UPI scams: you never need your PIN to receive money

If you remember one thing about UPI, make it this:

You never enter your UPI PIN to receive money.

Your PIN is for paying and for checking your balance. Receiving needs nothing from you: someone pays you and it lands. So if any screen asks for your PIN while telling you that you're about to receive money, it's lying, and whatever happens next sends money out of your account. That one rule stops most UPI fraud, whatever form it takes.

What changed on 1 October 2025

UPI used to allow person-to-person "collect requests". I could send you a request for ₹500; your app showed it, and if you approved it with your PIN, ₹500 went from you to me.

It was handy between people who knew each other, and it was also the engine of a very common UPI scam, because the approval screen looked a lot like a notice that money was arriving. NPCI capped these requests at ₹2,000 in 2019 to limit the damage.

From 1 October 2025, NPCI discontinued person-to-person collect requests entirely. Payment apps can no longer start, route or process them, so a stranger can't send you one.

Collect requests from merchants weren't part of that change. They're the kind you see when you type your UPI ID at an online checkout, where the request in your app is one you started yourself. Read any request before you approve it.

Where the scams went

Removing one tool didn't remove the scammers. The same trick now arrives in other forms, and the PIN rule beats every one of them.

"Scan this QR to receive your money." A QR code always sets up a payment from the person scanning it. A "buyer" on a marketplace, a fake refund desk, a prize message: if they send a QR and say scanning it puts money in your account, scanning it and entering your PIN pays them.

"Click this link to get your refund." The same trick as a link: it opens your UPI app ready to pay, dressed up as a refund or cashback.

Fake customer support. You search for a company's helpline and find a planted number. The "agent" walks you through steps to "verify your account", or asks you to install a screen-sharing app to "help". Then they watch you type your PIN. No genuine support team needs your PIN or your screen. For UPI problems, use the help section inside your UPI app or your bank's official app.

"I sent you money by mistake, please return it." A message that looks like a credit alert, then a call asking for the money back. Check your actual balance in your own app. A message saying you were paid proves nothing.

Fake payment screenshots. A customer shows a "payment successful" screen at your counter. The image proves nothing about your account.

→Spotting fake payment screenshots

Scams aimed at shopkeepers

The fake screenshot. Check your own account, not their phone.

The wrong-transfer call. Check your real balance. If money really did arrive by mistake, the sender's bank handles the return; you never send money to a number that called you.

"Update your KYC or your UPI will be blocked." A message with a link and a deadline. Banks don't block UPI by text message, and they don't ask for your PIN, OTP or card details through a link. Delete it.

Fake support for your sound box or payment app. A caller says your device or account needs "verification" and walks you through steps that end with your PIN or a screen-sharing app. Genuine support never needs either.

A QR pasted over yours. Your customers' payments go to a stranger until you notice. Scan your own code every morning.

The big order that needs a fee first. A bulk order from a stranger, conditional on you paying a "registration" or "processing" charge. You're the one who should be getting paid.

Sharing your UPI ID is safe

A UPI ID is an address for receiving money. Knowing it lets someone pay you and see your bank-registered name when they do, and nothing else. They still need you to scan, click or type your PIN. Don't.

→Is it safe to share your UPI QR code? What it reveals

Five minutes to protect yourself

Lock your UPI app with your phone's fingerprint or face lock, or the app's own lock.

Keep notifications and SMS alerts on, so you see every payment in and out.

Never write your UPI PIN down in your phone's notes, a photo or on the back of your card.

Don't install apps from links in messages. Use the official app store and check the developer name.

Read the name before every PIN. It's the one check a pasted QR or a fake screen can't change. If it isn't who you meant to pay, stop.

If it's already happened

Straight away: report it on 1930, the national cyber crime helpline (24 hours), or at cybercrime.gov.in, and call your bank, ideally within the hour. Money reported quickly can sometimes be held before it moves on.

Then raise a complaint in the UPI app where it happened.

Keep everything: the UPI reference number, screenshots, the phone number and the chat. Note the reference number of every complaint you make.

Change your UPI PIN if you shared it, typed it while someone could see your screen, or installed an app someone told you to.

For a large amount, also file an FIR at your local police station.

If your bank doesn't resolve your complaint within 30 days, or rejects it, you can escalate to the RBI's complaint portal at cms.rbi.org.in under the Integrated Ombudsman Scheme.

A suspicious call, SMS or WhatsApp message where no money was lost: report it on Chakshu, on the Department of Telecommunications' Sanchar Saathi portal (sancharsaathi.gov.in).

→Make a QR for your shop