How to use UPI safely: habits that stop scams
Verify before you pay, every time
UPI is now how India pays, and that is exactly why scammers target it. The good news: they almost never hack the technology. They trick the person holding the phone into approving a payment. So the thing that keeps you safe is not a clever setting, it is a handful of everyday habits. Learn these and the common scams simply stop working on you.
Did you know? By the middle of 2025, Indians were making more than 20 billion UPI payments a month (NPCI data, as reported in the press). With that much money moving, fraud is a small slice of a very large number, but a real one, so the habits below are worth building before you need them.
The one rule that matters most
If you remember nothing else, remember this: your UPI PIN only ever sends money out. It is never needed to receive money. Every “enter your PIN to get your refund” or “approve this to receive ₹5,000” message is the same trick wearing different clothes.
As the diagram shows, approving that screen sends your money out, it does not bring any in. To actually receive money, you only ever share your UPI ID or QR code. The full breakdown is in why your UPI PIN never receives money and the common UPI scam shapes.
Did you know? The Finance Ministry told Parliament that UPI frauds touched about ₹981 crore across roughly 12.64 lakh cases in one year (FY25). The sheer case count tells you these are ordinary, careful people, caught in a rushed moment, not a rare few.
The rest of the checklist
- Read the payee name before you tap pay. Your app shows who you are actually paying. A quick glance catches a wrong number or a lookalike name before the money goes.
- Set a daily UPI limit you can live with. A lower limit in your app caps the damage if you are ever tricked or your phone is taken. Raise it only when you genuinely need to.
- Lock your UPI app. Use the app’s own PIN, fingerprint or face lock, separate from your phone lock, so a borrowed or stolen phone cannot pay on your behalf.
- Never install an app a caller asks you to. Fake “support” staff ask you to install a screen-sharing or “helper” app so they can watch you type your PIN or take control. No real bank or app ever needs this.
Two more habits worth keeping
Verify unknown callers yourself. If someone claims to be your bank or an app’s support team, hang up and call the number printed on your card or the official website. Never trust a number the caller gives you. This is the same rule that defeats the KYC update scam and the digital arrest scam.
Slow down for ten seconds. Almost every scam needs you to hurry. Before you approve anything, ask one question: am I sending money or receiving it? Receiving never needs your PIN.
If it has already happened
Do not freeze with embarrassment, because speed is what gets money back. Call 1930, tell your bank, and file at cybercrime.gov.in. The step by step is in how to report a UPI fraud.
Did you know? The government’s cyber fraud reporting system, run through the 1930 helpline and cybercrime.gov.in, had saved more than ₹7,000 crore across more than 23 lakh complaints, as told to Parliament in December 2025 (Ministry of Home Affairs). The people who got their money back are mostly the ones who reported fast.
Questions people ask
How can I use UPI safely?
Build a few habits: remember that your PIN only sends money and is never needed to receive it, read the payee name before you pay, set a daily limit, lock your UPI app, and never install an app a caller tells you to. Those habits defeat almost every common UPI scam.
Do I ever need my UPI PIN to receive money?
No. Your UPI PIN is only ever needed to send money out of your account. If a refund, a prize, a cashback or a buyer asks you to enter your PIN to receive money, it is a scam, every time.
Should I set a UPI transaction limit?
Yes, it is a simple safety net. A lower daily limit in your app caps how much can leave your account if you are ever tricked or your phone is taken. You can raise it when you genuinely need to.
What should I do if I am scammed on UPI?
Act fast. Call 1930, the national cyber fraud helpline, tell your bank, and file at cybercrime.gov.in. Reporting in the first hour gives the best chance of freezing the money.
Source: Ministry of Finance replies in Parliament (UPI fraud figures), NPCI (UPI transaction volumes) and the 1930 cyber helpline. Figures change over time; confirm the latest.