Emerging Scams · India
UPI Scams in India
UPI made payments instant — and gave scammers a fast new rail. Here are the tricks they use, the one rule that stops most of them, and what to do if you’re hit.
Updated Aug 2026 · 7 min read
You list something for sale online. A keen buyer agrees to pay by UPI, sends a request, and tells you: “just enter your PIN to receive the money.” It feels normal — so you do it. And instead of receiving, you’ve just paid them.
That confusion between sending and receiving is at the heart of most UPI fraud. It’s a big business: the government reported ₹805 crore lost across 10.64 lakh UPI-fraud cases so far this financial year, while banks and the NPCI put the figure even higher — over ₹1,750 crore, up about 31% on the year.
The one rule that stops most UPI scams
You never enter your UPI PIN to receive money. A PIN is only ever needed to send it.
Receiving money — including refunds — is automatic and needs no PIN, no QR scan, and no approval. So if anyone asks you to enter your PIN, scan a QR, or approve a request “to receive,” they are trying to pull money out of your account.
The common UPI scams
The fake “collect request”
You’re “selling” something (OLX, Facebook Marketplace) or expecting a refund. The “buyer” sends a UPI request and says “enter your PIN to receive.” A request is a pull — approving it sends money FROM you. (India has been phasing out person-to-person collect requests since October 2025, but variations persist through merchant requests and apps.)
The QR “scan to receive”
They ask you to scan a QR code to get your money. Scanning a QR only ever makes a payment — it never receives one. Scammers also paste a fake QR sticker over a shop’s real one to divert your payment.
The fake payment screenshot
A “buyer” shows a screenshot proving they paid, and pressures you to hand over the item or cash. The screenshot is edited; no money ever arrived. Always check your own bank/app, never trust a screenshot.
The “KYC / PIN expiry” call
A caller says your UPI, bank KYC, or account is about to be blocked, and walks you into installing a “verification” app — often a screen-sharing app like AnyDesk that lets them watch you type your PIN.
Bank-impersonation SMS & links
A text that looks like it’s from your bank, with a short link to “update KYC” or “claim a refund.” The link leads to a fake page that steals your login, card, or OTP.
The refund / “sent by mistake” trick
Someone sends a message (sometimes with a small real transfer) claiming they paid you by accident, and presses you to “return” it — often to a different account, turning you into a money mule.
Got a suspicious “bank” link or QR?
Paste the link into our checker before you tap it. It flags fake bank pages, typo-squats, and hidden destinations — the tricks behind UPI phishing SMS.
Open the QR & link checker →Five rules that keep you safe
- 1
Never enter your UPI PIN to receive money — a PIN is only ever needed to SEND. Incoming money and refunds are automatic.
- 2
Never share your UPI PIN, OTP, card number, or CVV. No bank, NPCI, or genuine company will ever ask for them.
- 3
Never install a screen-sharing or remote-access app (AnyDesk, TeamViewer) because a “support” caller told you to.
- 4
Scan a QR only to PAY, never to receive. To get money, you just share your UPI ID or phone number.
- 5
Before paying, check the recipient’s name in your UPI app — and never trust a payment screenshot; verify in your own bank app.
Where to report — wherever you are
In India, call 1930 and tell your bank and UPI app immediately to block further transactions — reporting within hours gives the best chance of freezing the money. Reporting fast gives the best chance of freezing the money before it’s gone. Then file with your national authority:
India — Helpline 1930 · cybercrime.gov.in
Report in the first hours (the “golden hour”) to freeze funds. Run by I4C, Ministry of Home Affairs.
United States — FTC · FBI IC3
reportfraud.ftc.gov and ic3.gov.
United Kingdom — Action Fraud
actionfraud.police.uk · 0300 123 2040 (in Scotland, call Police Scotland on 101).
Australia — Scamwatch (National Anti-Scam Centre)
scamwatch.gov.au.
Canada — Canadian Anti-Fraud Centre
antifraudcentre-centreantifraude.ca · 1-888-495-8501.
Anywhere else: contact your bank and local police right away, and search “report a scam” plus your country. For cross-border cases, econsumer.gov collects international complaints. Beware anyone who later offers to “recover” your money for an upfront fee — that is a second scam.
Frequently asked questions
Do I ever need to enter my PIN to receive money?
No — never. Incoming payments and refunds credit automatically with zero action from you. If anyone asks you to enter your UPI PIN, approve a request, or scan a QR “to receive,” it is a scam designed to take money out of your account.
A buyer paid me but asks me to approve a request to “confirm” — is that safe?
No. That’s a collect request, and approving it with your PIN sends money FROM you, not to you. Decline it. To receive, you do nothing but share your UPI ID.
Is scanning a QR code to receive money safe?
No. Scanning a QR only ever initiates a payment. To receive money, you never scan anything — you simply give your UPI ID or number.
I’ve been scammed on UPI — what do I do first?
Call 1930 immediately (the sooner, the better chance of freezing the money), tell your bank and UPI app to block further transactions, and file a complaint at cybercrime.gov.in.
Also common in India: the “digital arrest” scam and fake QR codes. Browse all our scam guides.
Sources: Ministry of Finance data tabled in Parliament; NPCI and Reserve Bank of India safety guidance; Indian Cyber Crime Coordination Centre (I4C); 2025–2026 reporting. Figures are drawn from public reporting and should be verified against primary sources.