India processes over 14 billion UPI transactions every month. That scale attracts fraudsters running fake payment requests, phishing links and social-engineering calls pretending to be bank officials. The good news: most digital banking fraud succeeds because of user action — clicking a link, sharing an OTP, or approving a collect request — not because banks' core systems were hacked. This guide gives you 15 concrete habits that dramatically reduce your risk.
OTP and PIN safety
- Never share OTPs — OTPs authorise transactions. Sharing one is equivalent to handing over cash.
- Read the OTP SMS carefully — it states the purpose ("for UPI payment of ₹5,000 to Merchant X"). If the amount or payee is wrong, do not enter it.
- Use different PINs — your UPI PIN, ATM PIN and phone lock should not be the same. Avoid birthdays and sequential numbers.
- Enable biometric lock on UPI apps so a stolen unlocked phone cannot initiate payments.
UPI-specific precautions
- Decline unknown collect requests — a "collect" request pulls money from you. Scammers send ₹1 requests hoping you'll approve without reading.
- Verify before scanning QR codes — stickers at shops can be replaced with fraudster QR codes. Confirm the merchant name shown in your app before paying.
- Don't search random UPI IDs online — use official merchant handles or pay at verified POS terminals.
- Set a daily UPI limit in your banking app — most apps let you cap per-transaction and daily amounts.
Read our full UPI beginner's guide for setup instructions and transaction limits.
Net banking and email hygiene
- Type your bank URL manually — bookmark https://www.yourbank.com. Never click bank links in emails or SMS.
- Check for HTTPS and the padlock before entering credentials. Phishing sites mimic login pages closely.
- Use a dedicated email for banking — reduces exposure if a shopping-site account is breached.
- Turn on transaction alerts — SMS and push notifications for every debit let you spot fraud within minutes.
Device and account hygiene
- Update banking apps promptly — updates patch security vulnerabilities.
- Deregister old phone numbers from UPI when you change SIMs. A recycled number linked to your UPI ID is a known fraud vector.
- What to do if compromised — immediately call your bank's 24/7 helpline, block net banking and UPI, file a complaint at cybercrime.gov.in, and lodge an FIR for large losses.
Red flags to watch for
| Scam type | How it works | Your response |
|---|---|---|
| KYC expiry call | Caller claims account will freeze; asks for OTP to "verify" | Hang up. KYC updates happen at branch or official app only. |
| Refund fraud | "You overpaid — share OTP to receive refund" | Refunds don't require OTP. Decline and contact merchant directly. |
| Fake job offer | Asks for "processing fee" via UPI before interview | Legitimate employers never charge upfront fees. |
| Screen-sharing apps | Asks you to install AnyDesk/TeamViewer for "bank verification" | Never install remote-access apps for banking. |
FAQ
Can the bank reverse a UPI fraud transaction?
If you authorised the payment (entered PIN/OTP), reversal is difficult and depends on the receiving bank freezing funds in time. Report within minutes for the best chance.
Is UPI safe for large payments?
UPI is secure when used correctly. For very large amounts (property, business), many people prefer NEFT/RTGS with verified IFSC — see our IFSC verification guide.