To secure UPI, protect both the phone and the payment authorization: use a strong screen lock, keep your UPI PIN private, check the payee and amount before approving a payment, and confirm the limits your bank or app applies to your account. Menu names and available controls differ by app, handset, bank and transaction type.
Keep your UPI PIN private—and enter it only to authorize a payment
A UPI PIN is a 4- or 6-digit authorization credential. NPCI’s BHIM-UPI Guidelines, updated 4 June 2026, say: “Enter UPI PIN only on UPI PIN page” and “Only sending money requires UPI PIN”. You do not enter a PIN to receive money.
- Never disclose your PIN to a caller, message sender, or anyone claiming to be bank support. NPCI says bank customer support will never ask for it.
- Do not share an OTP either. Use your bank’s or app provider’s official contact route if you need help.
- Before entering the PIN, verify the recipient and amount. NPCI says an initiated UPI payment cannot be stopped.
These precautions are in NPCI’s UPI FAQ and BHIM-UPI Guidelines. The FAQ’s statement that BHIM does not store or read UPI-PIN details applies to BHIM; do not assume it describes every UPI app’s data handling.
Review your phone lock and UPI app authentication
Phone access and payment authorization are separate controls. NPCI describes device binding as a first authentication factor and the UPI PIN as an additional factor in its UPI ecosystem glossary. A screen lock helps protect access to the device; a UPI PIN authorizes a payment.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Use the strongest screen-lock option you can reliably use, and keep its passcode private.
- In your UPI app and bank app, review any app lock or authentication option actually offered. Paths and labels vary by app and device, so use the app’s own settings rather than relying on a universal menu path.
- If your app offers on-device fingerprint or face authentication for UPI, check its eligibility and terms before enabling it. NPCI circular OC-226, dated 7 October 2025, introduced this as an optional alternative to PIN entry, initially for transactions up to ₹5,000. Participating apps and PSP banks must validate device compatibility and security, including biometric enrollment and state. Availability and the applicable limit may vary; confirm what your app currently supports. This option does not replace the need to protect the phone itself.
Check the limit for your bank account and payment type
A published UPI ceiling is not necessarily the amount your account can send. Banks and apps may impose lower limits or other transaction controls, and the applicable cap can depend on the payment category.
| Published figure | What it applies to | How to use it |
|---|---|---|
| Up to ₹1 lakh per transaction | Normal UPI, according to NPCI’s FAQ | A published general ceiling, not a guarantee that your bank or account permits that amount. |
| Up to ₹2 lakh per transaction | Specified categories listed by NPCI | Check whether your transaction falls within an eligible category and what your bank allows. |
| Up to ₹5 lakh per transaction | IPO and Retail Direct Scheme transactions, according to NPCI’s FAQ | Category-specific ceiling; account and bank controls still matter. |
| ₹5 lakh per transaction | UPI tax payments: the Reserve Bank of India announced an increase from ₹1 lakh on 8 August 2024 | An RBI announcement with instructions to follow; confirm current implementation and your bank’s limit. |
The first three figures are from the NPCI UPI FAQ; the tax-payment change is in the RBI Monetary Policy Statement of 8 August 2024. They describe published category ceilings, not a single universal account limit.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
How to find out whether you can change your limit
- Open your bank’s official app or the UPI app linked to your account and look for UPI, payment, or transaction-limit controls. The exact path and labels depend on the provider.
- Check both the per-transaction and daily limits, and verify that the screen refers to the payment type you plan to use.
- If no relevant control is shown, contact your bank through its official app, website, or published phone number. Ask what limit applies to your account and whether it can be changed.
- Do not use a limit-change link sent unexpectedly by text or a caller. Navigate to the official app or contact the bank independently.
There is no single set of instructions or menu path for changing every bank’s UPI limit. Your bank or app is the authority for the current cap on your account.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Know how to reset your PIN and respond if your phone is lost
Reset a forgotten or exposed PIN through an official route
NPCI’s BHIM-UPI Guidelines describe resetting a UPI PIN from the app using verification. Start from the official app or bank route, and follow its current verification steps. NPCI’s 2025 circular also describes UIDAI face authentication as an optional PIN set or reset method; access depends on participating app and bank availability. Never follow a reset link from an unsolicited message or caller.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
If your phone is lost
- Contact your bank promptly through its official channel and report the lost phone.
- Ask your mobile operator to block the mobile number or SIM associated with UPI.
- Follow the bank’s instructions for securing or disabling UPI access and restoring service on a replacement device.
NPCI’s UPI FAQ advises contacting the bank and blocking the mobile number tied to UPI. A screen lock alone is not a complete lost-phone response.
Quick Recap
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
