Online PrivacyUPI "receive money" scams: collect requests and QR codes
One rule stops most UPI fraud: your UPI PIN is only ever needed to send money or check your balance. Receiving money needs nothing from you.
The tricks
The fake buyer. You list a sofa or a phone for sale online. A "buyer" agrees at once without bargaining, says he is an army officer or is out of town, and offers to pay in advance. He sends a payment request or a QR code and tells you to approve it or scan it "to receive the money". When you enter your PIN, money leaves your account.
The mistaken transfer. Someone sends you a small amount, then calls in distress: it was meant for a hospital bill, please send it back. Sometimes this is honest. Sometimes the caller follows it with a collect request for a larger sum, or the first credit was a fake screenshot or message and you return money you never got.
The refund or cashback. A caller from "customer care" says a refund or reward is due and sends a link or request to "accept".
The fake payment screenshot or message. A buyer in your shop shows a "payment successful" screen, or you receive a text that looks like a bank credit alert, but no money has arrived.
The signs
- You are asked to enter your PIN, scan a code or tap "Pay" in order to receive money.
- The request screen says "Pay", shows your account being debited, or asks for your UPI PIN. Read the screen: it says what it will do.
- A stranger is in a hurry, overpays, or refuses to meet or pay cash.
- You are asked to install an app or share your screen "to help with the payment".
How to stay safe
- Never enter your UPI PIN unless you mean to pay. To receive money you share only your UPI ID, number or your own QR code.
- Decline payment requests you did not expect. Declining costs nothing.
- Trust only your own bank statement or app balance, not a screenshot, a text message or a sound box you do not control. Shopkeepers: wait for your own app or sound box to confirm.
- For money sent to you by mistake: do not send it back yourself in a hurry. Check your statement for the real credit. If it is genuine, tell the sender to raise it with their bank, or return it only to the same account it came from, for the same amount.
- Set a daily limit you are comfortable with in your UPI app or bank app, and keep only what you need in the account linked to UPI.
- Lock the app with a screen lock and never share the PIN, even with family over chat.
I approved a collect request by mistake. What now?
Call 1930 and your bank immediately, and follow the steps under "If money has already gone" below. Speed matters most.
Is scanning a QR code dangerous in itself?
Scanning only reads the code. The danger is approving the payment that it opens. A QR code is always for paying, never for receiving.
If money has already gone
- Dial 1930 at once. It is the national helpline for victims of financial cyber fraud. Give the transaction details; the earlier the report, the better the chance that the money can be held before it is moved on.
- Call your bank or card company on its official number and block the card, UPI or account. Report the transaction as unauthorised and note the complaint number.
- File the complaint on the National Cyber Crime Reporting Portal, cybercrime.gov.in, and keep the acknowledgement number.
- Keep everything: screenshots, numbers, UPI IDs, account numbers, transaction references, links, the app's name. Do not delete chats.
The full checklist, with what to keep ready, is on what to do after a fraud. Helpline and portal checked on 12 November 2026.
Independent guide. This is not a government, bank or police website. Helplines and rules were checked at official sources on 12 November 2026; confirm on the official site before relying on them.