UPI made paying anyone as easy as a few taps — and it handed scammers a brand-new playground. Most people who lose money aren't careless; they're just caught by a trick they hadn't seen before. This guide keeps it plain: the one rule that stops most fraud, the common tricks, and what to do if you've already been hit.
The one rule that stops most UPI fraud
Remember this and you avoid the majority of scams: you never enter your UPI PIN to receive money. Your PIN is only for sending. If anyone — a buyer, a “refund” agent, a lottery caller — asks you to enter your PIN or scan a QR code to get money, it is a scam. Full stop.
No real payment ever needs your UPI PIN to be received. The moment someone asks you to enter a PIN “to get money,” the conversation is over.
How the common tricks actually work
Scammers rely on urgency and trust. They rush you (“your account will be blocked in 10 minutes”), or they pose as someone safe (bank, customer care, a genuine-looking buyer). Once you feel hurried or reassured, you stop checking. Slowing down is your best defence.
Common scams and what to do
| Scam | How it looks | What to do |
|---|---|---|
| Fake “collect” request | A payment request pops up claiming you'll receive money if you approve | Never approve a request to get money. Decline it. |
| QR code to “receive” | Buyer sends a QR and says scan it to get paid | Scanning a QR only sends money. Don't scan. |
| Fake customer care | A number found on Google “helps” you and asks for OTP or PIN | Use only the number on your bank's official app or card. Never share OTP/PIN. |
| KYC / account-expiry link | SMS with a link to “update KYC or your account is blocked” | Banks don't verify KYC via random links. Don't click; go to the official app. |
| Screen-sharing app | Caller asks you to install AnyDesk / TeamViewer to “fix” something | Never install remote-control apps for a stranger. Hang up. |
If you've already lost money, act fast: call the national cyber-crime helpline 1930 and file a report at cybercrime.gov.in. The sooner you report, the better the chance of freezing the transfer.
Your stay-safe checklist
- Never enter your UPI PIN to receive money — only to send it.
- Never share OTP, PIN or card details with anyone who calls you, even if they claim to be your bank.
- Don't click payment or KYC links from SMS or WhatsApp. Open your bank's official app instead.
- Don't install screen-sharing apps on a stranger's instruction.
- Slow down when rushed. Urgency is the scammer's main tool.
Where a short cyber-security course helps
Knowing the tricks protects you today; understanding why they work protects you for life. Our short Fundamentals of Cyber Security (FCS) course is a 6-week introduction to threats, safe practices and the basics of protecting systems — useful whether you just want to stay safe or want a first step towards a security career. Curious about free tools alongside it? See our guide to free AI tools for students.
Frequently asked questions
Can I lose money just by receiving a UPI payment?
No. Receiving money never needs your UPI PIN. If a screen asks you to enter your PIN or scan a QR code to receive money, it is a scam attempt to make you send money instead.
What should I do immediately if I've been scammed?
Call the national cyber-crime helpline 1930 right away and file a complaint at cybercrime.gov.in. Also inform your bank. Reporting quickly gives the best chance of freezing the transferred money.
Is it safe to call customer-care numbers I find on Google?
Be very careful. Scammers plant fake customer-care numbers online. Use only the number printed on your card or shown inside your bank's official app, and never share an OTP or PIN.
How long is the FCS course and what does it cost?
Fundamentals of Cyber Security (FCS) is 6 weeks and costs Rs 5,900, or Rs 5,310 as a one-time lumpsum, at Hartron Hisar.