How to avoid UPI and payment scams
UPI made payments instant, and scammers adapted just as fast. Most payment fraud does not break any technology. It persuades a person to do one thing — enter a PIN, read out an OTP, scan a code — at the wrong moment. If you know the handful of tricks in use and a few fixed rules, you can stop almost all of them. Share this page with family members who are new to UPI.
Five rules that stop most scams
- You never need your UPI PIN to receive money. A PIN is only for sending money or checking your own balance. If entering a PIN is part of “receiving”, it is a scam.
- Never share an OTP, PIN, CVV or password — not with “bank staff”, “customer care”, a delivery agent or anyone in a chat. Genuine banks and companies do not ask for them.
- Scanning a QR code is for paying, not receiving. Nobody needs you to scan a code to send you money.
- Check your own bank app before treating money as received. Screenshots can be faked.
- Slow down when someone hurries you. “Your account will be blocked in 10 minutes” is pressure, not a bank process.
Common scams and how to spot them
The collect request
You are selling something online. A “buyer” says they will pay and you receive a UPI request with a note like “Receive ₹5,000”. Approving it with your PIN sends ₹5,000 to them. Reject any request you did not expect. Read the screen: it says “Pay”, not “Receive”.
The fake screenshot
A customer shows or forwards a “payment successful” screen and leaves with the goods. Later you find nothing in your account. Defence: confirm in your own app, and ask for the UTR so you can search for it. See How to find the UTR number of a UPI payment.
The accidental-transfer refund
You get a message (sometimes a fake bank-style SMS) saying money was sent to you by mistake, followed by a call asking you to return it. Check your actual balance. If there really is an unknown credit, let your bank handle the reversal rather than sending money to a number the caller gives.
The QR swap
A fraudster sticks their own QR code over a shop’s printed code. Shopkeepers: check your displayed QR every day. Customers: after scanning, look at the name shown before you enter the PIN.
Fake customer care
Searching the web or social media for a company’s helpline can turn up fake numbers. The “agent” asks you to install a screen-sharing or remote-access app, then watches you type your PIN. Use the help section inside the official app, or the number on the company’s own website. Never install an app because a caller asked you to.
Job, prize and KYC messages
“Pay a small registration fee for this job”, “you won a lottery — pay tax to claim it”, “update your KYC or your account will be closed — click this link”. Real employers don’t charge to hire you, you can’t win a lottery you never entered, and banks don’t close accounts through text links.
Worked example
Mr. Bedi, a retired teacher, listed an old sofa online. A buyer agreed to ₹8,000 without bargaining, said he was in the army and could not visit, and sent a UPI request saying “Payment for sofa”. Mr. Bedi’s daughter had told him the PIN rule, so he looked closely: the screen said Pay ₹8,000. He declined the request and blocked the number. A buyer in a hurry who never bargains and cannot meet is a common warning sign.
If you have been cheated
- Act immediately. Call the national cyber crime helpline 1930 or report at cybercrime.gov.in. Quick reporting improves the chance of money being frozen before it moves.
- Inform your bank through its official app or helpline and ask them to block UPI, cards or net banking if needed.
- Raise a complaint in your UPI app for the transaction, quoting the UTR.
- Keep evidence: screenshots of chats, the caller’s number, the UTR, time and amount.
- Change passwords and PINs if you shared them or installed a remote-access app; uninstall that app.
Extra protection worth setting up
- Use a screen lock on your phone and an app lock on payment apps.
- Set a daily UPI limit in your bank app that matches how you actually spend.
- Turn on SMS or app alerts for every debit.
- Keep a separate account with a small balance for everyday UPI.
- Install apps only from your phone’s official app store or the company’s own website.
Frequently asked questions
Can someone take money just by knowing my UPI ID?
No. They can send you a request, but money leaves only when you approve with your PIN.
Is it safe to share my UTR?
Yes. It is a reference number that helps trace a payment. It cannot be used to withdraw money.
Will Conserworks ever ask for my PIN or OTP?
No. No Conserworks app or staff member will ask for your UPI PIN or an OTP in a call or chat. In-app codes are typed only on the official Conserworks site you are signing in to.
Businesses should also read Collecting customer payments safely. C Pay users: C Pay privacy and safety.