The safest rule is simple: a UPI PIN authorizes money going out; it is never needed to receive money. Do not disclose your UPI PIN, OTP, password, card PIN, CVV or login details, even to someone claiming to be from your bank. Before approving any payment or collect request, verify the payee and amount in your banking app. If an unauthorized transaction occurs, contact your bank through a trusted channel and call India’s 1930 cyber-fraud helpline immediately.
What a UPI PIN does—and what it does not do
Your UPI PIN is an authentication secret used to authorize a payment from your bank account. Entering it confirms that you approve the transaction shown on your screen. It is not a password for receiving money, accepting a refund, completing a KYC check or unlocking a reward.
As an Amazon Associate I earn from qualifying purchases.
A QR code can represent a payment request. Scanning one and entering your PIN normally authorizes money to leave your account. This is why a supposed buyer, courier, customer-support agent or employer who tells you to scan a QR code and enter your PIN to “receive” funds is asking you to make a payment. National Payments Corporation of India (NPCI) guidance specifically warns users not to share a UPI PIN.
Recommended Free Tools
Money being sent to you should appear as a credit in your bank or UPI app without you entering a PIN for the incoming transfer. You may need to accept or confirm some legitimate requests in an app, but inspect the transaction type, beneficiary and amount before doing so. If the screen asks for your PIN, treat it as an authorization to pay and stop if that is not what you intended.
#1 Best Overall
Pause before every payment
Scammers create urgency so that you approve a transaction without reading it. Build a short verification routine and use it even when the request appears to come from a familiar person or company.
- Open the banking app yourself. Do not use a link in an unexpected text, email, social-media message or search result. Type a known address or use the app already installed from your device’s official store.
- Read the beneficiary name and UPI ID. A familiar logo or profile photograph does not prove that the account belongs to the person contacting you. Compare the displayed name with the name you independently expected.
- Check the amount and transaction type. Confirm whether you are sending money, approving a collect request or setting up a mandate. A collect request is not a receipt of money; approving it can debit your account.
- Stop when the story and screen disagree. A “refund,” “cashback,” “verification” or “reward” that requires a PIN is not a receiving transaction. Cancel and verify through the organization’s known official contact route.
- Review the confirmation screen once more. Enter the PIN only after the payee, amount and purpose match what you intended. Never read the PIN aloud or type it into a caller’s form.
Keep your UPI and banking applications updated. Updates can correct security defects and ensure that warnings and transaction details are displayed as intended.
Common scam patterns and the safe response
Fake cashback, refund or reward
A message may promise a refund for a failed delivery, a cashback bonus or a prize. The link leads to a counterfeit page, or the sender instructs you to scan a QR code and enter your PIN. Do not follow the message’s payment instructions. Open your bank or merchant account independently and check whether a refund is actually pending. A genuine incoming credit does not require you to disclose your UPI PIN.
Fake buyer or collect request
Fraudsters posing as buyers sometimes send a collect request and say it is needed to receive payment. Read the request as a debit authorization: identify the beneficiary, amount and purpose. Reject anything you did not initiate or cannot verify. If you are selling an item, wait for the credit to appear in your own bank account; do not rely on a screenshot supplied by the buyer.
Rank #2
- Ideal for Gifting
- Ideal for a bookworm
- Compact for travelling
Impersonation by bank staff or officials
RBI warnings describe callers who claim to be bank employees, regulators, police officers or technical-support staff. They may threaten account closure or investigation, or offer a special benefit, to obtain your OTP, PIN, password, card details or permission to install an app. End the call. Contact the bank using the number printed on your card or statement, the bank’s established app, or its official website that you navigate to yourself. Bank support should not ask for your UPI PIN.
Search-result and social-media impersonation
Fraudulent advertisements and replies can place a fake customer-care number near the real one. Search results and social profiles are not proof of authenticity. Do not disclose credentials to a number found in an unsolicited message or advertisement. Use the contact route embedded in your bank’s app, your card, a statement or a web address you already know.
Malicious links and unknown applications
A link can lead to a look-alike login page, while an unknown application may request access to SMS messages, accessibility controls or screen contents. RBI and NPCI materials identify malicious links, spurious apps and unknown applications as payment-fraud tactics. Do not install software at a caller’s direction. If you have installed one, stop communicating with the caller, preserve relevant evidence, disconnect it from sensitive permissions where safe, and contact your bank through a trusted device or channel.
Free tools Windows power users keep installed
One-click scans. No signup required.
Investment and high-return lures
Promises of guaranteed or unusually fast returns can be used to move a conversation from a social platform to a payment request. Never transfer money merely to “unlock” profits, withdraw a balance or pay a verification fee. Verify the firm independently and use regulated, documented payment channels. A demand for a UPI PIN, OTP or remote-access app is a stop signal regardless of the promised return.
Threatening messages and emergency stories
Scammers may claim that a relative is in trouble, a parcel contains illegal goods or an account will be frozen within minutes. Urgency is a manipulation technique. Call the person or institution through a number you already have, not the number in the message, and do not authorize a payment while facts are unverified.
SIM swap or stolen phone
If your phone is lost, your SIM is stolen, or mobile service suddenly stops without explanation, treat it as a possible account-compromise event. Contact your mobile carrier and bank using trusted channels, ask the bank to secure digital access and payment instruments, and monitor transaction alerts. Change credentials through official apps or sites after the immediate risk is contained. A sudden loss of network service can be a warning sign of an unauthorized SIM replacement.
ATM tampering and card theft
Use ATMs in familiar, well-monitored locations. Inspect the slot and keypad for anything loose or unusual, shield the keypad while entering your PIN, and do not accept help from strangers. If a card is lost, retained by an ATM or possibly copied, report it to the bank immediately and request that it be blocked. Keep transaction alerts enabled so an unfamiliar withdrawal is visible quickly.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Credentials and devices: what must stay private
Treat every item below as confidential. A legitimate bank representative does not need you to reveal it during an incoming call:
Rank #4
- UPI PIN and bank-account PIN
- One-time passwords (OTPs)
- Internet-banking passwords, app passcodes and login credentials
- Debit or credit card number, expiry date, CVV and ATM PIN
- Answers to security questions or recovery codes
Use a screen lock and keep the operating system and banking apps current. Avoid banking on public computers or open Wi-Fi networks. Turn on bank SMS or email alerts where available and read them rather than dismissing them automatically. Keep contact details registered with the bank current so alerts and fraud notices reach you.
Do not permit remote-control or screen-sharing software because a caller says it is needed for a refund or support session. If you believe a device or SIM is compromised, use another trusted device to contact the bank and carrier. Remove suspicious applications only after recording their names and preserving messages or other evidence that investigators may need.
What to do immediately after an unauthorized transaction
Speed matters. The following sequence is designed for a suspected debit, card transaction, account takeover or UPI payment.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →- Stop the interaction. Do not send additional money, share another code or continue chatting with the suspected scammer. Do not click further links.
- Call your bank through a trusted route. Use the number on your card or statement, the bank’s established app or its known official website. Report the transaction as unauthorized, ask the bank to secure the account and relevant payment instruments, and request a complaint or reference number. Ask whether digital access, cards, mandates or UPI handles should be temporarily blocked.
- Call 1930 promptly. India’s National Cyber Crime Reporting system identifies 1930 for immediate reporting of cyber financial fraud. Provide the details requested and complete the associated online portal report when instructed. A helpline report does not by itself guarantee that money will be recovered.
- Preserve evidence. Record the transaction ID, date and time, amount, UPI ID or bank account, card details limited to what the reporting channel requests, phone numbers, email addresses, chat messages, call times and screenshots. Keep bank and portal acknowledgements.
- Secure the device and identity. If a SIM swap or lost phone is possible, contact the carrier and bank. Change passwords and app passcodes through official channels, sign out other sessions where the bank provides that option, and review beneficiaries, mandates and recent login activity.
- Monitor and follow up. Check subsequent alerts and statements for additional debits. Use the bank’s complaint reference and the cybercrime acknowledgement when following up; ignore anyone who later promises recovery in exchange for another fee.
Choosing the right response for the situation
| Situation | First action | Information to report |
|---|---|---|
| You approved a payment after being deceived | Contact the bank immediately, then call 1930 | Transaction ID, beneficiary, amount, time, messages and how the request was presented |
| You see a debit you did not authorize | Use the bank’s fraud-reporting channel and request account or card protection | Alert or statement details, account or card involved, date, amount and screenshots |
| Your phone or SIM is lost, swapped or suddenly disconnected | Contact the mobile carrier and bank through trusted channels | When service stopped, device or SIM details, recent alerts and any suspicious calls |
| You installed an app at a caller’s request | Stop contact; use a trusted device or channel to ask the bank to secure access | App name, installation time, permissions granted, messages and transactions |
| A card is lost, retained or suspected to be copied | Ask the bank to block it and report any unauthorized transactions | Card, ATM or merchant details, time and location, plus alerts |
Liability, reporting deadlines and recovery
Do not assume that every fraud report produces a refund or that one rule applies to every bank and payment. Responsibility can depend on whether you authorized the transaction, whether you shared credentials, how quickly you notified the bank, which institution handled the payment and the institution’s current policy.
Best Value
- It can be a gift option
- Comes with secure packaging
- Helpful in various ways
RBI’s customer-protection notification dated 14 December 2017 and cited here is specifically for cooperative banks. It says customers should notify their bank at the earliest after an unauthorized electronic transaction. For certain bank-side failures and some third-party breaches reported within three working days of receiving transaction communication, it describes zero-liability treatment. Where a customer shared credentials, the customer bears the loss until reporting. It also describes limited liability for certain third-party cases reported in four to seven working days and a 10-working-day shadow-reversal timeline for covered cases.
Those provisions are not a blanket promise for every UPI user, bank category or fraud scenario. Report immediately even when you are unsure whether the transaction was technically authorized, and ask your own bank for the applicable liability rule, complaint process and documents. Keep the complaint number and escalate through the bank’s formal grievance route if the response is incomplete.
A practical prevention checklist
- Update UPI, banking and phone software from trusted sources.
- Verify the beneficiary name, UPI ID and amount before entering a PIN.
- Read every collect request; reject one you did not initiate or cannot independently verify.
- Never share a UPI PIN, OTP, password, CVV, card PIN or login credential.
- Never scan an unknown QR code or follow an unsolicited refund or reward link that asks for a PIN.
- Use the bank’s known app, card, statement or official site instead of search ads or social-media replies for support.
- Avoid transactions on public devices and open Wi-Fi; use device locks and transaction alerts.
- Keep your mobile number and email current with the bank and carrier.
- After a suspicious event, preserve evidence before deleting messages or applications.
- Report quickly to the bank and 1930; retain both acknowledgements.
Official guidance to remember
NPCI’s UPI FAQ states: “Please do not share your UPI-PIN with anyone.” RBI’s customer-protection notification for cooperative banks states: “The customers must be advised to notify their bank of any unauthorised electronic banking transaction at the earliest after the occurrence of such transaction”. These two instructions capture the essential habit: protect the authorization secret and report a suspicious debit without delay.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
