UPI moves about ₹20 lakh crore a month in India. That's an astronomical amount of trust. Most of it works flawlessly. But scammers know the same: one well-placed UPI transaction tricks someone out of savings in 3 seconds.
Here are the 10 rules. Memorise them.
1. Scanning a QR code means YOU PAY
Every QR scan is a "pay this merchant" request. Scammers flip the script: "scan my QR to receive money!" — scanning it actually sends money FROM you.
Rule: Never scan a QR on someone else's word. If someone owes you, they send their UPI ID and YOU enter the amount.
2. "Collect" requests are money requests
That innocent notification "Rahul Kumar has sent a request for ₹500" — approving it pays ₹500 to Rahul.
Rule: Reject every Collect request from unknown sources. Even known sources: double-check before approving.
3. Your UPI PIN is for YOUR use only
No bank, no payment app, no government official ever needs your PIN.
Rule: If anyone asks — even once — it's a scam. Hang up.
4. Screenshots of "payment successful" are fake
Scammer buys something on OLX. Sends you a doctored "₹15,000 sent" screenshot. Says "check your account."
Rule: Only believe money is yours when it actually appears in your bank app, from your bank's notification, not the buyer's screenshot.
5. Pin-less payment = 2x danger
Many apps (Google Pay especially) allow low-value transactions without PIN if you stay logged in.
Rule: Use lock screen security. If someone has your unlocked phone, they can send ₹200-1,000 without knowing anything.
6. Public Wi-Fi = public transactions
Cafe Wi-Fi, airport Wi-Fi, mall Wi-Fi — assume someone's watching your network.
Rule: UPI only on mobile data or home/known Wi-Fi. Never on random free networks.
7. Never give your VPA to a stranger
Your Virtual Payment Address (like yourname@okhdfc) is basically your bank routing number.
Rule: Don't post it on public forums, Instagram, or chat groups. Shared only with trusted contacts.
8. "Family member" asking for UPI = verify by phone first
A hacked WhatsApp account is the #1 source of emergency money requests.
Rule: Any "Help me with ₹5,000, I'll return it tomorrow" — call them on their actual phone number first. Not WhatsApp voice. Phone call.
9. Set transaction limits
Every UPI app lets you set daily and per-transaction limits.
Rule: Set daily limit to what you actually spend. ₹5,000/day is enough for a teen. If a fraudster tries ₹50,000, it'll fail.
10. Enable SMS + app notifications
Immediately know the moment money leaves your account.
Rule: Within 10 minutes of a suspicious transaction, you can file a chargeback with your bank. After 24 hours, refund odds drop to 20%.
What to do if you got scammed
1. Immediately call your bank's fraud helpline (printed on the back of the card)
2. Lock UPI from inside the app
3. File a complaint at cybercrime.gov.in within 24 hours
4. Visit your bank branch within 3 days with a written complaint
5. Under RBI rules, you have limited liability if you reported within 3 days
Banks recover ~40% of reported UPI fraud if reported within 24 hours. After 7 days, nearly 0%.
Speed is the refund.