UPI fraud: the common tricks and how to protect yourself
Most UPI fraud relies on tricking you into entering your PIN or sharing a code. The common scams, simple rules that stop them, and what to do if money is taken.
The short answer
You never need to enter your UPI PIN to receive money — a PIN is only for sending. Most UPI fraud tricks people into approving a "collect request", scanning a QR code, sharing an OTP or installing a screen-sharing app. If you are defrauded, report it immediately on the national cybercrime helpline 1930 or at cybercrime.gov.in, and inform your bank.
Key takeaways
- Entering your UPI PIN always means money is leaving your account.
- Never share OTPs, PINs or passwords — no genuine bank or company will ask for them.
- Do not install screen-sharing or remote-access apps at a stranger’s request.
- Verify the name shown before you pay, and be wary of urgency and pressure.
- Report fraud immediately on 1930 or cybercrime.gov.in — speed improves the chance of recovery.
UPI has made paying anyone in India instant and almost free. Fraudsters know this too. The good news is that nearly every UPI scam depends on one thing: getting you to approve a payment. Learn a few rules and you can stop almost all of them.
The one rule to remember
A UPI PIN is only ever needed to send money. You never need it to receive money.
If anyone asks you to enter your PIN, scan a code or approve a request “to receive” money, it is a scam.
The most common UPI scams
1. The fake collect request
You receive a payment request that looks like a refund, prize or buyer’s payment. Approving it and entering your PIN sends money instead.
2. The QR code trick
Often used on online marketplaces: a “buyer” sends a QR code and says scanning it will transfer the payment to you. Scanning and entering a PIN pays them.
3. Fake customer care
You search online for a company’s helpline and call a number that belongs to a fraudster. They ask you to install a “support” app or share an OTP.
4. Screen-sharing apps
The caller asks you to install an app so they can “help”. These apps let them see your screen — including OTPs and PINs.
5. “Wrong transfer” pressure
You get a message saying money was sent to you by mistake, followed by an urgent request to return it. Often, no money was ever sent.
6. Fake KYC or account-block threats
A message says your bank account or SIM will be blocked unless you update KYC via a link. The link steals your details.
Simple rules that stop most fraud
- Never share OTP, UPI PIN, card PIN, CVV or passwords — with anyone.
- Check the name displayed on the payment screen before you pay.
- Do not click links in unexpected SMS, WhatsApp or email messages.
- Find helpline numbers only on the official website or app — never from search ads or social media.
- Do not install apps because a caller asked you to.
- Slow down. Urgency and pressure are the fraudster’s best tools.
- Set a daily UPI limit in your app that matches your real needs.
If you have been defrauded
Act quickly — speed matters.
- Call 1930, the national cybercrime helpline, or file a complaint at cybercrime.gov.in.
- Inform your bank immediately and ask them to block further transactions.
- Note the details: transaction ID, date, time, amount and the fraudster’s UPI ID or number.
- Change your PINs and passwords, and uninstall any app the fraudster asked you to install.
- Keep copies of your complaint numbers and follow up.
Protect the family
Older parents and teenagers are often targeted. Share the “PIN means paying” rule with them, and agree that they will call you before acting on any urgent message about money.
Frequently asked questions
Someone sent me money by mistake and is asking me to return it. What should I do?
Be careful — this is a known trick. Check your bank statement directly (not just the message). If money really was received, contact your bank and let them handle the reversal rather than sending money to the caller.
Can scanning a QR code take money from my account?
Scanning a QR code is used to pay. If you are told to scan a code to "receive" money, it is a scam.
What is the national cybercrime helpline number?
In India, call 1930 to report financial cyber fraud, or file a complaint at cybercrime.gov.in. Report as quickly as possible.