UPI Scams Explained: Collect Requests, Fake QR Codes and Refund Tricks

UPI has two directions. In a push payment you start it, by scanning a QR code or entering a UPI ID, and you confirm with your PIN. In a pull payment, also called a collect request, someone else asks for money and you approve it with your PIN.

In both cases, your PIN moves money out of your account. Receiving money needs nothing from you. PIN daala matlab paisa gaya. Bas itna yaad rakho.

In this trick, a "buyer", "customer care agent" or "lottery office" sends a request to your UPI app and tells you to approve it to receive a payment or a refund. Approving with your PIN actually pays them.

The National Payments Corporation of India (NPCI), which runs UPI, told banks and UPI apps to stop person to person (P2P) collect requests from 1 October 2025 (circular NPCI/UPI/OC/220/2025-26 dated 29 July 2025). Collect requests from merchants, such as a shopping or ticket booking app, still exist. So if a payment request pops up that you did not start yourself, decline it.

A QR code is a way to pay, not to get paid. Common versions:

• A "buyer" on a selling site sends a QR code and says "scan this to receive the advance". Scanning and entering your PIN sends your money to them.
• A sticker pasted over a shop's real QR code, so your payment goes to someone else. Before you enter the PIN, check that the name shown in your app is the shop's name.
• QR codes in emails, posters or messages that open a fake payment or login page.

Paise lene ke liye scan nahi karna padta. Jo bole "scan karo, paise aayenge", wahi scammer hai.

• Fake credit SMS. You get an SMS that looks like a bank alert saying money was credited, then a call: "I sent it by mistake, please send it back." The SMS is fake. Open your bank or UPI app and check your actual balance and history, not the SMS.
• Real mistaken credit. If money really arrived and someone asks for it back, do not send it to a new number or UPI ID they give you. Ask them to contact their own bank, which can handle a wrong transfer through official channels.
• Fake customer care. Numbers from search results, comments or social media posts that claim to be a bank, app or courier helpline. They ask you to approve a "refund" request or install a screen sharing app, then take control. Get support numbers only from the official app or website.

• Read the payee name on the confirmation screen before you enter your PIN.
• Never share your UPI PIN, OTP or card details with anyone, including someone who says they are from your bank.
• Do not install screen sharing or remote access apps because a caller asked you to.
• Keep your phone and UPI apps updated, and lock the apps with a screen lock.
• Turn on SMS and email alerts from your bank so you see every debit.

1. Call 1930 right away and keep the acknowledgement number.
2. Complete the complaint on cybercrime.gov.in with every UTR or transaction ID.
3. Report it to your bank and raise a complaint inside your UPI app.
4. Save screenshots of the chats, the request or QR code and the payment screens.

The full steps are in how to report cyber fraud in India. To check a suspicious link someone sent you without opening it, try the link checker on the home page.