Skip to content
Saved
Home › Guides › Fraud & UPI
Fraud & UPIहिंदी में पढ़ें

A suspicious UPI request: what to check before you tap

5 min readFacts valid until 2026-12-31
Woman in a sari and glasses looking carefully at her phone

Short answer: You never need to enter your UPI PIN to receive money. Your UPI PIN is the secret number that approves a payment. If someone asks for your PIN or OTP (the one-time code sent by SMS), or asks you to “approve” a request so they can pay you, stop. That’s how money leaves your account. Already lost money? Call 1930 or report at cybercrime.gov.in, and tell your bank straight away. Speed matters for getting money back.

Five common situations

  1. “I sent you money by mistake, please return it.” You get an SMS that looks like money has come in. Then someone calls and asks you to send it back. Check the balance in your bank app, not the SMS. Fake credit messages are easy to make. If money really did arrive by mistake, the sender can ask their own bank to recover it through the official complaint process. You don’t need to send anything to a stranger.

  2. “Approve this request to receive your refund, prize or cashback.” A request that asks for your UPI PIN takes money out of your account. Receiving money never needs your PIN. Since 1 October 2025, UPI has stopped ordinary person-to-person “collect” requests, where one person asks another to pay. So a request that reaches you now usually comes from a merchant ID, an account set up for a shop or business. Check the name carefully. Fraudsters register business names that look like real companies.

  3. “Scan this QR code to get your payment.” Scanning a QR code and entering your PIN is for paying, never for receiving. Selling something on a resale site? A “buyer” who sends you a QR code “to pay you” is almost always a fraud.

  4. “This is the police/CBI/customs. You’re under digital arrest.” Real police, CBI, ED, customs officers and judges don’t arrest people on video calls. They also don’t ask for money to “clear your name”. The government’s cybercrime coordination centre (I4C) warns about this scam. Hang up and report it to 1930.

  5. “Your account/KYC will be blocked today. Click this link or install this app.” KYC is the identity check your bank keeps on file. Banks don’t ask you to install screen-sharing or remote-access apps, which let someone else see or control your phone. Open your bank’s official app yourself, or call the number on the back of your card. Never use the number in the message.

A 10-second checklist before you tap “Pay”

  • Am I paying? If I’m meant to be receiving money, I shouldn’t be typing a PIN.
  • Do I know this person or business, and did I start this payment myself?
  • Does the UPI app show exactly the name I expect?
  • Is anyone rushing me or making me afraid?
  • Has anyone asked for my OTP, PIN, card details or a screen-share? If so, stop.

Got a suspicious call or message but lost no money? Report it on Sanchar Saathi → Chakshu at https://sancharsaathi.gov.in. These reports help get fraud numbers blocked.

If you’ve already paid or shared details

  1. Call 1930 (National Cyber Crime Helpline) or file at https://cybercrime.gov.in, as soon as you can. Quick reports give the best chance of freezing the money, so it can’t move on.
  2. Tell your bank through its official app, website or helpline. Ask them to block UPI or your card if needed, and write down the complaint number.
  3. Keep the evidence: screenshots, the transaction ID (UTR, the reference number of the payment), the fraudster’s number or UPI ID, and the time.
  4. Change your UPI PIN. If you shared any passwords, change those too.

Who bears the loss: what the rules say (check the dates)

  • For transactions up to 31 December 2026: RBI rules cover fraud caused by a breach (a security failure) somewhere else in the system, where neither you nor the bank was at fault. Report it within 3 working days and you shouldn’t have to bear the loss. Report later and you may have to bear part of it.
  • For transactions from 1 January 2027: new RBI rules give you 5 calendar days (weekends and holidays count) to report and still get this protection. The bank, not you, will have to prove what happened. The rules also add a one-time compensation for smaller frauds: if you lose up to ₹50,000, you may get back 85% of the loss or ₹25,000, whichever is less, once in your life. To qualify, report the fraud to 1930 or cybercrime.gov.in and to your bank within 5 calendar days. This applies to frauds from 1 January 2027.

If you shared your PIN or OTP yourself, you usually carry the loss until you report it. From 1 January 2027, the small-fraud compensation above may still help. That’s one more reason never to share them, and to report fast.

What to check today

  1. In your UPI app, look at your linked bank accounts and remove any you don’t use.
  2. Check your daily UPI limit in your bank app. A lower limit can reduce the damage from a fraud.
  3. Save 1930 in your phone contacts as “Cyber Fraud Helpline”.

Sources and review

Try it with your numbers
Fraud checklist
Open tool →

Educational information, not financial advice. Found an error? Tell us → · Corrections log

Frequently asked questions

Do I need to enter my UPI PIN to receive money?

No. You never need your UPI PIN to receive money. The PIN (your secret payment number) only approves money going out of your account. So if a caller says "enter your PIN to get your refund or prize", they are trying to take your money. Close the request and check your balance in your own bank app.

Someone says they sent me money by mistake. Should I send it back?

Don't send anything yet. Open your bank app and check the real balance, because fake credit SMS messages are easy to make. If money truly arrived by mistake, the sender can ask their own bank to recover it through the official complaint process. You don't have to return money to a stranger who calls you.

Can someone still send me a UPI collect request?

Since 1 October 2025, UPI has stopped ordinary person-to-person collect requests (where one person asks another to pay). Merchant collect requests still exist. So a request you get now usually comes from a merchant ID, an account set up for a business. Check the name with care, because fraudsters register names that look like real companies.

A buyer on a resale site sent me a QR code to pay me. Is it safe?

No. Scanning a QR code and entering your PIN is for paying, never for receiving. If you sell something online and a "buyer" sends a QR code "to pay you", it is almost always a fraud. Before you hand anything over, check your bank app to see if money has really arrived.

I paid a fraudster by UPI. Can I get my money back?

Sometimes, if you act fast. Call 1930 (National Cyber Crime Helpline) or report at cybercrime.gov.in straight away, because quick reports give the best chance of freezing the money. Then tell your bank through its official app or helpline. Keep screenshots and the UTR (the payment reference number). Recovery isn't guaranteed, but speed helps most.

Will my bank refund money lost in a UPI fraud?

It depends on who was at fault and when you report. For transactions up to 31 December 2026, report within 3 working days if the fault was elsewhere in the system. From 1 January 2027, you get 5 calendar days, and a one-time compensation may return up to ₹25,000 on small frauds. If you shared your PIN or OTP, you usually carry the loss until you report it.