The UPI "request money" scam: you never enter your PIN to receive money

One fact defeats this scam: your UPI PIN only ever sends money out of your account. Entering it approves a payment. It never brings money in.

Fraudsters rely on people not knowing that. They send something that looks like a way to get paid, and ask for the PIN to "complete" it.

How the scam works

The Reserve Bank of India describes the trick directly in its public warning on cyber frauds: fraudsters misuse the "collect request" feature of UPI by sending fake payment requests with messages such as "Enter your UPI PIN to receive money". The same warning lists unauthorised QR codes among the tools fraudsters use.

In practice, it usually runs like this:

1. Someone contacts you with a reason to send you money: a payment they say they owe you, an amount they say was debited by mistake, or help with a problem they say they can solve.
2. Instead of simply sending the money, they send you a payment request, or a QR code to scan.
3. The screen asks for your UPI PIN. The message makes it sound as though the PIN is needed to accept the money.
4. You enter the PIN, and the amount is paid from your account to theirs.

Whatever the story, the step that moves the money is always the same: you are asked to approve a payment while being told you are receiving one.

The rule to remember

The RBI puts it plainly: transactions involving receipt of money do not require scanning barcodes or QR codes, or entering a PIN. So:

• To receive money, you do nothing except share your UPI ID or your own QR code with the person paying you.
• If you are asked to scan a code or enter your PIN in order to be paid, it is not a payment to you.

Warning signs

• A payment request arrives when you were expecting to be paid, not to pay.
• The message on the request says anything like "enter PIN to receive" or "approve to get refund".
• You are sent a QR code and told scanning it will credit your account.
• The person is in a hurry, or keeps you on the phone while you do it.
• They claim to be from a bank, a payments app, a telecom company or a government office. The RBI notes fraudsters often pose as banks, e-wallet providers and telecom companies, using pretexts such as updating KYC, unblocking an account or SIM, or refunding a debited amount.

The RBI's complaint portal carries the shortest version of this advice: never respond to "Request money" options from unknown sources.

Never share your PIN

The RBI advises never sharing your account number, login ID, password, PIN, UPI PIN, OTP or card details with anyone, not even bank officials, however genuine they might sound. No genuine bank, app or government office needs your UPI PIN.

If you have already entered your PIN

Move quickly. The order matters.

1. Call 1930, the national cyber crime helpline, or file at cybercrime.gov.in. Keep the transaction reference (UTR), the amount, the time, and the UPI ID or number the money went to.
2. Tell your bank straight away through its official app, website or helpline, and keep the complaint number. Under the RBI's rules, where a loss happens because the customer shared payment credentials, the customer bears the loss until the transaction is reported to the bank; any loss after reporting is borne by the bank. Banks may also choose to waive a customer's liability. Either way, the sooner you report, the better.
3. File a full written complaint on the National Cyber Crime Reporting Portal if you reported by phone first.

Our guide to where to report financial fraud in India sets out each step, the RBI's time limits, and where to go if your bank does not resolve it.

If you were targeted but did not pay

Report it anyway. It helps stop the next attempt.

• Calls, SMS and WhatsApp messages used for fraud can be reported on the Department of Telecommunications' Chakshu service on the Sanchar Saathi portal. Suspicious links should be reported within 30 days of receiving them.
• The National Cyber Crime Reporting Portal lets you report the phone numbers, WhatsApp numbers, websites and social media accounts used by a fraudster.

The short version

• Your UPI PIN sends money. It never receives it.
• Receiving money never needs a QR scan or a PIN.
• Unexpected payment request? Decline it.
• Paid by mistake? Call 1930, then tell your bank at once.