UPI itself is hard to break into. Every payment from your bank account needs your UPI PIN, which lives with you, not on a server somewhere a fraudster can reach. So almost every UPI fraud works the other way round: instead of breaking the lock, the fraudster persuades you to open it. A fake refund, an urgent call from "your bank", a buyer who wants to pay you by QR code. The goal is always the same: get you to enter your PIN, or hand over something that lets them do it.
That's good news, in a way. If you know how the persuasion works, most of it is easy to spot. This guide covers the common patterns, the safeguards built into UPI, the steps to take straight away if money has gone, and the rules that decide whether it comes back.
The one rule that stops most UPI scams
You never need your UPI PIN to receive money. Not for a refund, not for a prize, not for a buyer paying you for something you're selling, not to "verify" your account. Your PIN is only ever for sending money out of your account.
Hold on to that, and the most common scams fall apart. Any screen, call or message that asks for your PIN in order to receive something is a payment from you in disguise.
Common UPI scams and how to spot them
The details change constantly. The patterns don't.
| Scam | How it works | The warning sign |
|---|---|---|
| The "refund" or "prize" request | You're told money is waiting for you and sent a request or link to accept it | Anything that needs your PIN to receive money |
| The QR code to receive | A buyer or caller sends a QR code and says scanning it will pay you | Scanning a QR code is always for paying, never for receiving |
| Fake customer support | You search for a helpline, call a fake number, and are asked to install a screen-sharing or remote access app | Any support agent who wants to see or control your screen, or asks for your PIN or OTP |
| "Sent by mistake, please return" | A fake SMS says money was credited to you, followed by a request to send it back | The credit isn't in your bank statement or app, only in a message |
| Account block or KYC threat | A message says your account or UPI will be blocked unless you click a link or call now | Urgency, a link, and a request for details or a payment |
| Lookalike payee | A UPI ID or QR code that resembles a real business, but pays someone else | The name your app shows before you pay doesn't match who you meant to pay |
| Task, job or investment offers | Small early "earnings" are paid to build trust, then you're asked to pay in larger sums | Being asked to pay money to earn money |
Selling online? You're a target too
People selling second-hand goods online meet a specific version of these scams. The "buyer" agrees at once, often without haggling, then sends a payment request, a QR code or a link so that you can "receive" the money, often with a reason why they can't meet or pay the usual way. The rule is the same: to be paid, you share your UPI ID or show your own QR code, and the buyer pays. You never scan, approve or enter a PIN.
Safeguards already built into UPI
NPCI's rules for UPI apps include several protections against exactly these tricks. Knowing they exist helps you notice when something is off.
- Requests to collect money from one person to another aren't allowed on UPI any more. A request that asks you to approve a payment to an individual is not a normal part of UPI.
- Before you approve a payment, your app must show the payee's details, including the name held by their bank, or a verified merchant's validated brand name. A name typed into a QR code or saved in your contacts doesn't override it. Read the name every time.
- When you pay to a UPI number, apps make you type it twice unless you pick it from saved contacts or beneficiaries.
- Apps mask mobile numbers and UPI IDs that contain them, showing only the last four digits.
- UPI Lite, which allows small payments without a PIN, isn't offered on rooted or jailbroken phones, and its balance is capped, which limits what an unlocked phone exposes. Our UPI Lite guide explains how to keep that balance small.
If you're not sure what's safe to share, our guide to what a UPI ID is explains the difference between your UPI ID, which you can share freely, and your PIN, which you never share.
If money has gone: the first hour
Speed decides a lot of what happens next, both whether the money can be stopped on its way out and how RBI's liability rules treat you. Do these in order:
- Stop further loss. Block UPI or your debit card through your bank's app or its official customer care number (from your bank's own website, app or passbook, never from a search result). If your UPI app or bank offers the new UPI Safety Switch under NPCI's MyUPI service, you can use it to ask for UPI debits from your account to be declined.
- Report the fraud on the national cyber fraud helpline 1930, or at cybercrime.gov.in. Note the acknowledgement number.
- Report it to your bank in writing as an unauthorised transaction: in the app, by email to its official address, or at the branch. Keep the complaint reference and the date and time you reported it.
- If you installed any app at the fraudster's request, uninstall it, and change your UPI PIN from a phone you trust. Our guide to changing or resetting your UPI PIN has the steps.
- Write down everything while you remember it: the UPI reference numbers, amounts, times, the numbers or IDs that contacted you, and screenshots of messages.
Don't pay anyone who offers to "recover" your money for a fee. Recovery scams target people who have just lost money.
Will you get the money back? RBI's liability rules
For unauthorised electronic transactions, RBI's customer-protection rules decide how much of the loss you bear. They depend on who was at fault and how quickly you reported it.
| Situation | Your liability |
|---|---|
| The bank was at fault (fraud, negligence or a deficiency on its side), whether or not you reported it | Zero |
| A breach elsewhere in the system, neither you nor the bank at fault, reported within 3 working days | Zero |
| The same, reported within 4 to 7 working days | The transaction value or a cap, whichever is lower: ₹5,000 for basic savings bank deposit accounts, ₹10,000 for most other savings accounts, ₹25,000 for other current accounts and higher-limit credit cards |
| Reported after more than 7 working days | As decided by your bank's board-approved policy |
| You shared your PIN, OTP or other payment credentials | The full loss until you report it; anything after that is the bank's |
Working days are counted by your home branch's schedule, excluding the day you received the bank's message about the transaction. Once you report, the bank must credit the disputed amount to your account (a shadow reversal) within 10 working days while it investigates, and resolve your complaint within 90 days.
Separately, RBI's 2025 authentication directions say that if a loss arises from a transaction processed without following those directions, the issuer must compensate the customer in full. And between banks, NPCI now gives the recipient's bank 15 calendar days to respond to a fraud chargeback, after which an unanswered one is deemed accepted. Our guide to UPI disputes and chargebacks explains how that process works.
If your bank says no
If the bank rejects your claim, doesn't reply within 30 days, or you disagree with its answer, you can take it to the RBI Ombudsman under the Integrated Ombudsman Scheme, 2026, within 90 days. File online at cms.rbi.org.in. Include your bank complaint reference, the 1930 or cybercrime.gov.in acknowledgement and the transaction details.
Habits that keep you safe
A handful of habits cover nearly every scam above:
- Read the payee name on the confirmation screen before entering your PIN, every time.
- Treat urgency as a warning sign. Banks don't block accounts over a phone call.
- Get helpline numbers only from your bank's own app, website, card or passbook.
- Never install an app because a caller asked you to.
- Use a screen lock, and an app lock on your UPI app if it offers one.
- Check your active UPI AutoPay mandates every few months, and revoke the ones you don't recognise.
- If a payment failed but money was debited, that's not fraud: wait for the automatic reversal. Our guide to money debited but transaction failed has RBI's deadlines.
For shops and businesses
Merchants face their own versions. The commonest at a counter is the fake payment screenshot: a customer shows a "successful" screen that was edited, or is an old payment. The defence is simple: accept only what your own soundbox, merchant app or bank shows, never a customer's phone. Our guide to QR codes and soundboxes for shops covers setting that up.
- Train staff that a customer's screen is not proof of payment.
- Don't send "refunds" to customers who say they overpaid until the overpayment shows in your own records.
- Be wary of calls claiming to be from your payment provider asking you to change settlement bank details or install software. Verify through your provider's official channels.
- Use maker-checker approval for changing payout or settlement bank details.
Frequently asked questions
Do I need to enter my UPI PIN to receive money?
No, never. Your UPI PIN is only for paying. Any request, link, QR code or caller that needs your PIN for you to receive money is a scam.
Where do I report UPI fraud?
Report it to your bank immediately as an unauthorised transaction, and on the national cyber fraud helpline 1930 or at cybercrime.gov.in. Keep the complaint and acknowledgement numbers.
Will my bank refund money lost to UPI fraud?
It depends on who was at fault and how quickly you reported it. Under RBI's rules you have zero liability if the bank was at fault, or if a breach elsewhere was reported within three working days. If you shared your PIN or OTP, you bear the loss until you report it. The bank must give a shadow credit within 10 working days of your report while it investigates.
Can someone take money from my account with just my UPI ID?
No. A UPI ID lets people send you money. Taking money out of your account needs your UPI PIN, except for small payments from a UPI Lite balance on your own phone.
Is scanning a QR code safe?
Scanning a QR code is how you pay someone. It's safe when you mean to pay that person or shop and the name your app shows matches. Never scan a code to receive money.
Official sources
- RBI — Customer Protection: limiting liability in unauthorised electronic banking transactions (6 Jul 2017)Zero and limited liability by fault and reporting time; caps of ₹5,000, ₹10,000 and ₹25,000; beyond seven working days per board policy; negligence; shadow credit within 10 working days; resolution within 90 days; working-day counting.
- RBI — Authentication mechanisms for digital payment transactions Directions, 2025Issuer compensates the customer in full for losses from transactions processed without complying with the directions.
- NPCI — UPI Consolidated Circular, Version 1.0, NPCI/UPI/CC/01 (18 Sep 2026)Payee details and bank-registered or verified names shown before paying (2.6, 2.13–2.15); no P2P collect (2.16); masking (4.7); UPI number dual entry (5.3); UPI Lite not on rooted devices (18.6).
- NPCI — MyUPI, AI-powered support for UPI payments (UPI HELP 2.0), NPCI/UPI/OC-227A/2026-27 (10 Sep 2026)UPI Safety Switch: decline of UPI debits on request, reasonable-efforts basis, resumption through the bank.
- NPCI — Revision of TAT for responding to Fraud and Wrong Credit chargebacks in URCS, NPCI/UPI/OC No. 235/2026-27 (16 Jul 2026)15 calendar days for beneficiary banks from 1 August 2026; deemed accepted if no response.
- RBI — Reserve Bank – Integrated Ombudsman Scheme, 2026: FAQs30-day and 90-day rules; cms.rbi.org.in.
- Ministry of Home Affairs — National Cyber Crime Reporting PortalHelpline 1930 for financial cyber fraud.
Last reviewed . Examples, amounts and screens marked illustrative are not LILPE figures.
