UPI Fraud Alert: 7 Rules to Keep Your Money Safe in 2026
NEWZA Editorial Team•
⚡ Key Financial Takeaways
UPI PIN is only for sending money; entering it to receive funds is a scam.
QR codes sent by unknown sources can force you to pay; always verify the payee name.
Person‑to‑person collect requests were discontinued on 1 Oct 2025, limiting fraud via fake requests.
Standard UPI cap is ₹1 lakh per day; new merchant discount rates from 15 Oct 2026 impose a 0.4 % fee on payments above ₹2,000, capped at ₹300 for ₹75,000+.
Report unauthorised transactions within three working days to potentially recover the loss under RBI rules.
💡 Why It Matters
The sheer volume of UPI transactions means that even a small percentage of fraud can affect millions of users. By understanding the mechanics of PIN usage, QR code safety, and recent regulatory changes, consumers can prevent loss and maintain confidence in India’s digital payment ecosystem.
Why UPI is Fast but Vulnerable The Unified Payments Interface (UPI) has become the backbone of India’s digital economy, handling more than 24 billion transactions in August 2026 alone. Its instant settlement and ease of use make it ideal for everyday purchases, but the same speed also gives fraudsters a quick window to exploit unsuspecting users.
PIN Misuse and QR Code Risks A common scam involves a caller or a fake “refund executive” asking you to type your UPI PIN to receive money. In reality, the PIN authorises a debit from your account, not a credit. Similarly, QR codes sent over messaging apps that claim cashback or a reward are often designed to pull money from you. Always double‑check the payee’s registered name that appears after scanning a code.
Collect Requests Ban Since 1 Oct 2025, the National Payments Corporation of India (NPCI) has stopped person‑to‑person collect requests. These were frequently used by fraudsters to trick users into approving payments. Only verified merchants—such as e‑commerce sites, food‑delivery apps, and IRCTC—can still send collect requests, so approve a pop‑up only if you initiated the purchase.
Transaction Limits and Merchant Fees UPI imposes a daily cap of ₹1 lakh per user, with many banks limiting you to about 20 transactions a day. New limits apply to recent UPI registrations or phone changes: a maximum of ₹5,000 can be sent in the first 24 hours. From 15 Oct 2026, merchants will pay a 0.4 % merchant discount rate (MDR) on payments above ₹2,000, capped at ₹300 for transactions of ₹75,000 and above. Certain sectors—railways, telecom, insurance, fuel, and farm‑input—pay a flat ₹5 fee instead. These costs are borne by merchants and cannot be passed on to consumers.
What to Do If Fraud Happens If you notice an unauthorised debit, act quickly: call the cybercrime helpline 1930, file a complaint at cybercrime.gov.in, notify your bank, and raise a dispute in your UPI app. RBI rules allow you to recover the amount if the fault lies with the bank or a third party, provided you report within three working days. However, if you voluntarily shared your PIN or OTP, liability may not be waived.
Bottom Line UPI’s convenience comes with a responsibility to stay vigilant. By following these seven rules—protecting your PIN, verifying QR codes, recognising legitimate collect requests, understanding transaction limits, and knowing the new fee structure—you can safeguard your money while enjoying the speed of digital payments.
🏛️ Background & Context
Since its launch in 2016, UPI has grown into the most widely used payment method in India, with billions of transactions each month. The Reserve Bank of India and NPCI continually update rules to balance speed, convenience, and security.
👁️ What To Watch Next
Consumers should monitor the implementation of the new merchant discount rate from 15 Oct 2026 and any further RBI guidelines on transaction limits or fee structures. Additionally, keep an eye on updates to the UPI app that may introduce new security features.
