Almost every UPI fraud in India works by getting you to approve something. Nothing is broken into. Your UPI PIN sends money out. It never brings money in. So a screen asking you to enter your PIN to accept a refund is a payment dressed up as a credit. Treat the PIN as a signature on a cheque going out, and most of the risk closes.
| Times your UPI PIN is needed to receive money | Never |
|---|---|
| What it means | A PIN entry always authorises a debit from your account, whatever the screen says |
| Report fraud on | 1930 — Or cybercrime.gov.in |
| Tell your bank | Same day, in writing — Liability under RBI rules turns on reporting delay |
| Daily UPI limit | Set your own — Lower it in the app; caps the worst case |
as of 2026-08-15 · NPCI UPI product documentation · verified
What to know
The collect request is the most exploited feature on UPI. A fraudster asks to collect money from you. The caption says refund, cashback, prize, or rent coming in. You approve it, you enter your PIN, and you are debited. NPCI and the apps have narrowed this over the years. The trick survives because the screen really is ambiguous. One rule beats every version of it. If you did not start a payment to someone you meant to pay, there is nothing to approve. Reject it. If someone genuinely owes you money, ask them to send it. Receiving needs nothing from you but your UPI ID.
The second pattern is the QR code. People read a QR as an address. It is an instruction. A QR cannot pull money on its own. But scan one, finish with your PIN, and money leaves. So scan this QR to get your refund is the collect-request trick wearing a different face. It runs hard on classifieds and marketplace listings. The story is usually a company account or an army posting, which explains why the buyer cannot meet you — the same manufactured authority that drives the digital arrest scam. A buyer who insists you scan something to be paid is not a buyer.
Reporting speed is not a formality. It decides who carries the loss. The RBI customer-protection framework sets a graded liability. Report an unauthorised electronic transaction promptly and you generally bear nothing, where the failure was not yours. Liability rises the longer you wait. That cover is strongest for payments you never authorised. It is weaker where you were tricked into approving one yourself, which is what most UPI fraud is. The steps are the same either way, and they are timed. Call 1930. File at cybercrime.gov.in. Then tell your bank in writing and keep the dated acknowledgement. Lower your UPI limit in the app today. It costs nothing and it caps a bad afternoon. If you think your identity, and not just your money, was used, also check your credit report and raise a dispute.
Frequently asked questions
Can someone take money from my account just by knowing my UPI ID?
No. A UPI ID on its own is like an email address. It lets someone send you money, or send you a request. Money leaves your account only when you approve it with your UPI PIN, on your own device. The risk is not that someone knows your ID. It is being talked into approving something.
Do I need to enter my UPI PIN to receive money?
Never. Entering the PIN always authorises a debit. Say a screen asks for your PIN while telling you a refund is coming in. That is a collect request or a payment flow. Finishing it sends money out of your account. Cancel it.
What should I do immediately after a UPI fraud?
Call 1930 and file at cybercrime.gov.in straight away. Then tell your bank in writing the same day, and keep the acknowledgement. Under the RBI framework your liability turns on how fast you report. Note the UPI reference number, the payee ID and the exact time. If the money went out on a card or a loan account rather than UPI, your borrower rights set out what the lender owes you. Take screenshots before anything is deleted.
Sources
- National Payments Corporation of India — UPI product overview and safety guidance (primary source)
- Reserve Bank of India — Customer Protection — Limiting Liability of Customers in Unauthorised Electronic Banking Transactions (primary source)
- Indian Cyber Crime Coordination Centre (I4C), Ministry of Home Affairs — National Cyber Crime Reporting Portal and helpline 1930 (primary source)
Related reading
Best Budgeting Apps in India
The one rule that separates a safe budgeting app from a dangerous one: how it reads your bank data.
6 Sep 2026 · 4 min
Building an Emergency Fund
How many months of expenses to hold, where to park the money, and why the ₹5 lakh deposit insurance limit shapes the plan.
7 Sep 2026 · 5 min
Claiming a Deceased Relative’s Assets
The document trail for banks, demat accounts and insurers, and why a nominee is not an heir.
7 Sep 2026 · 5 min