If somebody is sending money to you through UPI, you do not need to enter your UPI PIN to receive it.
That single rule can stop some of the most common UPI PIN fraud attempts. A person claiming to send a refund, cashback, marketplace payment or prize may ask you to scan a QR code, approve a request and type your PIN. Those actions can instead initiate or authorise money moving out of your account.
But there is an important distinction that many fraud warnings miss. A UPI PIN is primarily an authentication credential for transactions, and entering it does not invariably mean money will be debited. NPCI has, for example, confirmed that a PIN can be required for a UPI balance enquiry. The safe rule is therefore more precise: you never need your UPI PIN merely to receive money from another person. Never tell the PIN to anyone, and never enter it because another person says it is necessary to release incoming money.
NPCI defines the UPI PIN as a four-to-six-digit passcode created when a user registers for UPI and used to authorise bank transactions. It also explicitly tells customers not to share the PIN and says bank customer support will never ask for it.
That distinction matters because many UPI scams do not need a criminal to break the payment system. The criminal instead tries to persuade the account holder to authorise the wrong action.
FCRF Launches CP-FRM to Build India’s Next Generation of Fraud Risk Professionals
When Should You Enter Your UPI PIN?
Enter your UPI PIN only inside your trusted UPI application when you understand the action displayed on the screen and genuinely intend to authenticate it.
The most familiar example is an ordinary UPI payment. You scan a merchant’s QR code, select the bank account, verify the recipient and amount, and authenticate the payment.
The same principle applies when sending money directly to a UPI ID or mobile number. Before entering the PIN, check that the recipient displayed by the app is the person or business you actually intend to pay.
A PIN may also legitimately appear during certain non-payment UPI functions. NPCI’s January 2025 clarification on the so-called “jumped deposit” scam specifically stated that a PIN is required for balance enquiries and that entering it for a balance enquiry does not automatically authorise a withdrawal or a separate payment request.
UPI PIN set or reset processes are another distinct use case. NPCI’s UPI guidance has historically supported PIN reset using debit-card credentials and issuer OTP, while an October 2025 circular introduced UIDAI Face Authentication as an additional optional method for UPI PIN set or reset. Existing methods may continue to be used.
The practical test is simple: Did you initiate this action yourself, and does the UPI app clearly show what you are authenticating?
If not, stop.
When Should You Never Enter a UPI PIN?
You should not enter a UPI PIN merely because somebody tells you that doing so will allow you to receive money.
That includes claims involving a refund, cashback, prize, marketplace sale payment, government benefit, failed-payment reversal or money supposedly being returned to you.
NPCI’s fraud-awareness guidance specifically warns that scanning a QR code and entering a UPI PIN is meant for making payments, not receiving them.
You should also never disclose your PIN over a phone call, WhatsApp message, SMS, email, online form or screen-sharing session. The person asking may claim to be from your bank, a payment app, police, customer support or a merchant. Their claimed identity does not change the rule.
Your PIN is a credential. A legitimate support executive does not need to know it.
Do You Need a UPI PIN to Receive Money?
No.
If another person is transferring money to your UPI account, the sender authenticates the transaction from their side. You do not enter your UPI PIN to make that incoming transfer arrive.
This is where a large share of social-engineering confusion occurs.
Imagine that you are selling a phone online for ₹10,000. A supposed buyer says he has transferred the amount but that you must “accept” it. A payment request appears for ₹10,000. He tells you to enter your PIN to complete the receipt.
The request is not proof that ₹10,000 is waiting to enter your account. If the screen is asking you to authorise a payment request, approving it can send your money to the other party.
The Delhi Police’s cyber-safety material has documented precisely this marketplace pattern: a fraudster posing as a buyer uses UPI’s request-money function and persuades the seller to enter a PIN, resulting in money being transferred to the fraudster.
Never use the other person’s instructions as your guide to what a payment screen means. Read the screen yourself.
What Is a UPI Collect Request Scam?
A collect request reverses the situation many victims think they are seeing.
Instead of somebody sending money to you, they are asking you to pay them.
Collect requests are legitimate UPI functionality. The fraud begins when somebody misrepresents what the request means.
A scammer may call it a refund approval, payment acceptance request, verification transaction, cashback claim or money-release process. The terminology is designed to make an outgoing payment look like an incoming one.
The defence is straightforward: if an unexpected payment request appears, do not approve it simply because the person on the phone tells you to.
If somebody genuinely owes you money, they can transfer it directly to your correct UPI ID or other verified payment destination.
Can Scanning a QR Code Put Money Into Your Account?
A stranger’s QR code is not something you need to scan to receive an ordinary UPI payment.
A QR code can encode payment information that helps your UPI app identify where money is supposed to go. NPCI’s fraud-awareness material warns users against QR-code schemes promising rewards in exchange for scanning the code and entering a UPI PIN.
This is particularly relevant to online marketplace fraud.
A fake buyer may say, “Scan this code and ₹5,000 will be credited.” The QR may instead prepare a payment to an account controlled by the fraudster. If your app subsequently shows a payment amount and asks for authentication, do not proceed on the assumption that you are receiving money.
To get paid, you can provide the payer with your verified UPI ID or your own receiving QR code. You do not need to scan a QR supplied by the person who claims to be paying you.
Does Entering a UPI PIN Always Deduct Money?
No, and this is where safety advice needs precision.
Entering a UPI PIN during an actual payment flow can authorise the debit. But NPCI has confirmed that UPI balance enquiries also require PIN authentication and that entering a PIN for a balance enquiry does not automatically approve a separate withdrawal or payment.
This means the popular statement “every time you type your PIN, money leaves your account” is too broad.
A better rule is:
Never enter a UPI PIN to receive money. Enter it only inside your trusted UPI app for an action you deliberately initiated or have independently verified, after reading what the screen says.
That formulation protects users without misdescribing how UPI works.
What Changed Under RBI’s 2025-26 Authentication Rules?
India’s digital-payment authentication framework has also changed.
The Reserve Bank of India’s Authentication Mechanisms for Digital Payment Transactions Directions, 2025 require domestic digital payment transactions, unless specifically exempted, to use at least two distinct authentication factors. The directions took effect for payment system providers and participants from April 1, 2026.
RBI recognises authentication factors based on something the user has, knows or is. Examples listed by RBI include passwords, SMS OTPs, PINs, cards, software tokens, fingerprints and other biometrics. At least one factor for a digital payment, other than card-present transactions, must be dynamically created or proven and unique to that transaction.
This is significant because two-factor authentication should not be confused with a rule that every digital payment must always use an SMS OTP. RBI now provides a broader technology-neutral framework.
NPCI subsequently introduced additional authentication options for UPI. Its October 2025 circular provided for UIDAI Face Authentication as an additional option for setting or resetting a UPI PIN, while retaining existing methods.
None of these changes creates a requirement to enter a UPI PIN to receive an ordinary person-to-person payment.
What Should You Check Before Entering Your UPI PIN?
Before authenticating a payment, ignore the conversation happening around you for a few seconds and read your own screen.
Check the action, the amount and the recipient.
If the caller says you are receiving ₹8,000 but your UPI app shows a ₹8,000 payment to another person, believe the app screen, not the caller.
Do not let anyone rush you through this stage. Fraudsters benefit when victims treat the PIN screen as a routine obstacle rather than the final point at which they can stop the transaction.
Also avoid entering financial credentials while screen-sharing or remote-access software is being used at somebody else’s instruction. NPCI’s fraud-awareness material warns about downloading unknown applications, while mainstream UPI safety guidance similarly warns against screen-sharing tools being used to expose sensitive information.
What If You Entered Your UPI PIN but No Money Was Debited?
Do not assume that every PIN entry means you have been defrauded.
First check what action you actually authenticated.
If it was a balance enquiry you initiated yourself, for example, NPCI says PIN entry is part of that process and does not automatically authorise another withdrawal.
If, however, you entered the PIN after an unexpected collect request, suspicious QR code, unknown payment link or instructions from a stranger, check your account transaction history immediately.
If you disclosed the PIN itself to another person, treat the credential as compromised. Use your bank or UPI app’s official security options, contact the bank through its verified channel and follow its instructions for securing the account.
Never search randomly for a “customer-care number” and call the first number that appears. Fraudsters can impersonate support services too.
What Should You Do If Money Has Already Been Debited?
Speed matters after a suspected UPI fraud.
First, contact your bank immediately through its official fraud-reporting channel and report the disputed transaction.
Then call India’s National Cyber Crime Helpline on 1930 for cyber financial fraud and file the complaint through the . The portal itself directs victims of financial fraud to 1930.
Keep the transaction ID, amount, date and time, bank account details, UPI ID involved, screenshots, phone numbers, messages and other relevant evidence available.
Do not wait for the fraudster to promise a refund.
Will the Bank Refund Money Lost Through UPI Fraud?
A refund cannot be assumed merely because a transaction was fraudulent.
RBI’s customer-liability framework distinguishes between situations involving bank fault, third-party breaches and customer negligence.
Under RBI’s directions for unauthorised electronic banking transactions, a customer can have zero liability where the unauthorised transaction results from contributory fraud, negligence or deficiency on the bank’s part. Zero liability can also arise in a qualifying third-party breach where neither the bank nor customer is at fault and the customer reports the transaction within three working days of receiving the bank’s communication about it.
The position changes where the loss results from customer negligence, such as sharing payment credentials. RBI states that in such circumstances the customer bears the loss until the unauthorised transaction is reported to the bank; losses occurring after reporting are borne by the bank.
These rules are why a social-media promise such as “all UPI fraud is automatically refunded if reported within three days” is misleading. Liability depends on the circumstances.
RBI’s newer 2025 authentication directions add another protection: if a loss arises from transactions carried out without complying with those authentication directions, the issuer must compensate the customer in full.
Report first. Let the bank investigate the transaction under the applicable framework.
A Small Unexpected UPI Credit Does Not Give Someone Access to Your Account
The “jumped deposit” narrative created another misunderstanding around UPI.
The claim suggested that a fraudster could deposit a small amount into someone’s account and then somehow trigger a withdrawal when the victim checked the balance and entered a PIN.
NPCI issued a clarification in January 2025 saying that simply receiving money does not allow another party to withdraw funds from the recipient’s account. It also said a balance enquiry and a payment request are separate transactions.
That does not mean social-engineering scams involving unexpected credits are impossible. A criminal can still use an unexpected payment as a pretext to call the recipient, demand repayment, send a collect request or otherwise manipulate them.
The distinction is between a technical automatic debit, which NPCI rejected in the jumped-deposit scenario, and a social-engineering attempt designed to persuade the user to authorise a separate transaction.
The Five-Second UPI PIN Test
Before typing your PIN, ask yourself three things:
Did I start this action?
Does my screen say I am paying, approving or authenticating something I understand?
Am I entering the PIN because my trusted UPI app requires it, or because another person is telling me to?
If the third answer is “because somebody told me to receive money,” stop.
For a real-world example of how unauthorised UPI transactions can become a cybercrime investigation, see The420.in’s report on the .
Frequently Asked Questions
1. Do I need to enter my UPI PIN to receive money?
No. An ordinary incoming UPI transfer does not require the recipient to enter a UPI PIN. The sender authorises the payment from their side.
2. Does entering a UPI PIN always mean money will be deducted?
No. NPCI has confirmed, for example, that UPI balance enquiries require PIN entry and that this does not automatically authorise a separate withdrawal or payment. PIN entry during an actual payment-authorisation flow, however, can authorise a debit.
3. Should I scan a QR code to receive a refund?
You do not need to scan a QR code supplied by another person merely to receive an ordinary UPI payment. NPCI specifically warns about QR-code schemes that promise rewards and then ask users to enter their UPI PIN.
4. Can a bank employee ask for my UPI PIN?
No legitimate bank customer-support process requires you to tell an employee your UPI PIN. NPCI explicitly states that the PIN should not be shared and that bank customer support will never ask for it.
5. What is a UPI collect request?
It is a request asking you to make a payment. Criminals can misrepresent such requests as refunds, cashback or incoming payments. Never approve an unexpected request based solely on instructions from the person who sent it.
6. What should I do immediately after a fraudulent UPI debit?
Notify your bank through its official fraud-reporting channel, call 1930 for cyber financial fraud and report the incident through the National Cyber Crime Reporting Portal. Preserve transaction IDs, screenshots, messages and details of the account or UPI ID involved.
7. Will I automatically get my money back if I report within three days?
Not necessarily. RBI’s customer-liability framework depends on factors including whether the bank was at fault, whether there was a third-party breach, whether the customer was negligent and how quickly the transaction was reported.
8. What is the safest rule to remember about a UPI PIN?
Never share it. Never enter it merely to receive money. When your UPI app legitimately asks for it, read the action, recipient and amount yourself before authenticating.
Useful next step: Open the UPI app you normally use and locate its transaction-history, security and official help sections now, before you need them during a fraud. Save your bank’s official fraud-reporting number separately. If a suspicious debit has already occurred, stop troubleshooting and report it immediately to the bank and 1930.Internal links used
The420 Insight
The strongest defence against UPI PIN fraud is not memorising every new scam name. It is understanding what the PIN actually does.
A UPI PIN is a private authentication credential. It can legitimately be used for more than one UPI function, so the blanket claim that “typing a PIN always sends money” is inaccurate. But receiving an ordinary UPI payment from somebody else does not require you to enter that PIN.
That distinction makes many scams much easier to identify. A refund, prize or incoming payment should not turn into a stranger directing you through a QR scan, collect request and PIN screen.
When another person controls the instructions and your PIN is the final step, stop and read the transaction yourself.
About the author — Ayesha Aayat writes on cybercrime, digital safety, and emerging online threats. Her work focuses on public awareness, legal clarity, and technology-driven risks.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
