UPI is fast and convenient, and that is exactly why fraudsters love it. Most UPI frauds do not "hack" anything. They trick people into doing one thing: entering their UPI PIN or scanning a QR code when they think they are receiving money. If you learn a handful of rules, you can avoid nearly all of these tricks. This is Part 23 of our Tech for Beginners series. Today we will cover protecting your PIN, payment requests, QR code tricks, fake payment screenshots, setting limits, and exactly what to do after a wrong or fraudulent payment.
In Part 22 we set up a UPI app and made a first payment. In Part 21 we learned never to share OTPs. For more real-world examples, read our guide on protecting yourself from UPI and online payment frauds. Many UPI tricks are part of bigger scams, such as fake police calls; our guide to financial scams and "digital arrest" frauds explains how they work and why real officials never ask for money on a video call.
A note on changes: UPI rules, app features and fraud patterns change. The core rules below stay the same, but check your app and bank for current options.
Rule 1: You never need a PIN to receive money
This is the single most important UPI rule. Write it down and teach it to your family:
Entering your UPI PIN always means money is leaving your account.
If someone says, "Enter your PIN to receive the refund", "Scan this code to get your prize money", or "Approve this request to receive payment for your OLX item", it is a fraud. When someone pays you, the money simply arrives. You do nothing.
Rule 2: Your UPI PIN is only for you
- Never tell your PIN to anyone: not family members who "just want to help", not shopkeepers, not callers claiming to be from your bank, NPCI, RBI, police or customer care.
- Enter your PIN only inside your UPI app's own PIN screen, never on a website, a form or in a chat.
- Cover the screen with your hand when typing it in public, just like at an ATM.
- Change it immediately if you think someone saw it (Part 22 shows how).
Payment requests: read before you approve
A collect request or payment request is when someone asks you to pay, and your app shows a pop-up to approve or decline. For years, fraudsters sent fake collect requests disguised as refunds or prizes.
- NPCI discontinued person-to-person collect requests on UPI from October 1, 2025, as an anti-fraud step. Requests from registered merchants (for example, when you choose UPI at an online checkout and approve the payment in your app) are still allowed.
- So if you see any payment request you did not start yourself, decline it. Approving it and entering your PIN sends money out.
- Always read the screen: it says "Pay" with an amount and a name. If you were expecting to receive money, stop.
QR code tricks
A QR code is an easy way to fill in payment details. Scanning a QR code with a UPI app is for paying, not receiving.
Common QR frauds
- "Scan to receive" fraud: a fake buyer on a selling website sends a QR code and asks you to scan it to receive payment. Scanning and entering your PIN sends them money instead.
- Swapped stickers: a fraudster pastes their own QR sticker over a shop's or a parking counter's code, so payments go to them.
- QR codes in messages promising prizes, cashback, jobs or loans.
Stay safe with QR codes
- Scan QR codes only when you are paying someone.
- After scanning, check the name on the screen before entering the amount. At a shop, ask "Is this your name?" if unsure.
- Check the amount carefully if the QR fills it in automatically.
- Do not scan QR codes received from strangers on WhatsApp, email or social media.
Fake payment screenshots and SMS
If you sell things or run a shop, watch out for people who show a "payment successful" screen or send a screenshot or an SMS that looks like a bank message. These can be faked easily.
- Check your UPI app history or bank app for the credit.
- Check the bank SMS comes from your bank's official sender name, and that it matches your account balance.
- Use a payment soundbox or app notifications at the counter, but still verify large amounts in your bank app.
- Do not hand over goods until you have confirmed the money is in your account.
"I sent money by mistake, please return it"
A stranger calls or messages saying they sent money to your number by mistake, and shows a screenshot. Often no money was sent at all, or it came from a stolen account. Check your bank balance yourself. If money really arrived and you want to return it, contact your bank rather than sending money to the caller's new UPI ID or link.
Other common UPI tricks
- Fake customer care: searching for an app's helpline online and calling a fake number. The "agent" asks you to install a screen-sharing app or to "verify" with your PIN. Get help only from inside the official app.
- Screen-sharing apps: never install remote access apps at a stranger's request. They let the fraudster see your screen, including your PIN and OTPs.
- Job and task scams: "Like videos and earn money" offers that ask you to pay a deposit to unlock earnings.
- Fake KYC calls and SMS: "Your UPI will be blocked, update KYC here."
Setting limits and controls
- Some banks and UPI apps let you set a lower daily limit for UPI payments. Look in your app's bank account settings, or your bank's app or net banking.
- Use UPI Lite for small, frequent payments so you keep a small amount separate, if your app supports it.
- Keep only one or two UPI apps; remove apps you no longer use (Part 5).
- Turn on app lock and keep your phone's screen lock strong.
- Keep bank SMS alerts on, and read every debit alert.
What to do after a wrong payment
If you paid the wrong person by mistake (for example, a typing error in the number or UPI ID):
- Contact the receiver politely if you know them, and ask them to return it.
- Raise a complaint in your UPI app. Open the transaction in History and look for Help, Raise a dispute or Report a problem. Choose the reason, such as "Paid to wrong account".
- Contact your bank with the UTR or transaction ID and details. Banks can contact the receiver's bank, but a return usually depends on the receiver agreeing.
- If your complaint is not resolved, you can escalate through your bank's grievance officer and, after the prescribed period, to the RBI Ombudsman via the RBI's complaint portal. Our guide on bank customer rights and complaints explains these steps.
What to do after a fraud
Act fast. Minutes matter.
- Call 1930, the national cyber crime helpline, or report at cybercrime.gov.in immediately.
- Inform your bank right away through its official helpline, app or branch, and ask them to block UPI and cards if needed. Under RBI rules, how quickly you report affects your liability. In cases where you were not negligent, reporting within three working days of the bank's alert can mean zero liability. If you shared your PIN or OTP, you may bear the loss until you report it, so report as soon as possible.
- Raise a complaint in the UPI app on that transaction.
- Change your UPI PIN, and uninstall any remote access app you were asked to install.
- Keep screenshots, phone numbers, UPI IDs and transaction IDs as evidence.
You can also report suspected fraud calls, SMS and WhatsApp messages on the government's Sanchar Saathi portal (Chakshu), even if you did not lose money.
Teach elderly family members
Parents and grandparents are frequent targets. Sit with them once, show them what a "Pay" screen looks like, and agree on a simple family rule: before approving any unexpected request or scanning a code sent by someone, call a family member first. A two-minute call can save months of savings.
Frequently asked questions
Can someone take money from my account if they know my UPI ID or phone number?
No, not by themselves. Your UPI ID and number are for receiving money. Money can leave only when you approve a payment with your PIN. That is why fraudsters try to trick you into entering it.
Is it safe to show my QR code to customers?
Yes. Your own QR code is for receiving money. Just verify payments in your app, not on the customer's screen.
Will I get my money back after a fraud?
It depends on how quickly you report, whether the money can be traced and frozen, and the circumstances. Reporting to 1930 and your bank within minutes or hours gives the best chance.
What is next
Try this today: explain "You never need a PIN to receive money" to one family member, check whether your bank lets you set a lower UPI limit, and save 1930 in your contacts. In the next part of Tech for Beginners, we will cover debit cards, net banking and wallets, and how to pay safely online.
