UPI Fraud: How to Avoid & Report

The collect request is the single most exploited feature. A fraudster sends a request to *collect* money from you, captioned as a refund, a cashback, a prize or a rent payment coming in. Approving it and entering your PIN debits you. NPCI and the apps have narrowed this over time, but the pattern persists because it exploits a genuine ambiguity in what the screen appears to say. The rule that survives every variant: if you did not initiate a payment to a person you intend to pay, there is nothing to approve. Reject, and if a real payer owes you money, ask them to send it — receiving requires no action from you beyond sharing your UPI ID.

The second pattern is the QR code, which people read as an address when it is really an instruction. A QR code cannot pull money on its own, but scanning one and then completing the flow with your PIN sends money. So "scan this QR to receive your refund" is the same trick as the collect request with a different interface. This is heavily used on classifieds and marketplace listings, often with a plausible story about a company account or an army posting that explains why the buyer cannot meet. A buyer who insists you scan anything to be paid is not a buyer.

Reporting speed is not a formality — it is the variable that decides who bears the loss. The RBI customer-protection framework sets a graded liability: report an unauthorised electronic transaction promptly and the customer generally bears nothing where the failure was not theirs, with liability rising the longer the delay runs. That protection is strongest for transactions you never authorised, and weaker where you were deceived into authorising the payment yourself, which is what most UPI fraud actually is. Either way the sequence is the same and it is time-critical: 1930, then cybercrime.gov.in, then your bank in writing with a dated acknowledgement. Lower your UPI transaction limit in the app today; it costs you nothing and it caps the size of a bad afternoon.