What is UPI and is it safe?
Short answer
The Unified Payments Interface is India's instant interbank payment system, working between any participating bank and app, free at point of use for person-to-person transfers. It is safe when used correctly, and the one rule that prevents almost all UPI fraud is that you never enter your PIN to receive money — only to send it.
Verified · 5 cited sources
UPI links your bank account to a virtual payment address, so you can pay without sharing account numbers. It is interoperable — any UPI app can pay any other — and processes more real-time payment transactions than any other system in the world.
Person-to-person transfers are free at point of use, and QR-code payments have made digital payment ordinary at every scale from large purchases to street vendors.
The safety rule that matters most: entering your UPI PIN authorises money leaving your account. It is never required to receive money. Every 'collect request' scam works by persuading you that approving a request will credit you — it will not.
The second rule: no genuine institution ever asks for your UPI PIN, your card PIN, an OTP or a password. Banks, UPI apps, NPCI and government departments do not phone people for these.
Do not install screen-sharing or remote-access apps at anyone's phone instruction. This is the mechanism behind a large share of fraud where a 'customer care agent' watches you enter credentials.
Set a daily transaction limit in your app — limits are adjustable downward and lowering them costs nothing while capping your exposure.
If money is taken, call 1930 immediately, before calling your bank, then file at cybercrime.gov.in. Under RBI rules, reporting an unauthorised transaction within three working days generally gives you zero liability, and the bank bears the burden of proving customer negligence.
For disputes the app and bank do not resolve, NPCI has a dispute redressal mechanism, and the RBI Ombudsman on 14448 is free and binding after 30 days.
- Interoperable instant payments between any bank and any UPI app
- You never enter a PIN to receive money — only to send it
- No genuine institution asks for a PIN, OTP or password
- Never install screen-sharing apps at a caller's instruction
- Fraud: call 1930 first, then the bank; zero liability if reported within three working days
People also ask
Sources & provenance
Facts verified
- 1.UPI product overview and statistics OfficialNational Payments Corporation of IndiaUsed for: How UPI works, interoperability and transaction volumes
- 2.UPI safety OfficialNPCIUsed for: PIN is never required to receive money; collect request misuse
- 3.UPI dispute redressal OfficialNPCIUsed for: Escalation path for unresolved transaction disputes
- 4.Limiting Liability of Customers in Unauthorised Electronic Banking Transactions RegulatorReserve Bank of IndiaUsed for: Zero liability window and burden of proof
- 5.National Cyber Crime Reporting Portal OfficialMinistry of Home AffairsUsed for: 1930 helpline and online reporting
How UPI works, the safety rules and the dispute and liability framework come from NPCI, the RBI and the Ministry of Home Affairs as cited. Transaction limits, charges on specific transaction types and app features change. The recommendation to call 1930 before the bank is our conclusion about sequencing.
Facts on this page are taken from the sources listed above — Government of India ministries and departments, statutory authorities, regulators such as the RBI, SEBI, IRDAI and TRAI, state governments and official statistical releases. Comparisons, judgments and "which option suits whom" conclusions are AI-assisted analysis written over those sources; they are marked in the text and listed as an AI-analysis entry in the sources, not attributed to any authority. Fees, slabs, limits and processing times change, often at the start of a financial year on 1 April; figures are current as of the review date shown and should be confirmed with the responsible department before you rely on them. A great deal of Indian administration is state administration — where a rule differs by state, this site says so.