UPI Fraud Se Kaise Bachein — The 9 Scams and How to Stop Them

UPI has made payments effortless for over 350 million Indians. But the same speed that makes it convenient also makes fraud fast. The good news: almost every UPI scam relies on one mistake from you — and once you know the pattern, they stop working.

The golden rule of UPI

You never enter your UPI PIN to receive money. Your PIN is only ever needed to send money out of your account.

The 9 most common UPI scams in India

1. The "wrong payment" refund trick

A stranger calls saying they accidentally sent you money and asks you to return it. They send a collect request (a request for money) disguised as a refund. If you approve it, money leaves your account.

2. Fake QR code scam

On marketplaces like OLX, a "buyer" sends a QR code claiming you must scan it to receive payment. Scanning a QR and entering your PIN always sends money — never receives it.

3. Screen-sharing apps

A "bank executive" asks you to install AnyDesk or TeamViewer to "fix" an issue. They then watch your screen and steal your PIN and OTP.

4. Fake UPI handles

Scammers create handles that look official, like paytm.refund@oksbi. Always verify the name that appears before paying, not just the handle.

5. SIM swap fraud

Fraudsters get a duplicate SIM of your number, then reset your UPI and intercept OTPs.

6. Phishing links

A link claims your KYC will expire or you've won a prize. It opens a fake page that captures your card or UPI details.

7. Cashback and reward scams

You're promised cashback if you "verify" by sending ₹1 — which exposes your details and trains you to approve their requests.

8. Silent auto-pay mandates

You approve what looks like a one-off ₹1 or ₹10 payment — for a "verification", a free trial or a small reward. What you actually authorise is a recurring mandate that quietly debits your account every month. Because the amount is small, most people notice only after several cycles. Always read what you are approving: a mandate screen shows a frequency and an end date, a normal payment does not.

9. The "help me, I'm family" message

A message from an unknown number claims to be your son, daughter or a close relative who has "lost their phone" and urgently needs money sent to a new UPI ID. It works because it bypasses the technical defences entirely and goes straight at your instinct to help. Call the person on their known number before sending anything, however convincing the story.

The settings that protect you before anything happens

Most UPI advice is about spotting scams in the moment. These settings reduce what a scam can cost you even when you do slip — and they take about ten minutes once.

• Set a daily transaction limit you actually need. Most banking apps let you lower your UPI limit well below the default. If your normal life involves paying a few thousand rupees a day, a limit set there caps the damage of any single bad minute.
• Review your active mandates. Every UPI app has an autopay or mandate section listing recurring debits. Open it, read every entry, and cancel anything you do not recognise. Do this quarterly — it is the single best defence against scam 8 above.
• Turn off or restrict collect requests where your app allows it. Most people never legitimately receive a collect request from a stranger, and disabling them removes an entire scam category at once.
• Use UPI Lite for small everyday payments. It keeps low-value spending in a separate small balance, so your main account is not exposed for every chai and auto ride.
• Lock the app itself with a separate biometric or PIN, so a handed-over or stolen phone is not an open bank account.
• Check which accounts are linked. If you have added an account you no longer use, remove it. Fewer linked accounts means less to protect.

A quick comparison: safe vs unsafe actions

If it has already happened

That sequence is what lets banks freeze the money while it is still moving. We cover the full minute-by-minute process, your zero-liability rights under RBI's rules, and how frozen money actually comes back in our dedicated guide: Scammed on UPI? The First 60 Minutes.

Frequently asked questions

Can someone take money from my account just by knowing my UPI ID?

No. A UPI ID on its own is like a postal address — it lets people send you money, not take it. Money only leaves your account when your UPI PIN is entered on your device. That is precisely why every scam in this guide is ultimately an attempt to get you to enter your PIN yourself.

Is it safe to share my UPI ID or QR code publicly?

Yes, for receiving payments — shopkeepers display QR codes all day. The risk is not exposure of the ID but the follow-on social engineering: once someone has your number or ID, they may call pretending to be support, or send collect requests. Sharing it is fine; acting on unsolicited contact about it is not.

What happens if I scan a QR code by mistake?

Nothing, as long as you do not complete the payment with your PIN. Scanning only opens a payment screen. Read what it says before proceeding — if a screen appears asking for your PIN when you expected to receive money, close it. Receiving never requires a PIN.

Are UPI apps like GPay, PhonePe and Paytm equally safe?

Broadly yes — they run on the same NPCI infrastructure with the same PIN protections, so the differences are in interface, not underlying security. Your risk comes from how you use them, not which one you pick. Whichever you use, set a daily limit and review your mandates.

Is UPI Lite safe if it does not need a PIN?

Yes, by design. UPI Lite holds a small balance separate from your bank account and is intended for low-value payments where entering a PIN each time is impractical. The protection is the cap: because only a small amount sits there, the most anyone can take is that small amount. Do not treat it as a reason to relax about your main account.

My bank sent an OTP I did not request. What does that mean?

Treat it as a signal that someone is actively trying to use your details. Do not share it with anyone, including a caller claiming to be from the bank. Change your UPI PIN and banking password, and call the bank on the number printed on your card — never a number from the message or the caller.

Can I get my money back if I approved the payment myself?

It is harder, but not hopeless. RBI's zero-liability protection applies to unauthorised transactions reported within three working days. If you were tricked into pressing "Pay" yourself, recovery depends mainly on whether the money was frozen before it was withdrawn — which is why reporting to 1930 within the hour matters more than anything else you can do.

The bottom line

UPI itself is safe — the weak link is always social engineering. Slow down whenever someone creates urgency, never share your PIN or OTP, and remember that receiving money never requires your PIN. Then spend ten minutes on the settings above, so the one day you do slip costs you far less than it could have.