Every UPI payment from your bank account ends the same way: a keypad appears and you type four or six digits. That number is your UPI PIN, and it's the single thing that stands between your bank balance and anyone who gets hold of your phone or your UPI ID.
Most people set it once and forget about it until something goes wrong: a payment fails with "incorrect UPI PIN", a bank blocks UPI after too many attempts, or a caller insists you need to enter it to receive a refund. This guide explains what the PIN is and how it works, so those moments make sense. If you need to change or reset it, our step-by-step guide to changing or resetting your UPI PIN has the details.
What a UPI PIN is
NPCI describes the UPI PIN (UPI Personal Identification Number) as a 4- to 6-digit passcode you create when you first register for UPI, and which you enter to authorise all bank transactions through UPI. It belongs to your bank account, not to the app: if you've already set a UPI PIN for an account in one UPI app, the same PIN works for that account in any other UPI app.
If you link two bank accounts, each has its own UPI PIN. And the UPI PIN is separate from any mobile banking PIN (MPIN) your bank issued for its own app; NPCI's guidance is to set a UPI PIN specifically for UPI.
Who checks your UPI PIN
Not your UPI app. NPCI's rules split the work. Your app and its bank (the payment service provider) are responsible for the first factor: binding UPI to your phone and SIM, and securing the app. Your own bank, which holds your account, is responsible for verifying the UPI PIN itself.
The PIN is entered through UPI's secure common library and sent in encrypted form, so the app can't read it. NPCI's own BHIM app states that it doesn't store or read your UPI PIN, and that your bank's customer support will never ask for it. That's the practical point: there's no legitimate reason for any person to need your UPI PIN.
When you need it, and when you don't
The PIN is for money leaving your account. Some features are designed to skip it for small or pre-approved payments:
| Situation | UPI PIN needed? | Why |
|---|---|---|
| Paying a person or a shop | Yes | Every regular UPI payment from your bank account needs it |
| Receiving money | Never | Nothing leaves your account. A request for your PIN to receive money is a scam |
| Paying from UPI Lite | No, up to ₹1,000 per payment | You approved the Lite top-up with your PIN instead |
| Recurring UPI AutoPay debits | Not for debits up to ₹15,000 (₹1 lakh in some categories) | You approved the mandate with your PIN when you set it up |
| Paying by fingerprint or face, where your bank offers it | No, up to ₹5,000 for now | On-device biometrics replace the PIN for that payment |
| Setting up AutoPay, adding money to UPI Lite | Yes | These approve future payments |
Our guides to UPI Lite and UPI AutoPay explain those two features and their limits.
UPI PIN, ATM PIN, MPIN and OTP: not the same thing
These four codes are often confused, and scammers rely on that confusion:
| Code | What it's for | Who sets it | Share it? |
|---|---|---|---|
| UPI PIN | Approving UPI payments from a bank account | You, during UPI registration | Never |
| ATM or debit card PIN | Cash withdrawals and card payments at machines | You, with your bank | Never |
| MPIN | Logging into or approving actions in your bank's own mobile app | You, with your bank | Never |
| OTP | A one-time code that confirms a specific action, such as setting a UPI PIN | Your bank sends it | Never |
Your debit card details and an OTP are used to set or reset your UPI PIN, which is why fraudsters ask for them. That's exactly why fraudsters ask for them: they're the keys to creating a new PIN. Keep all four to yourself.
How a UPI PIN is set
You set your UPI PIN when you first link a bank account to a UPI app, and you'll set it again if you forget it. NPCI's rules list the ways your identity can be checked for this:
- Your debit card details (last digits and expiry date) plus an OTP from your bank.
- An Aadhaar OTP, if your bank account is linked to Aadhaar.
- Aadhaar face authentication through UIDAI, introduced by NPCI in October 2025 as an additional option.
Which options you see depends on your bank and app. The full steps, including what to do without a debit card, are in our UPI PIN reset guide.
Common UPI PIN problems
Most PIN errors fall into a handful of cases:
| What you see | What it means | What to do |
|---|---|---|
| Incorrect UPI PIN | The PIN you entered doesn't match; the payment fails and nothing is debited | Re-enter carefully. Check you're using the PIN for this bank account, not another account's or your ATM PIN |
| UPI PIN tries exceeded, or UPI blocked | After several wrong attempts, your bank may temporarily block sending money by UPI; how many attempts and for how long varies by bank | Wait for the block period your bank states, or reset your PIN. Don't keep guessing |
| UPI PIN not set | You linked the account but never created a PIN, or re-registered on a new phone | Set the PIN from the bank account section of your app |
| Fingerprint or face payments stopped working | Your bank switches off biometric payments in every app whenever the UPI PIN is changed or reset | Turn biometric payments back on in your app and give consent again |
| Asked for your PIN to receive money | A scam | Don't enter it. Report the number to your bank and the 1930 helpline |
If a payment failed for a reason other than the PIN, such as a limit or a bank that didn't respond, our guide to why UPI transactions fail goes through the other causes.
Paying with your fingerprint or face instead
Since NPCI's October 2025 circular on additional authentication methods, banks can let you approve UPI payments with your phone's own biometrics (fingerprint or face unlock) in place of the UPI PIN. It's optional, and the PIN keeps working.
- It's available initially for payments up to ₹5,000; NPCI has said it will review the limit.
- Your app needs your explicit consent to turn it on, and again after every new device binding or change to the fingerprints or faces stored on your phone.
- It isn't offered on rooted or jailbroken phones.
- Your bank must notify you whenever it's turned on or off.
- If you don't use it for 90 days, the app makes it inactive until you confirm with your UPI PIN.
Keeping your UPI PIN safe
A strong habit beats any security feature:
- Never tell anyone your UPI PIN, including people who say they're from your bank, NPCI or an app's support team.
- Don't enter your PIN on any screen that promises you'll receive money.
- Avoid obvious PINs such as your birth year or 1234, and don't reuse your ATM PIN.
- Cover the keypad in public, and lock your phone and your UPI app.
- If you think someone knows your PIN, change it straight away, and ask your bank to block UPI if money has gone. NPCI's rules require banks to let you block UPI on request.
Our guide to UPI fraud explains the scams built around getting your PIN, and what to do in the first hour if one works.
Frequently asked questions
Is the UPI PIN 4 or 6 digits?
Either. NPCI describes the UPI PIN as a 4- to 6-digit code; which length you set depends on your bank.
Is my UPI PIN the same in all UPI apps?
Yes, for the same bank account. The PIN belongs to the account and is verified by your bank, so changing it in one app changes it everywhere.
Is UPI PIN the same as ATM PIN?
No. They're separate codes. You can choose the same digits, but it's safer not to, and your bank verifies each one separately.
What happens if I enter the wrong UPI PIN?
The payment fails and nothing is debited. If you enter a wrong PIN several times, your bank may temporarily block UPI payments from your account; the number of attempts and the block period vary by bank.
Do I need my UPI PIN to receive money?
Never. Receiving money needs nothing from you. Anyone asking you to enter your PIN to receive money is trying to take it.
Official sources
- NPCI — UPI FAQsUPI PIN as a 4–6 digit passcode authorising all bank transactions; same PIN across UPI apps; different from bank MPIN; BHIM does not store or read the PIN; wrong PIN fails the transaction and repeated wrong PINs may lead the bank to block UPI temporarily (varies by bank).
- NPCI — UPI Consolidated Circular, Version 1.0, NPCI/UPI/CC/01 (18 Sep 2026)UPI PIN setup methods (3.3); payer PSP responsible for the first factor and device binding, remitter bank for UPI PIN authentication (3.4–3.5); biometric authentication rules (9.1–9.8); blocking UPI on request (10.2).
- NPCI — Introduction of Additional Authentication methods in UPI, NPCI/UPI/OC-226/2025-26 (7 Oct 2025)UIDAI face authentication for UPI PIN set and reset; on-device biometric authentication in place of the UPI PIN, initially up to ₹5,000; consent, notifications, disabling on PIN change, 90-day inactivity.
- RBI — Digital Payments – E-mandate Framework, 2026 (21 Apr 2026)Recurring debits without fresh authentication up to ₹15,000, or ₹1 lakh in set categories.
- RBI — Framework for Facilitating Small Value Digital Payments in Offline Mode (updated 4 Dec 2024)UPI Lite payments up to ₹1,000 without AFA.
Last reviewed . Examples, amounts and screens marked illustrative are not LILPE figures.
