UPI safety: how to avoid fraud
OTP, PIN, collect requests and QR scams — the rules that keep money safe.
Save or print these rules — check them before any payment you are unsure about.
Why it works this way
- Your PIN and OTP are the only keys to your account — sharing them hands over the keys.
- Collect-request fraud works because people expect “accept” to mean “receive”.
- Checking the on-screen name defeats fake identities and fake shop names.
Common mistakes
- Sharing an OTP “for verification” — there is no such verification.
- Paying ₹1 “to check” a stranger's link — the link itself is the trap.
- Ignoring a wrong debit for days — early reporting matters for recovery.
I already shared my OTP. What now? Change your UPI PIN at once, check your recent transactions, inform your bank immediately, and report the fraud. Do not wait to see whether money goes missing.
Safe habits for daily UPI use
Lock your phone with a PIN or fingerprint, and lock your UPI app separately if it offers that option. Never write your UPI PIN in notes, photos or chats — if anyone sees your phone unlocked, the PIN is the only thing standing between them and your money. Check your transaction history once a week, so a wrong debit is caught early, not at month-end.
Keep daily spends in one primary account and larger savings elsewhere, so a single mistake cannot empty everything. Download UPI apps only from the official Play Store or App Store, and beware of "customer care" numbers from search results — use the number inside the app or on your bank's official website instead.
Sources & checks
These are the standard safety rules given by banks and the national payments system: your bank never asks for your OTP or PIN, and no genuine refund, prize or job offer ever needs you to send money first. If you are unsure about any payment, stop and ask your bank before proceeding. This guide is education, not financial advice.
If money went to the wrong person
Act at once: inform your bank and raise a complaint against that transaction inside your UPI app, keeping the transaction ID (UTR) safe. If you know the receiver, contact them and ask for the money back — many wrong transfers are returned this way. If you do not know them, only the bank can contact them, and recovery is not guaranteed.
Never pay a "fee" or "charge" to anyone who promises to reverse the payment — that is a second fraud built on the first. Genuine reversals go through the bank, and they never ask for money to process one.
Related guides
What EMI really means, and how total interest is calculated.
Post office RD and TD, in plain wordsHow recurring and time deposits work, and what to check first.
Track an India Post articleFind your 13-character number, check it, then track officially.