The Complete UPI Safety Guide for India
UPI has made everyday payments faster for hundreds of millions of Indians, but it has also created new openings for fraud. This guide covers every rule you need to protect your bank account when using PhonePe, Google Pay, Paytm, or BHIM.
What is UPI and why does it attract fraud?
Unified Payments Interface (UPI) is a real-time payment system built by the National Payments Corporation of India (NPCI) and regulated by the Reserve Bank of India (RBI). It links your bank account directly to apps such as PhonePe, Google Pay, Paytm, and BHIM, allowing instant transfers 24 hours a day.
Because UPI moves real money instantly and cannot be automatically reversed by your app, a single mistake can drain your account in seconds. Fraudsters know this and have built entire industries around tricking people into authorising payments. Understanding how UPI actually works is the first step to staying safe.
The golden rules every UPI user must follow
Your UPI PIN is for sending money, never for receiving it
This is the single most important rule. You only enter your UPI PIN when you are sending money or making a payment. If someone calls you, messages you, or sends you a request asking you to enter your PIN to “receive” money, it is a scam. There is no such process. Entering your PIN in response to any incoming request will send money from your account to theirs.
Collect requests are payment requests, not receipt confirmations
A collect request (sometimes shown as a “money request” or “request money” notification) is asking you to authorise a payment from your account to someone else. When you approve a collect request, money leaves your account. Fraudsters phrase collect requests as though you are about to receive money: “Your refund of ₹5,000 is ready — approve to receive.” This is a lie. Always read the direction of any transaction carefully before approving.
Never share your OTP with anyone
A one-time password (OTP) sent to your mobile is a security credential. No bank, no UPI app, no government department, and no customer-care representative will ever ask you to share an OTP over phone or chat. If you share an OTP, an attacker can link your bank account to a device they control.
Verify the receiver’s UPI ID before every payment
Check the name displayed after you enter a UPI ID or scan a QR code. Every UPI app shows a confirmation screen with the recipient’s registered name before you confirm. If the name shown does not match the person you intend to pay, stop immediately.
Do not scan QR codes sent by strangers
A QR code shown to you by a buyer or stranger — especially for a refund or token advance — typically encodes a payment request, not a receive instruction. Scanning and approving it will send money to the scammer.
Understanding the collect-request trap in detail
The collect-request trap is the most common UPI scam in India. Here is how it typically unfolds on an OLX or similar classified ad:
- You post an item for sale. A “buyer” contacts you and agrees to pay immediately.
- They say they will send a UPI collect request for the amount as a “verification”.
- A notification arrives in your UPI app saying “[Name] is requesting ₹X from you”.
- You enter your PIN thinking you are confirming receipt — but you have just sent the money.
The correct behaviour: ignore all collect requests from unknown numbers. Sellers never need to accept collect requests. If someone wants to pay you, they enter your UPI ID and send money directly. You will receive it without doing anything.
UPI AutoPay mandates: what to watch
UPI AutoPay (recurring mandates) allows apps to debit your account automatically at fixed intervals — useful for subscriptions, EMIs, and utility bills. However, poorly explained or fraudulently obtained mandates can drain your account silently.
- Always read mandate notifications carefully before approving. The amount, frequency, and merchant name are shown.
- Review active mandates regularly. In PhonePe: Profile → Manage Mandates. In Google Pay: Settings → Autopay. In Paytm: UPI Autopay section.
- Cancel any mandate you do not recognise. Contact your bank if a mandate is debiting money you did not authorise.
- For mandates above ₹15,000 per transaction, additional PIN or OTP authentication is required — this is an NPCI-mandated safeguard.
Setting up your UPI apps securely
Use a strong app lock or biometric authentication
Enable the fingerprint or face-unlock option within your UPI app. This prevents anyone who picks up your unlocked phone from sending money. On PhonePe go to Profile → App Lock; on Google Pay go to Settings → Privacy → App Lock; on Paytm go to Profile → Security Settings.
Set a transaction limit if your bank allows it
Many banks allow you to set a daily UPI transaction limit lower than the NPCI ceiling of ₹1 lakh. Log in to your bank’s net banking or mobile banking app and look for UPI transaction limit settings. A lower daily cap means a fraudster cannot empty your account even if they gain access.
Register only your main mobile number with UPI
Your UPI-registered SIM must stay active. If your number is ported or deactivated, immediately deregister UPI apps linked to that number before the number is reassigned.
Enable SMS alerts for every bank transaction
Make sure your bank sends you an SMS for every debit, however small. This is your early warning system. Contact your bank’s customer care to activate it if it is not already on.
Keep your UPI app updated. NPCI and app developers regularly release security patches. An outdated app may have known vulnerabilities that fraudsters actively exploit.
Recognising fake UPI customer-care numbers
Fraudsters create fake helpline numbers and post them on social media, WhatsApp, and even fake websites that appear in search results. When a victim calls about a failed transaction, the fake agent says they need remote access or an OTP to “process the refund”.
- Always get customer-care numbers only from the official app itself or the official website.
- PhonePe helpline: available in-app or at phonepe.com/help.
- Google Pay support: in-app → Help → Contact Us.
- Paytm support: paytm.com/care or in-app chat.
- BHIM: bhimupi.org.in or the in-app Help section.
- NPCI helpdesk: 1800-120-1740 (toll-free).
Never install any remote-access app (AnyDesk, TeamViewer, or similar) at the request of a person claiming to be bank or UPI customer care. This is a near-universal indicator of fraud. Once you grant remote access, the attacker can see your OTPs in real time and transfer all your money.
What to do within the first hour after a UPI fraud
Call your bank immediately
Call your bank’s 24-hour fraud helpline and ask them to block or flag the transaction. Ask for a complaint reference number. Time matters: if the receiving account has not been emptied or the funds are still in a payment gateway, the bank may be able to hold them.
Call the National Cyber Crime Helpline: 1930
Dial 1930 from any phone. This is the Government of India’s dedicated financial-fraud helpline. Operators can flag the fraudster’s account with the receiving bank and, in some cases, initiate a hold before money is withdrawn. Have your transaction ID, date, time, and amount ready.
File a complaint on cybercrime.gov.in
Go to cybercrime.gov.in and file a financial-fraud complaint. You will receive a complaint number which can be used at the police station. This creates an official record with the National Cyber Crime Reporting Portal operated by the Ministry of Home Affairs.
Visit your nearest police station
File an FIR or complaint under the IT Act. Bring printouts of your transaction history, screenshots of any messages, and your bank statement showing the fraudulent debit. If the officer is unfamiliar with cyber fraud, ask them to register it with the Cyber Crime Cell.
Report on the UPI app
Use the in-app reporting feature to report the fraudulent UPI ID. This flags the ID to NPCI and may prevent others from being victimised.
Special caution: SIM-swap fraud
In a SIM-swap attack, a fraudster convinces your mobile operator to transfer your phone number to a new SIM card they control. With your number, they can receive OTPs and gain control of your UPI apps and bank accounts.
- If your phone suddenly loses mobile signal in an area with normal coverage, call your operator immediately from another phone.
- Set a SIM-lock PIN with your mobile operator.
- Register an alternate mobile number or email with your bank for alerts.
Your action plan
- ✓ Enable app lock and biometric authentication on all UPI apps.
- ✓ Set a lower daily UPI transaction limit with your bank.
- ✓ Confirm SMS alerts are active for all bank accounts.
- ✓ Never enter your PIN for any reason except sending money yourself.
- ✓ Reject all collect requests from unknown numbers.
- ✓ Keep customer-care numbers saved from official sources only.
- ✓ Review and cancel any UPI AutoPay mandates you do not recognise.
- ✓ If fraud occurs: call your bank, dial 1930, report at cybercrime.gov.in, file a police complaint.
Frequently Asked Questions
Stay safe online with Cyber Kannadigas
Get cyber-safety alerts, scam warnings, and digital-literacy tips for Karnataka — free, weekly.