the report there without delay.
- Contact your bank. Use the number on the back of your card, in the bank's official app or on its website. Report the unauthorised transaction and ask them to block your UPI, cards or net banking if needed. Ask for a complaint reference number in writing.
- Secure your phone. Uninstall any app the scammer asked you to install and change your UPI PIN and banking passwords.
- Keep evidence. Save screenshots of chats, call logs, the scammer's number and UPI ID, payment confirmations and bank SMS. Do not delete the conversation.
Reporting quickly to your bank also matters for your liability under RBI rules. RBI has issued revised directions on fraudulent electronic banking transactions that apply to transactions from 1 January 2027, including a five-calendar-day reporting window for some protections. Until then, the older framework applies. In both cases, losses caused by sharing your PIN or OTP can fall on you, so report the moment you notice anything wrong.
Report fraud calls and messages, even if you did not lose money
If you received a suspicious call, SMS or WhatsApp message but did not lose money, report it on Chakshu, a facility on the Department of Telecommunications' Sanchar Saathi portal and app. You can report fake customer care, KYC and payment scams, impersonation of officials, fake job or loan offers and similar attempts. The sender's number must be visible in your report. Chakshu is not meant for cases where money has already been lost; for those, use 1930 and cybercrime.gov.in.
| Situation | Where to report |
|---|---|
| Money already lost to fraud | Call 1930, file on cybercrime.gov.in, and inform your bank |
| Suspicious call, SMS or WhatsApp, no money lost | Chakshu on the Sanchar Saathi app or sancharsaathi.gov.in |
| Wrong or unauthorised debit in your account | Your bank's official helpline or app, plus 1930 if fraud is involved |
Frequently Asked Questions
Do I need to enter my UPI PIN to receive money?
No. Your UPI PIN is needed only to send money. Anyone asking you to enter it to receive a payment, refund or prize is attempting fraud.
Can a stranger still send me a UPI collect request?
NPCI discontinued person-to-person collect requests from 1 October 2025. Merchants can still send them, so approve a request only when you started the purchase yourself.
A caller from "my bank" is asking for an OTP. What should I do?
Hang up. Do not share the OTP, PIN or password, and do not install any app they suggest. Call your bank back on the number in its official app or website, and report the call on Chakshu.
Will I definitely get my money back?
Not always. Quick reporting can help freeze money that has not yet been withdrawn, but recovery depends on the case. Your bank's liability rules also depend on how and when the fraud happened and how quickly you reported it.
Comments
Post a Comment