UPI (Unified Payments Interface) lets you send and receive money instantly from your bank account using an app like Google Pay, PhonePe, Paytm or BHIM. The single most important safety rule is this: you enter your UPI PIN only to SEND money, never to receive it. Anyone asking you to enter your PIN or scan a QR code to "receive" money is trying to make you pay them. UPI is genuinely safe when you understand this one principle, along with a few habits. This lesson covers how UPI works, how to pay safely, and the scams to watch for.
How UPI works
UPI links your bank account to a payment app through your registered mobile number. You set a UPI PIN (a 4 or 6-digit number), which authorises payments. To pay someone, you send money to their UPI ID, phone number, or by scanning their QR code, and confirm with your PIN. The money moves from your bank to theirs in seconds. There's no need to enter card numbers or bank details each time, which is what makes UPI so convenient, and why it's used everywhere from big shops to roadside vendors.
The one rule that keeps you safe
Burn this into memory: PIN = sending money. You enter your UPI PIN only when money is leaving your account. Receiving money requires nothing from you, no PIN, no scanning, no approving a request. So the moment anyone, a "buyer", a "customer care agent", a "refund team", asks you to enter your PIN or scan a QR to receive money, stop. It's a scam designed to make you pay them while you think you're being paid.
Sending money safely (step by step)
- Open your UPI app (Google Pay, PhonePe, etc.).
- Choose Pay and enter the person's UPI ID / number, or Scan QR for a shop.
- Check the name that appears, confirm it's the correct recipient.
- Enter the exact amount.
- Enter your UPI PIN to confirm. The money is sent.
Always verify the recipient's name before paying, especially for large amounts or a new contact.
Receiving money safely
To receive money, you simply share your UPI ID, phone number, or QR code with the sender. That's it. You do not enter your PIN, approve a "collect request", or scan anything. When someone pays you, the money just arrives and you get a notification. If a "buyer" insists you scan a QR or enter your PIN "to get the payment", they're trying to rob you.
Common UPI scams (and how to dodge them)
| Scam | The trick | Your defence |
|---|---|---|
| "Receive money" collect request | Sends a request you approve, which actually pays them | Never approve/enter PIN to receive; decline unknown requests |
| Fake QR for refund | "Scan this QR to get your refund" | Scanning a QR pays money; refunds don't need it |
| Wrong-transfer trick | "I sent you money by mistake, please return it" | Verify in your own app first; ignore fake screenshots |
| Fake customer care | Wrong helpline number, asks you to pay/share PIN | Use the app's official support only |
| Screen-sharing fraud | Asks you to install AnyDesk/TeamViewer to "help" | Never install screen-share apps for strangers |
Never share these
- Your UPI PIN — with anyone, ever.
- Your card number, CVV, expiry, OTP — UPI doesn't need these shared with others.
- Screen access — never install remote/screen-sharing apps (AnyDesk, TeamViewer) at a stranger's request; they'll watch you type your PIN.
Protect your UPI account
- Lock your phone with a PIN, pattern or fingerprint. Your UPI app is only as safe as your phone.
- Set an app lock on the UPI app itself, if available.
- Keep your linked number secure; if you lose your SIM, block it and update your bank quickly.
- Check your bank SMS/notifications for every transaction; report anything you didn't do.
- Set a sensible daily limit if your app allows, to cap potential loss.
What to do if money is wrongly deducted or you're scammed
- Report in the UPI app (raise a complaint for the transaction).
- Call your bank immediately to report unauthorised transactions.
- Call the cybercrime helpline 1930 and report at cybercrime.gov.in.
- Keep the transaction ID and screenshots for the complaint.
Speed matters; report within minutes for the best chance of action.
Real-world scenario (a vendor almost loses money)
A small vendor lists an item for sale online. A "buyer" calls, agrees to pay, then says, "I'll send the money, just approve the request I'm sending and enter your PIN to receive it." The vendor, not knowing the rule, is about to enter the PIN, which would send his own money to the scammer. A moment's pause and the rule, "I never enter a PIN to receive", saves him. He simply shares his UPI QR instead and asks the buyer to pay normally. The scammer hangs up. This exact trick, dressed up in many ways, is the most common UPI fraud, and the one rule defeats all versions of it.
Pro tips
- Memorise: PIN and QR-scanning mean money going OUT, never coming in.
- Verify the recipient's name before paying, and start with a ₹1 test for a new large payment.
- Keep transaction notifications on so you catch anything unexpected.
- Never let anyone guide you to install a screen-sharing app or "help" you with a payment.
Common mistakes
- Entering the PIN to "receive" money. This always sends money; receiving needs nothing from you.
- Scanning a QR for a "refund". Scanning pays; genuine refunds arrive on their own.
- Sharing the PIN or OTP with "customer care". Real support never asks for these.
- Installing screen-share apps for strangers. They'll watch you enter your PIN.
- Not checking the recipient's name. A wrong ID sends money to the wrong person, and UPI transfers are hard to reverse.
Key takeaways
- UPI sends and receives money instantly; your PIN authorises only sending.
- Receiving money needs nothing from you, no PIN, no QR, no approval.
- Verify the recipient's name before paying; never share your PIN or OTP.
- Never install screen-share apps for strangers; report fraud to your bank and 1930.
Practice task
Open your UPI app and find where to view your UPI ID and QR code (what you'd share to receive money). Then make a small ₹1 payment to a trusted contact, noticing that you check the name and enter your PIN only to send. Confirm transaction notifications are switched on.
Learn everyday digital skills safely, from UPI to email to Office, in the Basic Computer Course (BCC) at HCI.
Frequently Asked Questions
Is UPI safe to use?
Yes, when you follow the rules: enter your PIN only to send money, never to receive it, verify the recipient before paying, and never share your PIN or OTP. Most UPI fraud relies on tricking you into paying.
Do I need to enter my UPI PIN to receive money?
No. Receiving money needs nothing from you, no PIN, no QR scan, no approval. If someone asks you to enter your PIN to "receive" money, it's a scam to make you pay them.
What are common UPI scams?
Fake "receive money" collect requests, "scan this QR for a refund", wrong-transfer return tricks, fake customer care asking for your PIN, and screen-sharing fraud. All aim to make you pay or reveal your PIN.
Should I install AnyDesk or TeamViewer if customer care asks?
Never. These screen-sharing apps let a stranger watch and control your phone, including your PIN entry. Genuine support never asks you to install them.
What should I do if money is wrongly deducted from UPI?
Raise a complaint in your UPI app, call your bank immediately, report to the cybercrime helpline 1930 and cybercrime.gov.in, and keep the transaction ID and screenshots. Act within minutes.