A UPI collect request scam works like this: a fraudster sends you a "collect" (pull) request through your UPI app, disguised to look like money coming to you. If you tap Approve and enter your UPI PIN, you are actually authorising a payment out of your account. The single rule that stops this scam every time: receiving money never, ever requires your UPI PIN. If any screen asks for your PIN before money can "arrive," stop immediately — close the app, do not enter anything.
If this is happening to you right now: do not enter your PIN. Decline or ignore the request. If you already entered it and money has left your account, skip to the recovery section below and call 1930 immediately.
What a collect request actually is
UPI (Unified Payments Interface, the tap-to-pay system run by NPCI) has two different actions that look almost identical on your phone but do opposite things:
- A "pay" request — you choose to send money. You enter your PIN. Money leaves your account.
- A "collect" request — someone else asks your app to pull money from your account. You still
A collect request is a completely normal, legitimate UPI feature — a shopkeeper or a friend can send you one for a genuine reason ("send me the money you owe" style requests). The scam is not the feature. The scam is scammers relying on the fact that most people don't read the direction of the request carefully, and the notification on your phone can look exactly like a routine payment alert at a glance.
not a suspicious link. It is a standard UPI feature being used against you by someone who is counting on you to skim the notification and tap Approve without reading it.
How the scam actually works
The scam nearly always starts on a marketplace, classifieds site, or social media — somewhere a stranger has a reason to talk to you about a payment.
A typical version goes like this:
- You are selling something online — a used phone, furniture, a scooter, concert tickets — on
- A "buyer" contacts you, is friendly and eager, and says they want to pay you right now via
- They ask for your UPI ID (your VPA — Virtual Payment Address, the yourname@bank handle) so they
- Instead of sending money, they send you a collect request for that amount — sometimes for
- Your phone shows a notification. It often just says something like "collect request" with an
- You open the app to "accept the payment" and are shown a screen with an Approve button and a
- You enter your UPI PIN thinking you are confirming receipt. The moment you do, the transaction
- The scammer stops replying. The item is never paid for. The money is gone.
In every version, the mechanism is identical: **a request arrives inside your own UPI app, it is made to look like an incoming credit, and your PIN entry is what actually authorises money to leave.**
send you money. If receiving a payment ever requires you to type a PIN, it is not a payment coming to you — it is a payment being taken from you.
The red flags
| What you see | What it usually means |
|---|---|
| A stranger insists on paying you first, before you hand over goods | Common setup for a collect-request scam |
| Notification says "request" or "collect" rather than "received" | It is a pull request — approving it sends money OUT |
| App asks you to enter your UPI PIN to "receive" money | This should never happen — decline immediately |
| Buyer pressures you to "just approve it quickly" or "check your phone now" | Urgency is designed to stop you from reading the screen carefully |
| Amount on the approval screen doesn't match what was agreed, or is oddly precise | Sign of a collect request rather than a real credit |
| Message claims to be a refund, cashback, KYC check, or "verification" needing approval | Same mechanism, different story |
Know your vulnerabilities before attackers do
Run a free VAPT scan — takes 5 minutes, no signup required.
Book Your Free ScanIf it is happening right now
- Do not enter your UPI PIN. No exceptions, no matter what the message says.
- Read the screen again, slowly. Does it say "pay," "approve," or ask for a PIN? Genuine incoming
- Decline or ignore the request. Most UPI apps let you decline a collect request outright — do
- Stop talking to the "buyer." If they push back or get aggressive when you refuse to approve
- Verify independently if you're unsure. Call your bank on the number printed on your card or
- Never share your UPI PIN, OTP, or app screen with anyone over a call or screen-share app,
If you have already approved it and money is gone
Speed decides whether this money can be recovered. Do these in order, right now.
- Call 1930 immediately — this is the National Cyber Crime Helpline, run under the Ministry of
- File a complaint at
https://cybercrime.gov.in— this is the National Cyber Crime Reporting
- Call your bank's fraud/customer care number (from the back of your card or the bank's
- Preserve every piece of evidence: screenshots of the chat with the scammer, the collect
- Report the listing on the marketplace or platform where contact was made, so the account can
single most useful piece of information for both your bank and the cybercrime portal to trace and potentially freeze the funds.
How to protect family, especially elderly parents
Older family members are frequent targets because they may be less familiar with the difference between "pay" and "collect" screens, and are often taught simply to "approve" whatever their phone shows them without reading it closely.
- Sit with them once and show the actual difference between a Pay screen and a Collect/Request
- Tell them plainly: "No one ever needs your PIN to send you money. Ever." Repeat this exact
- Ask them to call you (or another trusted family member) before approving any UPI request from
- Turn on SMS/app transaction alerts if they aren't already on, so any movement of money is visible
- If they use UPI to sell items online, suggest they ask buyers to send money as a normal "pay"
collect request"] --> B["Notification looks
like incoming payment"] B --> C{"Victim reads
the request?"} C -->|"Approves and
enters PIN"| D["Money debited
from victim"] C -->|"Reads direction
carefully"| E["Declines the
request"] C -->|"Remembers PIN
rule"| F["Never needed to
receive money"] style A fill:#5f1e1e,stroke:#EF4444,color:#e2e8f0 style B fill:#5f1e1e,stroke:#EF4444,color:#e2e8f0 style D fill:#5f1e1e,stroke:#EF4444,color:#e2e8f0 style E fill:#1e3d2f,stroke:#10B981,color:#e2e8f0 style F fill:#1e3d2f,stroke:#10B981,color:#e2e8f0
This research is published by Bachao.AI, built by Dhisattva AI Pvt Ltd, as part of an ongoing effort to explain common India-specific digital fraud patterns in plain language. This particular scam does not involve scanning a QR code or opening a payment link, so there is no scanning tool that applies here — the defence is entirely about reading the request correctly and remembering the PIN rule above.
Related reading
For other UPI-related frauds and more scam breakdowns, see the blog at /blog. For official
guidance on UPI safety, RBI's consumer awareness pages at https://www.rbi.org.in and NPCI's own
UPI safety information at https://www.npci.org.in are useful references, as is
https://www.cert-in.org.in for broader cyber-safety advisories.