Staying safe on UPI
UPI itself is secure. Almost every loss happens because someone is persuaded to approve a payment or hand over access. A few fixed rules shut most scams down.
The one rule that matters most
You never need to enter your UPI PIN, scan a QR code or share an OTP to receive money. All three are steps for sending money. Anyone who asks you to do them “to get your refund” or “to receive payment” is taking money from you.
Scams to recognise
- The buyer who pays by QR. You list something for sale; the “buyer” sends a QR code to scan so you can “receive” the amount. Scanning and entering your PIN pays them.
- Fake customer care. A search result or social post shows a helpline number. The “agent” asks you to install a screen-sharing app or share an OTP. Use only the number inside your bank or payment app.
- Wrong transfer, please return. You get a message that money was sent to you by mistake, followed by an urgent call. Check your actual bank balance; if a real credit arrived, ask the sender to raise it with their bank.
- KYC or electricity disconnection threats. A message says your account or power will be cut tonight unless you call a number or tap a link. Banks and utilities do not work this way.
- Digital arrest. Callers pose as police, customs or a courier company, claim a parcel or case is in your name and demand payment over video call. No Indian agency arrests or collects money over a call.
- Task and investment groups. Small early payouts for rating videos or “trading tips” lead to demands for larger deposits that never return.
Habits that protect you
- Read the name shown before you enter the PIN. If it is not who you expect, stop.
- Set a daily UPI limit in your app that matches your real needs, and use a small-value wallet for everyday payments.
- Lock your phone and the payment app separately, and never save PINs in notes or chats.
- Do not install apps from links, and remove any remote-access app you do not use.
- Turn on SMS and app alerts so an unknown debit is noticed in minutes.
If money has gone
- Call 1930, the national cybercrime helpline, at once. Early reports can freeze the money before it is withdrawn.
- File a complaint at cybercrime.gov.in and keep the acknowledgement number.
- Tell your bank through its official channel and block UPI, cards and net banking if your phone or credentials are compromised.
- Save evidence: screenshots, numbers, transaction IDs.
Speed matters. Under Reserve Bank rules your liability for unauthorised transactions is limited when you report promptly, and reporting within three working days gives the strongest protection. Payments you approved yourself under deception are harder to recover, which is why the first hour counts.
Share these rules with parents and older relatives. They are targeted most.
UPI is a payment system operated by NPCI. Rupya.com is not affiliated with NPCI or any bank or payment app.