The safest rule is simple: never share your UPI PIN or OTP, and enter your PIN only after checking that the app is asking you to pay the correct person the correct amount. A PIN is not needed to receive money. If a payment looks suspicious or has already gone through, report it through your UPI app or bank and call India’s cyber-fraud helpline, 1930.
What a UPI PIN does—and what it does not do
Your UPI PIN authorizes a transaction. It should remain private: the National Payments Corporation of India (NPCI) says not to share it and says bank customer support will never ask for it. Treat OTPs as private security information too. Do not disclose either code to a caller, message sender, or anyone claiming to help with a payment.
You do not enter a UPI PIN to receive money. NPCI warns that scanning a QR code and then entering a PIN is part of making a payment, not receiving one. Before authorizing anything, read the action shown in your app and check the payee and amount. If a screen asks you to pay when you expected a refund, reward, or incoming transfer, stop.
How to spot and avoid common UPI scam tactics
Fake rewards, refunds, and QR-code instructions
A scammer may claim that you must scan a QR code or enter your PIN to claim cashback, a prize, a refund, or money someone is sending you. NPCI specifically warns about fake cashback links and QR-code lures. A QR scan alone is not the authorization step; the critical point is to understand the payee and payment prompt before entering your PIN. Do not follow payment links or QR instructions from an unknown person unless you have independently verified the source and purpose.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Unsolicited collect requests
A collect request asks you to approve a payment. The Reserve Bank of India (RBI) advises users to review the merchant or person’s collect request and reconfirm the recipient and amount. Pause before accepting an unexpected request. Reject it if you do not recognize the requester or the reason, and verify any claim of an urgent refund, account block, or need for help through a trusted channel—not by replying to the message or calling a number it provides.
Threats, investment pitches, and unknown apps
NPCI flags threatening messages, fake investment schemes, online scams, and requests to download unknown apps as fraud patterns. Do not install an unfamiliar app or remote-access tool because a caller says it is required to fix a payment problem. Stop the conversation and contact your bank using a number or channel you already trust.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
The “jumped deposit” claim
NPCI’s clarification dated 13 January 2025 says that simply opening a UPI or bank app does not automatically approve a payment. Its explanation says a user must navigate to the request, select Pay, and authorize the transaction with the UPI PIN. That describes the payment mechanics; it is not a reason to ignore suspicious activity. Check the transaction and report anything you did not authorize.
Use this check before approving any payment
- Read the action on screen. Confirm whether the app is asking you to pay or showing an incoming payment. Never enter a PIN to receive money, a refund, or a reward.
- Verify the recipient and amount. Check the payee details and exact amount before authorizing. Do not approve an unfamiliar or unsolicited collect request.
- Keep credentials private. Never tell anyone your UPI PIN or OTP, including someone who claims to be from your bank or payment app.
- Use the official app and a protected phone. Keep your UPI/payment app updated and secure your phone and app with a strong passcode. Avoid unknown apps and links.
- Pause when someone is pressuring you. Do not approve a payment while following a stranger’s instructions. End the interaction and verify the claim independently through your bank or the relevant organization’s official channel.
NPCI’s UPI safety guidance and the RBI’s Financial Awareness Messages also advise users to protect their PIN, keep apps updated, and use device security.
Recommended Free Tools
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
What to do if money is deducted or you suspect fraud
- Report the transaction to your UPI app or bank. Open the transaction history and use the app’s complaint or issue-reporting option, or contact your bank. NPCI’s UPI FAQ describes raising or checking a grievance through the participating UPI app; BHIM’s complaint guidance describes reporting an issue from transaction history.
- Report cyber financial fraud promptly. Call India’s 1930 helpline and file a report through the National Cyber Crime Reporting Portal. The portal identifies 1930 for immediate reporting of cyber financial fraud.
- Keep the relevant details. Save the transaction reference, amount, time, payee information, messages, phone numbers, and screenshots. These can help when you explain the incident to your bank and when filing a report.
- Follow your bank’s instructions to secure your account and device. Stop communicating with the suspected scammer and do not install software they recommend.
If a payment is pending or failed but money was debited
Check the payment status in your app and with your bank, then use the app or bank complaint route if the status remains unclear or the amount has not returned. NPCI’s FAQ describes real-time reversals for declined transactions but says delayed reversals may require contacting bank support. Reversal handling and timelines can change, so follow the current status and instructions provided by your bank or payment app.
Quick Recap
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Keep your account harder to misuse
- Use a strong phone passcode and app lock where available.
- Install app updates, and use only official app sources.
- Do not share your PIN or OTP, or approve a prompt because another person tells you to.
- Verify unexpected payment requests and claims through a trusted channel before taking action.
- Know how to find your app’s transaction history and complaint option before you need them.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
