UPI is safe when you follow one principle: money coming IN never needs you to do anything. Every UPI fraud makes you do something — approve, scan, enter a PIN, install an app.
The ten rules
1. Never enter your PIN to receive money. 2. Never scan a QR to receive money. 3. Never approve a collect request you did not initiate. 4. Set a daily limit just above your need. 5. Lock the UPI app with biometrics. 6. Use a separate merchant UPI / current account for the shop with a printed static QR. 7. Never install a screen-sharing app for ‘support’. 8. Verify a new payee by calling a number you already have. 9. Check the payee name shown before paying. 10. Report a wrong payment in the app and to 1930 within minutes.
For a business
Give staff a collection QR, not the owner's UPI login. Reconcile daily. Keep the personal UPI on a different number from the one printed on the shop board.
If a wrong payment was made
Raise a dispute in the app immediately (‘report an issue’), note the UTR, call 1930, and inform your bank; the NPCI dispute mechanism can reverse a mistaken payment when the receiver's bank co-operates.
Checklist
- ☐Daily limit set
- ☐App lock / biometric on
- ☐Separate merchant QR for collections
- ☐Collect-request alerts reviewed, unknown ones declined
- ☐1930 saved
- ☐Staff told: no PIN, no scan, no approval to receive money
Where to report
- • 1930 — national cyber-crime helpline (money lost: call within the first hour)
- • cybercrime.gov.in — National Cyber Crime Reporting Portal
- • chakshu.sancharsaathi.gov.in — report fraud numbers and SMS
- • sachet.rbi.org.in — RBI complaints about unregistered lenders / deposit schemes