How to Protect Yourself From UPI Scams, Phishing and Online Fraud in India

Ramesh, a retired teacher, got a call: "Sir, your electricity will be cut tonight because of unpaid bills. Install this app to pay." He installed it, and within ten minutes, ₹80,000 had left his account.

No one hacked his bank. He gave the fraudster control himself, because he was frightened and in a hurry. That is how most online fraud works. The good news: a few simple habits stop most of it.

1. To receive money, you never enter your UPI PIN. A request that asks for your PIN to "receive" is a payment request.
2. Never share an OTP, PIN, CVV, password or card number, with anyone, for any reason. Genuine banks and agencies never ask for them.
3. Never install an app or share your screen because a caller or message asked you to. Remote-access apps give them full control.
4. Urgency is a red flag. "Do it now or your account will be blocked" is a standard pressure tactic.
5. Verify through a channel you trust. Hang up and call the official number from the bank's website or your card.
6. If it sounds too good to be true, it is.

A buyer says "I'll send the money" and sends you a collect request. If you approve it with your PIN, money leaves your account. Or someone says they sent money by mistake and asks you to return it. Check your bank balance first, and don't approve unknown requests.

An SMS or WhatsApp says: "Your account will be blocked. Update KYC at this link." The link opens a copy of the bank's page that steals your details. Banks do not ask for KYC through links in messages. Visit the bank's official app or branch.

Fraudsters list their numbers on search results and maps pretending to be a bank, courier or airline. Always use the number on the official website or the card.

Messages that look like they come from your bank, a delivery company, the income tax department or an e-commerce site, asking you to click a link. Check the sender, the web address and spelling. Don't click. Open the site yourself. If you are filing taxes, go directly to the portal, as described in how to file ITR yourself.

You get a message offering ₹5,000 a day for liking videos or reviewing products. At first you may even get small payments. Then you are asked to "invest" to unlock bigger returns, and lose it all. Real employers don't charge you fees for a job. See make money online honestly.

Groups on WhatsApp or Telegram promise "guaranteed 20% monthly returns", fake trading apps or insider tips. Check that the adviser is registered with SEBI and that platforms are legitimate. For safe basics, see mutual funds explained.

Instant loan apps ask for access to your contacts and photos, then threaten and shame you into paying huge amounts. Use only loans from regulated banks and NBFCs listed on the RBI website. Never grant contact and gallery permissions to unknown apps.

Callers claim to be from the police, CBI, customs or courier companies and say you are in a serious case, then demand money or insist on video calls. There is no such thing as a "digital arrest" in Indian law. Hang up and call 1930.

Scanning a QR code is for paying, not receiving. If a stranger sends a QR code to "receive" money, it is a scam. Check the merchant name before you pay.

Fraudsters may clone a voice or video of a relative asking for urgent money. Verify by calling the person on their known number or asking a question only they can answer. Be cautious about how much audio and video you post publicly. For how such tools work, see how AI chatbots work.

• Use long, unique passwords for each important account.
• Use a password manager (and a strong master password).
• Don't reuse your email password anywhere.

Turn it on for email, banking, social media and cloud storage. An authenticator app is safer than SMS where available.

• Keep it updated.
• Install apps only from the official Play Store or App Store, and check ratings and the publisher.
• Review app permissions. A torch app doesn't need your contacts.
• Use a screen lock and enable Find My Device.
• Don't connect to unknown public Wi-Fi for payments.

• Set transaction limits and alerts on your accounts.
• Use a separate account with a small balance for daily UPI, keeping savings elsewhere.
• Check SMS alerts for transactions you didn't make.
• Never save your PIN or card details in notes or messages.
• Log out after banking, and use official apps.

• Check sender addresses carefully.
• Don't open unexpected attachments.
• Limit personal details you post, such as birthdate, phone number and address.
• Be careful with "friends" asking for money. Verify first.

Fraudsters often target older people. Sit down together and:

• Teach the golden rules above.
• Set low transaction limits on their accounts.
• Agree that any request involving money gets a family call first.
• Save 1930 in their phones.

Speed matters. Money can sometimes be frozen if you act within the first hour.

1. Call 1930 (the national cybercrime helpline) immediately.
2. Report at cybercrime.gov.in with transaction IDs, screenshots, phone numbers and links.
3. Call your bank using the official number. Ask them to block cards, UPI and net banking, and to raise a dispute.
4. Change passwords and revoke any suspicious app access.
5. Uninstall remote-access apps and, if needed, reset the phone.
6. Keep evidence: messages, call logs, receipts, screenshots.
7. File a police complaint if advised, and keep the reference numbers.
8. Tell your family, so they aren't targeted next.

Don't feel ashamed. Skilled fraudsters fool educated people. Reporting quickly helps you and others.

Under RBI rules, your liability for unauthorised transactions can be limited if you report promptly. Report as soon as you notice, and read your bank's policy.

Before you pay or share anything, ask:

• Who contacted me, and did I expect it?
• Are they rushing or threatening me?
• Are they asking for a PIN, OTP, link or app?
• Can I verify this through an official source?
• What's the worst that happens if I wait an hour?

If any answer worries you, stop. Include these checks in your yearly routine. See monthly life admin routine.

UPI itself is secure. Most losses come from people being tricked into approving payments or sharing credentials.

Not without your PIN or approval. But they can send fake collect requests, so never approve unknown ones.

You can, but never share personal details. If in doubt, hang up and call back on an official number.

Use caution. Free VPNs may collect your data, and public Wi-Fi can be risky. Avoid banking on them.

They can explain patterns, but they are not a reliable detector. Verify with official sources. See writing better AI prompts and never paste personal data.

Fraud methods change constantly. Check the RBI, NPCI and cybercrime.gov.in sites for the latest advisories. This article is general guidance.