UPI Safety Guide: Limits, Common Scams, Wrong Payments and How to Report Fraud

UPI makes paying fast, but its speed is also what scammers use. Almost every UPI fraud works the same way: the fraudster tricks you into approving a payment yourself. This guide explains UPI limits, the scams you are most likely to meet, how to protect yourself, and exactly what to do if money has gone to the wrong place.

The key points

• You never need your UPI PIN to receive money. If an app asks for your PIN, you are paying, not receiving.
• Report any fraud at once. Call the cyber crime helpline 1930 and tell your bank.
• Most banks and apps set a limit of about ₹1 lakh per day. Your own bank or app can set a lower limit.
• Never share your PIN, OTP or card details with anyone, not even someone who says they are from your bank.

UPI limits

Type of payment	Usual limit
Normal payments to people and shops	Up to ₹1 lakh per transaction and ₹1 lakh per day
Number of transactions a day	Set by your bank and app, often around 10 to 20
Capital markets and insurance (IPO, mutual funds, premiums)	Up to ₹5 lakh per transaction, with a higher daily limit
Verified education and hospital payments	Higher limits, up to ₹10 lakh a day
UPI 123Pay on feature phones	Up to ₹10,000 per transaction

These are the limits set by the payment system. Your bank and your UPI app may set lower limits, and a new UPI user may face lower limits in the first day. Check the limit in your app’s settings or ask your bank.

The most common UPI scams

Scam	How it works	How to stay safe
“Collect request” scam	A stranger sends a request saying “you will receive ₹X, approve it”. Approving it takes money out of your account.	Never approve a collect request you did not expect. Receiving money never needs a PIN.
QR code scam	You are asked to scan a QR code to “receive” a refund or payment. Scanning a QR code is only used to pay.	Do not scan a QR code sent by a buyer or seller to receive money.
Fake customer care	You search for a helpline number online and a fake number appears. The “agent” asks for your PIN or asks you to install a remote-access app.	Use only the number printed on your bank’s official site, app or card. Never install screen-sharing apps like AnyDesk because someone asked.
Wrong payment and “return it” scam	Someone sends you money by mistake, then asks you to send it back to a different number, or the original payment is a fraud that gets reversed.	Do not return money to a number the caller gives. Ask your bank to reverse it.
Fake apps and links	A message or SMS link asks you to “update KYC” or claim a prize, and leads to a fake app or page.	Install apps only from the official app store. Ignore links that ask for KYC or PIN.
Fake payment screenshot	A buyer shows a fake “payment successful” screen.	Check your own bank SMS or app before handing over goods.

Daily habits that protect you

• Use a strong phone lock and a separate app lock for your UPI app.
• Choose a UPI PIN that is not your birth date or phone number, and never write it down on your phone.
• Before paying, check the name shown by the app against the person or shop you intend to pay.
• Pay only a small test amount first when you are paying a new person a large sum.
• Turn on SMS or app alerts for every transaction.
• Keep your mobile number linked to your bank current. If you lose your SIM or phone, ask your bank and telecom company to block it immediately.
• Do not use public Wi-Fi for payments.

If you paid the wrong person

1. Take a screenshot of the transaction. Note the date, time, amount and the UPI reference number.
2. Use the “Raise issue” or “Report” option for that transaction in your UPI app.
3. Call your bank’s customer care using the number on its official website and give the details. Ask them to contact the receiver’s bank.
4. If the receiver is someone you know, ask them politely to return it.
5. If nothing happens, complain to the bank’s nodal or grievance officer, and then to the NPCI through your app’s dispute process.

Act the same day. The sooner the bank is told, the better the chances of freezing the money.

If you are a victim of fraud

1. Call 1930, the national cyber crime helpline, or report at cybercrime.gov.in as quickly as you can. Early reports help police freeze the money before it is moved.
2. Inform your bank immediately, by phone and in writing or through the app, and ask to block your UPI and cards if needed.
3. Keep evidence: screenshots, SMS, call numbers, transaction IDs.
4. File a police complaint or FIR if the loss is large.
5. If the bank does not solve it in 30 days, complain to the RBI Integrated Ombudsman at cms.rbi.org.in.

Reporting quickly also matters for your rights. Under the RBI circular on limiting customer liability (6 July 2017), you have zero liability for an unauthorised transaction caused by a third-party breach if you report it to your bank within 3 working days of the bank’s message about it. If you report after 4 to 7 working days, your liability is capped at a fixed amount (for example ₹10,000 for most savings accounts). Beyond 7 working days it depends on the bank’s board-approved policy. If you were careless, for example by sharing your PIN or OTP, you may bear the whole loss until you report it. This is why you should report at once and never share them.

Related guides

Keep your Aadhaar and bank details safe too: read our Aadhaar guide for how to lock your biometrics.

Sources

• NPCI: UPI circulars (official source for transaction limits and rule changes)
• RBI: Limiting liability of customers in unauthorised electronic banking transactions (6 July 2017)
• National Cyber Crime Reporting Portal
• ClearTax: UPI transaction limits

Last checked: 27 October 2026. UPI limits and rules change and differ by bank and app, so confirm in your own app or with your bank. This guide is general information.