UPI collect request & refund scams: why you never enter PIN to receive
Got a 'refund' or collect request on UPI? Your PIN is only for sending money. Learn the common scams, a 10-second check and what to do in the first hour.
You get a message: "Congratulations, your refund of ₹4,800 is ready. Scan this QR code or approve the request to receive it." You tap, a screen asks for your UPI PIN, and a minute later your account is lighter. This is one of the most common UPI tricks in India, and it works because it feels like a normal payment screen.
This guide explains how the "collect request" and "refund" scams work, the one rule that beats all of them, and what to do in the first minutes if you slip.
The one rule: your PIN is only for sending money
Your UPI PIN has a single job: to approve money leaving your account. You never need it to receive money. Safety guidance circulating around NPCI's UPI awareness campaigns says the same thing: you do not need to enter a PIN or scan a QR code to receive a payment, and if someone asks you to, treat it as a red flag.
So if any screen asks for your PIN while the story is "you will get money", stop. Cancel the transaction.
How the common scams look
1. The "collect request"
A stranger sends a request from their UPI ID asking you to pay. It may be labelled "refund", "cashback", "prize" or even look like a bill. If you approve it and enter your PIN, you pay them.
2. The "scan to receive" QR
A buyer on a resale platform says, "I will send you the advance, just scan this QR." Scanning a QR code that belongs to them and entering your PIN pays them. Receiving money only needs you to share your own UPI ID or show your own QR.
3. The fake customer-care refund
You complain about a delayed order and later get a call from a "support agent". They ask you to install a screen-sharing app or approve one small test payment to "verify" your account. Once they can see your screen, they see your PIN too.
4. The wrong-transfer plea
Someone sends you ₹2,000 "by mistake" and then calls, pleading you to return it, sometimes with a link to a different account. Don't pay anyone back through a number they give you. Ask your bank to help reverse the original credit.
A 10-second check before every approval
Ask yourself these four questions:
- Who is asking? Is the name and UPI ID someone I know and expected?
- Is money going out? Look for words like "Pay", "Collect request", or a PIN prompt. Those mean debit.
- Am I being rushed? Scammers create urgency: "offer ends in 5 minutes".
- Did I start this? If you didn't initiate the payment, don't approve it.
If any answer feels wrong, decline the request. Declining costs nothing; approving can cost your savings.
If you have already paid: act fast
Speed matters more than anything else. Indian cyber-crime guidance points you to two official channels:
- Call the national cyber-crime helpline 1930, which is used for reporting online financial fraud.
- File a complaint on the national cyber-crime portal, cybercrime.gov.in.
- Call your bank and ask them to flag the transaction and block further misuse.
- Keep screenshots of the chat, the UPI ID, the transaction ID and the time.
Sources differ on how long the "golden hour" lasts. Some say the first few hours, others say minutes. The honest takeaway: report as soon as you realise, because police can ask banks to freeze the receiving account only while the money is still there. Reports have also noted that the helpline can be busy, so use the portal as a backup. Never pay any "recovery agent" who promises to get your money back for a fee; that is often a second scam.
Small habits that make you harder to trick
- Set a daily UPI limit you are comfortable with. A lower limit caps the damage of any mistake.
- Turn on app lock and never share your phone screen with anyone claiming to help.
- Use only the official support number from the app or the company's website, not one from a search ad or a message.
- Don't keep a large balance in the account linked to UPI. Park your emergency fund in a separate savings account.
- Look at your transaction history once a week. Odd small debits are often "tests" before a bigger attempt.
Practical takeaway
- Receiving money never needs your PIN.
- Decline unexpected collect requests without a second thought.
- If you are scammed, call 1930 and file on cybercrime.gov.in immediately, then inform your bank.
- Review your account weekly so small leaks do not hide.
This is general information, not financial advice.
How Dhuddu helps
A regular look at your spending is one of the easiest ways to catch things that don't belong. Dhuddu is a free expense tracker for India that can read your bank alerts and statements, so an unfamiliar ₹499 or ₹4,800 debit stands out in your weekly review. You can also set budgets and use the Android app on Google Play to keep an eye on money going out.