Is UPI safe?
UPI has protections built in. In a Lok Sabha reply on 16 March 2026, the Finance Ministry listed them (PIB): your UPI account is bound to your mobile number and your phone (device binding), every payment needs a second factor in your UPI PIN, there are daily transaction limits, and NPCI gives every bank an AI-based fraud monitoring system that raises alerts and declines suspicious payments. The same reply says UPI carried 81% of India's retail digital payments in 2024-25.
So a stranger can't simply pull money out of your account. The weak point is the moment you approve something. The RBI's fraud awareness booklet, BE(A)WARE, lists how fraudsters work, and its UPI tricks end in one of two ways: you type your own PIN on a payment you think is something else, or you hand over your PIN, an OTP or control of your phone.
UPI scam kaise hota hai? Seedhi baat: scammer aapse hi PIN dalwata hai. Kabhi QR scan karwata hai, kabhi "refund" ya "cashback" ke naam pe request bhejta hai, kabhi screen-sharing app install karwata hai. Paisa lene ke liye PIN kabhi nahi lagta.
Do you need a UPI PIN to receive money?
No. The RBI booklet puts it plainly: "there is no need to enter PIN / password anywhere to receive money." It adds that if UPI or any other app needs your PIN to finish a transaction, you are sending money, not receiving it. The same goes for QR codes: receiving money never requires you to scan one.
That one rule breaks the QR, collect request, refund and "sent by mistake" tricks below.
Types of UPI fraud and how each one works
Each of these is described by the RBI, NPCI or a bank's own warning. For each one: how it starts, the moment the money goes, and the tell.
1. QR code scam: "scan this to get your money"
- How it starts: The RBI says fraudsters reach people with one excuse or another and talk them into scanning a QR code with their payment app. A buyer's advance, a refund and a prize are all excuses that fit.
- The moment money goes: A QR code carries the details of the account that gets paid. Scanning it opens a payment screen, and when you enter your PIN there, you pay them.
- The tell: Anyone asking you to scan a QR code to receive money. The RBI's advice is never to scan a QR code to receive money.
2. Collect request scam: "approve this to get paid"
- How it starts: The RBI booklet describes fake buyers on online sales platforms, often claiming to be defence personnel posted somewhere remote. Instead of paying, they use UPI's "request money" option and press the seller to approve it with a PIN.
- The moment money goes: You enter your PIN on the request, and the money moves to their account.
- The tell: The button says Pay and the screen wants your PIN. NPCI stopped person-to-person collect requests from 1 October 2025 (PTI via The Week), so a request that reaches you now should be from a business you asked to bill you, like your grocer or your gym. Decline anything you didn't expect.
3. Refund scam with a fake customer care number
- How it starts: A payment fails or an order goes wrong, so you search for the company's helpline. The RBI says numbers shown on search engines often belong to fraudsters, made to look like the bank's or company's. In another version, someone calls you first: the RBI lists crediting back a debited amount as one of the excuses used in fake calls.
- The moment money goes: The "agent" asks for your card details, PIN or OTP for "verification", sends a QR code or request to "process the refund", or asks you to install an app (the next scam).
- The tell: A mobile number. The RBI says customer care numbers are never mobile numbers, so take them from the company's official website or app, not the search results page. Under TRAI's rules, bank service calls are meant to come from 1600xx numbers (PIB), and our guide to TRAI's spam call rules explains them. Even then, no genuine caller needs your PIN or OTP.
4. Screen-sharing app scam
- How it starts: A support executive says they can fix your problem faster if you install an app and read out a code.
- The moment money goes: With the app running, the RBI says, they can watch or control your phone, see your banking details as you type them, and make payments from your banking or UPI apps.
- The tell: Anyone calling from a personal number who asks you to install an app. The RBI's advice: install a screen-sharing app only when the company's official toll-free number tells you to, log out of payment apps first, and delete it when the work is done.
5. "Sent by mistake" (jumped deposit) scam
- How it starts: A small amount lands in your account, or the caller says it did. Then someone calls, panicking, asking for it back.
- The moment money goes: They send a payment request or QR code "so you can return it", for far more than they sent.
- The tell: A stranger who wants the refund from you directly. Check the balance in your bank's own app, not the SMS or screenshot they send; the RBI notes that fraudsters send spoofed SMSes made to look like your bank's. Let your bank handle any genuine wrong credit. The full walkthrough is in our post on the jumped deposit scam.
6. Fake app links
- How it starts: A link arrives by SMS, email, WhatsApp or social media to an app made to look like your bank's or another trusted company's.
- The moment money goes: Once you install it, the RBI says, the fraudster can get complete access to your phone, including messages and OTPs received before or after the install.
- The tell: Any app link someone sends you. The RBI says never to download an app from an unknown source or because a stranger told you to, and to check the publisher, the ratings and the permissions it asks for.
7. AutoPay requests you didn't set up
- How it starts: We didn't find an official warning that describes a single AutoPay script, so here is what approving one does. AutoPay lets a merchant debit your account again and again. NPCI's AutoPay guideline shows the mandate screen: the amount is taken multiple times, at the stated frequency, for as long as the mandate is valid (NPCI).
- The moment money goes: You approve the mandate with your UPI PIN. That gives the merchant a standing permission, not a one-time payment.
- The tell: A mandate for something you didn't sign up for, or a cap higher than the plan you chose. Decline it. The same guideline says you can pause or revoke a mandate any time, and your UPI app lists the active ones.
8. SIM swap
- How it starts: Someone posing as mobile network staff offers a free SIM upgrade or extra benefits and asks for your identity details, according to the RBI booklet. With those, they get a duplicate SIM or eSIM for your number.
- The moment money goes: OTPs for your bank account now arrive on their SIM, and they use them for transactions.
- The tell: Your phone shows no network for a long time in a place where it normally works. The RBI says to contact your operator at once to check whether a duplicate SIM has been issued.
Scams where you send the money yourself
Some frauds need no trick screen. They talk you into paying, and UPI is how the money leaves. These come from the same RBI booklet, except digital arrest, which the CBI has warned about:
| Scam | What you're asked to pay | The tell |
|---|---|---|
| Online job offer | Registration, training or laptop fee | The RBI says a genuine employer never asks for money to give you a job |
| Lottery or prize | Tax, shipping or processing fee to release the prize | The RBI's advice is never to pay in response to a lottery call or email |
| Instant loan | Processing fee, GST or advance EMI before the loan arrives | Real lenders deduct the processing fee from the loan instead of asking for it first |
| Friend on a new profile or number | Urgent money for a hospital bill or emergency | Call them on a number you already have, or meet them, before paying |
| Digital arrest call | A fine, deposit or "verification" amount | No agency places anyone under digital arrest or takes money over a call |
| Commission to use your account | Nothing upfront: you receive money and pass it on | The RBI says the money mule becomes the target of police investigation. See RBI's draft mule rules |
Can someone hack my UPI with just my phone number?
Your number gives a stranger less than you might fear, but not nothing.
What the number does give them. On Google Pay, your mobile number can be your UPI number, so anyone who has it can pay you (Google Pay Help). That is what lets someone send you ₹1 and then call about a "mistake". With your number they can also call, text and try any trick above.
What it doesn't give them. UPI ties your account to your mobile number and your device, and each payment needs your UPI PIN as a second factor (PIB). Knowing your number gets a stranger neither of those.
Where the number does matter. A SIM swap (scam 8) moves your number, and your OTPs, to their SIM. Don't share identity details with anyone claiming to be from your operator, and act fast if your network goes dead. The RBI says banks, the RBI and other genuine entities never ask for your password, card details, CVV or OTP, so anyone asking is not one of them.
If your number sits on a lot of public lists, our guide to receiving files without sharing your phone number covers ways to hand it out less.
What to do if you lost money in a UPI scam
- Call 1930 or file at cybercrime.gov.in. These are the national cybercrime helpline and reporting portal set up by the Ministry of Home Affairs (PIB). Write down the acknowledgement number.
- Call your bank on the number from its official website. The RBI booklet says to block your card and also freeze debits in the linked account, then check that net banking and mobile banking are safe too.
- Complain to the bank, not only in the app. NPCI's UPI Help guideline tells payment apps to show a note that complaints about fraudulent transactions should go to your bank (NPCI).
- Report the call, SMS or WhatsApp on Chakshu. It is in the Sanchar Saathi portal; report within 30 days so it can be acted on. Chakshu itself sends anyone who has already lost money to 1930 or cybercrime.gov.in.
- Keep the evidence. Screenshots of the chat, the request or QR code, the UPI transaction ID and the caller's number.
- If a stranger's money is sitting in your account, don't move it. Tell your bank in writing and let it handle the reversal.
If your bank doesn't resolve the complaint, the RBI booklet points to its online complaint portal at cms.rbi.org.in.
Practise spotting UPI scams
Scam ya Nahi? is a free daily game from NO SUS: five practice messages a day, no account. The cards include UPI screens like collect requests, scanned QR codes and AutoPay requests, mixed with genuine payments, and Nox explains the tell after each answer. Better to meet a fake PIN screen there than on a real call.