Festive shopping brings a sharp increase in digital payments, making UPI safety especially important for consumers. Fake cashback offers, QR-code tricks, phishing messages, impersonation and fraudulent payment requests can put users at risk if they act without checking the transaction details.
Why UPI scams become a bigger concern during festive shopping
UPI has become a routine payment method for everything from grocery purchases and clothing to travel bookings, food orders and online shopping. During the festive season, consumers also encounter a higher volume of promotional messages, discount advertisements, cashback claims and payment links.
The technology itself is not necessarily the problem. The bigger risk often comes from scammers manipulating users into authorising transactions themselves.
The National Payments Corporation of India (NPCI) warns users about several fraud techniques, including fake cashback links, suspicious QR codes, unknown applications, fake investment schemes and deceptive messages. NPCI specifically notes that scanning a QR code and entering a UPI PIN is intended to make a payment, not to receive money.
For shoppers in Tier-2 and Tier-3 cities, where UPI is increasingly used by local retailers and small businesses, understanding these basic precautions can help prevent avoidable losses.
Never enter your UPI PIN to receive money
One of the most important UPI safety rules is simple: you do not need to enter your UPI PIN to receive money.
Scammers may claim that a QR code will provide cashback, a refund, a festival reward or a payment. They may then ask the user to scan the code and enter the UPI PIN.
That action can authorise a payment from the user’s bank account.
NPCI’s fraud-awareness guidance specifically warns about QR-code and cashback scams and explains that entering the UPI PIN after scanning a QR code is associated with making a payment.
Before approving any transaction, users should read the payment screen carefully. Check the amount, recipient name and other transaction details before entering the PIN.
Be careful with festive cashback and discount messages
Festival periods generate large numbers of promotional messages across SMS, WhatsApp, email and social media. Not every offer that uses the name or logo of a familiar company is genuine.
A message may claim that you have won cashback, received a shopping voucher or become eligible for a limited-period reward. It may contain a link asking you to log in, provide banking information or complete a UPI transaction.
Instead of opening an unfamiliar link, users should visit the company’s official website or application directly and check whether the offer exists.
NPCI lists fake cashback links and deceptive messages among the fraud patterns against which digital-payment users should remain vigilant.
Check every collect request before approving it
UPI can also be used to send payment requests. A user may receive a collect request that appears unexpected or is presented as a refund, booking confirmation, prize or purchase adjustment.
Do not approve a request simply because the sender claims that it will result in money being credited to your account.
Payment applications provide transaction details that should be reviewed before approval. BHIM, for example, allows users to view pending UPI collect requests and transaction history, while also providing options to report issues with transactions.
If you were not expecting a payment request, verify it independently with the person or business involved before taking any action.
Do not share your UPI PIN, OTP or banking credentials
Your UPI PIN should remain private. The same applies to OTPs, passwords, debit-card details and other banking credentials.
A person claiming to be from a bank, payment application, courier company, shopping platform or government department should not be given these details merely because they sound convincing.
The Reserve Bank of India has repeatedly highlighted the importance of protecting critical information such as PINs, OTPs and passwords when using digital payment services.
If someone pressures you to share a PIN or OTP during a phone call, message or screen-sharing session, stop the interaction and contact the relevant organisation through its official channel.
Avoid unknown apps and remote-access requests
Another common risk involves applications that users are persuaded to install to receive refunds, discounts, customer support or other services.
NPCI includes downloading unknown applications among the fraud patterns users should watch for.
Users should install financial and payment applications only through trusted sources and should pay attention to the permissions requested by an application.
Be especially cautious if someone asks you to install an unfamiliar app and then requests access to your phone screen, messages or banking applications.
A genuine refund does not require you to hand control of your device to a stranger.
What to do if you accidentally approve a fraudulent UPI payment
Speed matters if money has been transferred fraudulently.
If you realise that you have been targeted, contact your bank or payment service provider immediately and report the transaction. Keep the transaction ID, date, amount, screenshots, messages and other relevant information ready.
The Government of India’s National Cyber Crime Reporting Portal provides a dedicated mechanism for reporting financial cyber fraud. The national cybercrime helpline is 1930 and operates 24×7.
The government portal also allows citizens to report and track cybercrime complaints.
Do not wait until the next day if money has already been lost. Immediate reporting can help authorities and financial institutions begin the appropriate response.
A simple safety checklist for festive UPI payments
Before approving any UPI transaction, take a few seconds to check what is happening on the screen.
Do not enter a UPI PIN merely to receive money. Verify the recipient before sending money. Treat unexpected cashback links and QR codes with suspicion. Avoid unknown applications and never disclose your PIN or OTP to another person.
Consumers should also avoid making financial decisions while being pressured by claims such as limited-time rewards, urgent refunds or accounts being blocked. Scammers often rely on creating urgency so that victims do not stop to verify the transaction.
This is particularly relevant during major shopping periods, when consumers are already receiving numerous legitimate offers and payment notifications.
Takeaways
- Never enter your UPI PIN to receive money or claim a supposed cashback.
- Check the recipient, amount and payment request before authorising a transaction.
- Never share your UPI PIN, OTP, password or banking credentials with anyone.
- Report suspected financial cyber fraud immediately through 1930 and the National Cyber Crime Reporting Portal.
FAQs
Is it safe to scan a QR code for receiving money?
Be cautious. NPCI states that scanning a QR code and entering a UPI PIN is meant for making a payment, not receiving money. If someone asks you to enter your PIN to receive a refund or cashback, do not proceed.
Can someone take money if I share my UPI PIN?
A UPI PIN is used to authorise eligible transactions. It should therefore never be shared with another person. NPCI advises users not to share their UPI PIN.
What should I do after a fraudulent UPI transaction?
Contact your bank or payment provider immediately and report the incident through the National Cyber Crime Reporting Portal or by calling 1930. Keep the transaction details and supporting evidence available.
Is 1930 available for reporting online financial fraud?
Yes. The Government of India’s National Cyber Crime Reporting Portal identifies 1930 as the national helpline for reporting online financial fraud, and its helpline information states that it operates 24×7.