UPI and Online Banking Security: 12 Tips to Avoid Fraud
UPI has made payments instant, and that includes payments to fraudsters. Most UPI and banking fraud doesn’t involve hacking the bank. It works by tricking the account holder into approving a payment or sharing a code. These habits block the vast majority of scams.
Protect your PINs and codes
- You never need your UPI PIN to receive money. If anyone asks you to enter your PIN or scan a QR code “to receive” a refund, prize or payment, it is a scam. Entering the PIN always sends money.
- Never share OTPs, UPI PINs, card CVVs or net-banking passwords, with anyone, including people claiming to be from your bank, the police, a courier company or customer support. Banks never ask for these.
- Use a UPI PIN that isn’t your birthday, card PIN or phone-unlock PIN. Choose a random 6-digit PIN with the PIN generator and memorise it.
- Lock your phone with a strong PIN or biometrics, and enable the app lock inside your UPI and banking apps.
Watch out for the common scams
- “Collect request” scams: a stranger sends a payment request labelled as a refund or reward. Approving it sends them money. Read every request carefully and decline anything unexpected.
- Fake customer care numbers: scammers advertise fake helplines on search results and social media. Get support numbers only from the official app, website or the back of your card.
- Screen-sharing apps: never install AnyDesk, TeamViewer or similar apps at a caller’s request. They let the scammer watch you type codes.
- Phishing links: SMS or WhatsApp messages about blocked accounts, KYC updates, electricity disconnection or parcel delivery fees are classic phishing. Open your bank’s app directly instead of tapping links.
- “Digital arrest” and impersonation calls: no police or government agency arrests people over video calls or demands money transfers to “verify” you. Hang up.
Lock down your accounts
- Use a unique, strong password for net banking and for the email linked to your bank, ideally 20+ characters from the password generator, stored in a password manager.
- Turn on transaction alerts by SMS and email, and set daily UPI and card limits that match your actual spending.
- Keep apps and your phone updated, and install banking apps only from the official Play Store or App Store listing.
If money is stolen: act within the first hour
- Call the national cyber-crime helpline 1930 immediately, and file a complaint at cybercrime.gov.in. Reporting fast improves the chance that funds can be frozen in the receiving account.
- Inform your bank through its official number or app and ask them to block UPI, cards and net banking.
- Change your passwords and UPI PIN from a device you trust.
- Keep screenshots of messages, transaction IDs and the fraudster’s UPI ID or number for the complaint.
Under RBI rules on limiting customer liability, reporting unauthorised electronic transactions quickly (within three working days) can significantly reduce or eliminate your liability, so don’t delay.