UPI Fraud and Cyber Safety: A Guide for Students

Key takeaways

Entering your UPI PIN always sends money. You never need a PIN, QR scan or approval to receive money.
Never share OTPs, never install apps or APK files sent by strangers, and take helpline numbers only from official apps or websites.
Any job, scholarship or course that asks you to pay to "release" money or confirm selection is a red flag.
If money is taken, call 1930 and report on cybercrime.gov.in immediately, then inform your bank and save all evidence.

Students and first-time job seekers are a favourite target for online fraudsters. You use UPI every day, you are looking for part-time work, you apply for scholarships and courses online, and you may not yet know how scams are set up. Almost every UPI fraud depends on one thing: getting you to approve a payment, share a code or install an app. This guide explains how the common scams work, the settings that protect you, and exactly what to do — minute by minute — if money is taken.

Five rules that stop most UPI fraud

Remember these before anything else

You never need your UPI PIN to receive money. If anyone asks you to enter your PIN "to receive" a payment, it is a scam. Entering the PIN always sends money out.
Never share an OTP with anyone — not a "bank officer", not "customer care", not a "company HR". Banks do not ask for OTPs on calls.
Scanning a QR code is for paying, not for receiving.
Never install apps from links sent on WhatsApp, SMS or by a caller — especially files ending in .apk, and never screen-sharing apps at a stranger's request.
Get customer care numbers only from the official app or website of the bank or company, not from search results, social media comments or forwarded messages.

How a UPI payment actually works

Understanding the basics makes the tricks obvious. In UPI, there are only two ways money moves:

You pay: you scan a QR code, enter a UPI ID or mobile number, or approve a "collect request" — and then you enter your UPI PIN. The PIN is your signature for sending money.
You receive: someone sends money to your UPI ID or number. You do nothing. No PIN, no QR scan, no approval.

A collect request (also shown as "payment request" or "request money") is a message asking you to pay. It appears in your UPI app with an "Approve/Pay" button. Fraudsters send collect requests and tell you it is a refund, a prize or a buyer's payment. If you approve and enter your PIN, money leaves your account.

The scams students meet most often

Scam	How it works	Warning sign
"Buyer" on an online marketplace	You list a used phone or books. A "buyer" agrees instantly, then sends a QR code or collect request "to send you the money".	Any request to scan, approve or enter a PIN to receive payment.
Part-time "task" job	A message offers money for liking videos or writing reviews. You get small payments at first. Then you must "invest" or "recharge" to unlock bigger tasks, and the money disappears.	Being paid for very easy work, then being asked to deposit money.
Job offer with a fee	"You are selected" for a job you barely applied to. Pay for registration, training kit, uniform or verification.	Paying to get a job, interviews only on chat, personal UPI IDs for "company" fees.
Scholarship or course "processing fee"	A call says your scholarship is approved and you must pay a small fee or share an OTP to release it.	Government scholarship portals do not ask you to pay to release funds.
"Sent by mistake"	You get an SMS that looks like a credit, then a call begging you to return "wrong" money — often via a collect request.	Check your actual bank balance in the bank app; fake credit SMS are common.
Fake customer care	You search for a helpline, call a number from a fake listing, and are told to install an app or share an OTP for a "refund".	Any "support" person asking for OTP, PIN or a screen-sharing app.
Malicious APK	A WhatsApp file named like a challan, wedding card, bill or bank update. Installing it can let criminals read your SMS and OTPs.	Any app sent as a file instead of from the official Play Store or App Store.
"Digital arrest" and police threats	A video call from someone in uniform claims a parcel in your name had drugs, or your Aadhaar was misused, and demands money to "clear" your name.	Real police and agencies do not arrest people over video calls or ask for money transfers to settle cases.
KYC update SMS	"Your account will be blocked today, update KYC" with a link to a fake bank page.	Urgency plus a link. Banks ask you to visit the branch or use the official app.

All of these share three features: urgency ("today only", "account will be blocked"), a request for a code, PIN or app install, and a reason you should not tell anyone. If you see all three, stop.

Job and internship scams in more detail

Because students are actively looking for work, fake job offers deserve extra attention. Before you respond to any offer, check:

Did you actually apply to this company? Search the company's official website and check whether the job is listed there.
Is the email from the company's own domain, not a free email address?
Was there a real interview with questions about your skills, or only a chat?
Are you asked to pay anything — registration, training, laptop, uniform, security deposit? Genuine employers do not charge you to hire you.
Is the salary unusually high for little work or no experience?
Are you asked to share your bank login, UPI PIN, or to receive and forward money? Receiving and forwarding money for others can make you part of a crime as a "money mule".

For genuine job searches, use official platforms such as the National Career Service portal, and for apprenticeships the official apprenticeship portal described in our NAPS guide.

Never lend your bank account

Some "jobs" pay you a commission to let money pass through your account, or to hand over your bank kit, SIM or UPI login. This money is usually from fraud victims. Accounts used this way can be frozen and the account holder may face police inquiry. Refuse, however friendly the person seems.

Phone and app settings that protect you

Screen lock: Set a PIN, pattern or fingerprint on your phone. Do not use 1234 or your birth year.
App lock on UPI apps: Turn on the app's own lock (fingerprint or PIN) in its settings, so a borrowed phone cannot be used to pay.
Different PINs: Your UPI PIN, ATM PIN and phone lock should all be different.
Install only from official stores: In Android settings, keep "Install unknown apps" turned off for WhatsApp, browsers and file managers.
Update regularly: Install Android/iOS updates and update your banking apps from the store.
Two-step verification on WhatsApp: Turn it on in WhatsApp settings so nobody can take over your account with an OTP alone.
Check SMS alerts: Make sure your bank sends SMS or app alerts for every transaction, and read them.
Review UPI app permissions and linked accounts every few months and remove anything you do not recognise.

Check mobile numbers registered in your name

The Department of Telecommunications' Sanchar Saathi portal lets you check which mobile connections are registered against your identity and report ones that are not yours. It also has a facility to report suspected fraud calls and messages, and to request blocking of a lost or stolen phone. Check the portal for the current list of services.

Safe habits on shared computers and public Wi-Fi

Many students use computers at cyber cafes, institutes or libraries to fill forms. Follow these habits:

Never tick "Remember me" or let the browser save passwords on a shared computer.
Log out of email, scholarship portals and banking sites, then close the browser completely.
Do not leave downloaded documents (Aadhaar, marksheets) in the Downloads folder. Delete them and empty the recycle bin.
Avoid doing banking on free public Wi-Fi. Use your mobile data instead.
Check the website address carefully before entering details. Government portals usually end in .gov.in or .nic.in.

If you lose money: what to do in the first hour

Speed matters. The faster a fraud is reported, the better the chance that the money can be frozen before it is withdrawn. Do these steps in order, without waiting.

Call 1930. This is the national cyber crime helpline for reporting financial fraud. Give your name, mobile number, bank, transaction ID (UTR / UPI reference), amount, date and time, and the fraudster's UPI ID or number.
Report online at cybercrime.gov.in (the National Cyber Crime Reporting Portal). Choose the option to report financial fraud and fill in all transaction details. Note your acknowledgement or complaint number.
Call your bank's official helpline (from the back of your debit card or the bank's official app) and ask them to block UPI, debit card and net banking if needed. Ask for a complaint reference number.
Raise a complaint inside your UPI app for the specific transaction as well.
Change your UPI PIN, net banking password and email password from a safe device, and uninstall any app the fraudster asked you to install.
Save evidence: screenshots of chats, call logs, transaction screens, SMS, the fraudster's profile and numbers. Do not delete the conversation.
Visit the nearest police station or cyber cell if asked, with printouts of your complaint and evidence.

Why reporting to your bank quickly matters

RBI rules on customer liability for unauthorised electronic transactions depend on how quickly you report the transaction to your bank. Reporting immediately — and in any case within three working days — gives you the strongest protection. If an unauthorised transaction happened because you shared your PIN or OTP, you may have to bear the loss until you report it. If your bank does not resolve your complaint, you can approach the RBI's complaint management system. Read the RBI's official guidance for the exact current rules.

Template: details to keep ready before calling 1930

Detail	Where to find it
Transaction / UTR reference number	Transaction details screen in your UPI app, or bank SMS
Date, time and amount of each debit	Bank SMS or app transaction history
Your bank name and account (last 4 digits)	Bank app or passbook
Fraudster's UPI ID, phone number, website or profile link	Your UPI app history, call log, chat screenshots
Short description of what happened	Write 4–5 lines while you remember clearly

Beware of "recovery" scams after fraud

After someone loses money, they are sometimes contacted by people claiming they can recover it for a fee — fake lawyers, fake cyber cell officers or "hackers". These are second scams. Genuine complaints are handled through 1930, the cybercrime portal, your bank and the police. No genuine official asks you to pay a fee to get your money back.

Help your family stay safe

Parents and grandparents are often targeted too, especially with fake KYC, electricity bill and "your son is in trouble" calls. Spend ten minutes teaching them the five rules at the top of this page. Save 1930 in their phone contacts. Agree on a simple family rule: before any urgent payment to anyone, call a family member first.

1930 saved in every family phone
Screen lock and app lock turned on
Bank SMS alerts working
No unknown apps installed; "Install unknown apps" turned off
WhatsApp two-step verification on
Everyone knows: receiving money never needs a PIN

Being careful online is now a basic job skill. Employers expect office staff to recognise phishing emails and suspicious links. Our basic computer skills checklist includes safe internet habits along with other skills you need at work.

Frequently asked questions

What is the cyber crime helpline number in India?

1930 is the national helpline for reporting cyber financial fraud. You can also file a complaint online on the National Cyber Crime Reporting Portal at cybercrime.gov.in.

Do I need to enter my UPI PIN to receive money?

No. Receiving money through UPI never needs your PIN. If someone asks you to enter your PIN, scan a QR code or approve a request to receive money, it is a scam.

Can I get my money back after a UPI fraud?

Sometimes, if the money is still in the receiving account when it is reported. That is why you should call 1930, report on cybercrime.gov.in and inform your bank as quickly as possible. Recovery is not guaranteed.

How do I know if a job offer is fake?

Warning signs include being selected without a proper interview, being asked to pay any fee, communication only through chat apps, unusually high pay for simple work, and requests to use your bank account to receive and forward money.

Is it safe to install apps sent on WhatsApp?

No. Apps sent as files, especially .apk files, can steal your SMS and OTPs. Install apps only from the official Play Store or App Store, and keep the option to install unknown apps turned off.

Official sources & further reading

Government portals change their rules, fees and steps from time to time. Always confirm current details on the official website before you apply.

Nipun India Academic Team writes and reviews Learning Center guides using the same syllabus our training centers teach. First published 10 Oct 2026, last reviewed 10 Oct 2026. Read our editorial policy or report a correction.