UPI payments look simple, but these seven things can save you from a costly mistake

The latest market report highlights that UPI is now so routine that many users scan a QR code, enter a PIN and move on without thinking much around what happens in between. But the same convenience can make a hurried payment costly. A few basic facts can help users avoid common mistakes, especially when a transaction involves an unfamiliar QR code, payment request or caller.

One, a QR code is not a way to receive money by itself. Scanning a QR code and entering your UPI PIN authorises a payment from your account. Fraudsters sometimes send QR codes while claiming that the scan will help you receive a refund, cashback or prize. If money is supposed to come to you, you should not have to enter your UPI PIN to receive it.

Two, the UPI PIN should stay private. NPCI says the PIN is used to authorise bank transactions and should never be shared, including with someone claiming to be from your bank or payment app. Customer-care staff do not need your UPI PIN to process a complaint.

Three, check the name and amount before approving. A payment request can look routine on a small phone screen, particularly when you are paying in a hurry. Before entering the PIN, check the recipient shown by the app and the amount. A mistaken UPI transfer generally cannot simply be stopped after it has been initiated, so checking before approval matters.

Four, a collect request is different from receiving money. A collect request asks you to approve a payment. If someone says, “I have sent you a request, just approve it to get the money,” stop and check what the screen actually says. Accepting such a request can debit your account.

Five, UPI does have transaction limits, but there is no single number that applies to every payment. NPCI’s standard FAQ says normal UPI fund transfers can be up to Rs. 1 lakh per transaction, while elevated limits apply to certain categories. Banks and payment providers can additionally apply their own internal limits within the permitted framework, so your available limit may be softer. A failed high-value payment does not automatically mean your UPI account is blocked.

Six, UPI is increasingly adding authentication choices, but the basic safety principle stays the same. NPCI introduced optional on-device biometric authentication as an alternative to the UPI PIN for eligible transactions, initially up to Rs. 5,000.

Availability depends on the bank, app and device. Users should still review the transaction details before authenticating.

Seven, speed matters if you spot an unauthorised transaction. Inform your bank immediately through its official channels and raise the complaint in the UPI app where available. RBI’s customer-protection framework says that in certain third-party breach cases, reporting within three working days of receiving the transaction communication can provide zero liability. Where the customer has shared payment credentials, that stated, the customer can bear the loss until the transaction is noted.

The volume of UPI payments reveals why these checks matter. NPCI recorded more than 24.5 billion UPI transactions in August 2026, worth nearly Rs. 29.82 lakh crore. With payments happening at such scale, fraud attempts can arrive through fake cashback offers, impersonation, malicious links, bogus customer-care numbers and altered QR codes.

A useful habit is to treat every UPI approval as a financial instruction, not a routine tap. Pause for a few seconds, verify who will receive the money and why you are authorising it. That small pause can be more valuable than trying to recover money after it has left your account.