UPI Safety: How to Use India's Payment Backbone Without Getting Scammed

The one rule that prevents most UPI fraud

You only ever enter your UPI PIN to send money, never to receive it. If an app or a caller asks you to enter your PIN to "receive a refund," "claim a prize," or "verify your account," that is a scam, every single time, with no exceptions.

Common scam patterns to recognize

• Fake "collect request": a scammer sends a payment request disguised as if you're about to receive money - approving it (entering your PIN) actually sends money out of your account.
• QR code scams: someone claiming to be a buyer on a resale marketplace asks you to "scan this QR to receive payment" - scanning and entering a PIN to receive money is never how UPI works; you never need to enter a PIN to receive funds.
• Remote-access app tricks: a caller posing as bank/tech support convinces you to install a screen-sharing app "to fix an issue," then watches you enter your PIN or directly controls your phone.
• Urgency and authority: nearly every scam pattern above relies on manufactured urgency ("your account will be blocked in 10 minutes") or a claim of official authority (posing as your bank, the RBI, or a well-known company).

Everyday safety habits

• Never share your UPI PIN, OTP, or CVV with anyone - not your bank, not "customer support," not family claiming an emergency over a call you didn't initiate.
• Double-check the payee name shown before confirming any payment - a wrong or unfamiliar name is a red flag worth stopping for.
• Set a daily UPI transaction limit your bank's app allows, sized to your normal usage - it caps the damage if something does go wrong.
• If you get an unexpected request, verify through the bank's official app or number - never through a contact number given to you in the same suspicious message or call.

If something feels off

Stop before completing the transaction. A genuine refund, prize, or support request from a real institution will never require you to authorize an outgoing payment, share your PIN, or install remote-access software. See our article on what to do if you've already been scammed.