UPI Collect Request Fraud: What to Do If You Approved One

"A buyer said he would send money for my old sofa, a request popped up, I entered my PIN, and ₹15,000 went out of my account." If this just happened, call 1930 or file at cybercrime.gov.in now, then report the transaction to your bank's 24x7 fraud line. Speed is what gives the fraudster's bank time to freeze the money.

The trick works because a collect request looks like a payment notification. It is not. A collect request asks you to pay, and your UPI PIN is the signature that releases the money. This guide covers how the scam works after NPCI's 2025 change, what you can recover as of October 2026, and the exact complaint to send. For a wider view of UPI frauds, see our guide on UPI scams and what to do.

How a collect request works, and why the scam works

UPI has two ways to start a payment:

NPCI's circular dated 29 July 2025 told banks and UPI apps not to initiate, route or process person-to-person collect transactions after 1 October 2025, citing fraud. Before that, P2P collect requests were capped at ₹2,000 each, but scammers simply sent many. Merchant collect requests continue, for example when a shopping or travel site asks you to approve a payment in your UPI app.

The scam has adapted rather than disappeared. Common forms now:

• Fake merchant requests. A fraudster uses a merchant account (sometimes a mule business) to send a request labelled "refund", "cashback" or "KYC fee".
• "Scan to receive" QR codes. Sent over chat for an OLX-style sale or a "prize". Scanning and entering a PIN pays the fraudster.
• Payment links that open your UPI app with an amount pre-filled.
• Fake customer care that walks you through "approving a refund" while you are actually approving a payment.

The rule that defeats all of them: you never enter a UPI PIN to receive money.

Step-by-step: what to do

In the first hour

1. Call 1930 or file at cybercrime.gov.in. The National Cyber Crime Reporting Portal alerts the banks involved so they can try to place a hold on the money. Note the acknowledgement number.
2. Report to your bank through its fraud helpline, app or net banking. Banks must offer 24x7 reporting channels. Ask for a complaint reference number.
3. Raise a dispute in the UPI app on that exact transaction, choosing "fraud" or "unauthorised" as the reason.
4. Block the sender from the request screen in your app, and do not reply to further messages.
5. Change your UPI PIN if you typed it anywhere other than your own UPI app, and uninstall any app the fraudster asked you to download.

On the first day

6. Collect evidence: screenshots of the request (sender name and UPI ID), the chat or call log, the advertisement or listing, the 12-digit UPI reference number and your bank SMS.
7. Report the phone number on the Sanchar Saathi portal's Chakshu facility so the number can be checked and blocked.
8. File a police complaint if your bank or the cybercrime portal asks for one, especially for larger amounts.

If it is unresolved

9. Write to the bank's grievance or nodal officer with your 1930 acknowledgement and dispute number.
10. Escalate in the UPI system in NPCI's order: UPI app, its partner bank, your bank, then NPCI.
11. Approach the RBI Ombudsman at cms.rbi.org.in if the bank rejects your complaint or does not respond within 30 days. Under the Integrated Ombudsman Scheme, 2026, file within 90 days of the bank's last reply or response deadline, whichever is later.

What you can recover under RBI rules

Be prepared for a hard truth: approving a request with your own PIN is usually treated differently from a hacked account.

For transactions up to 31 December 2026, RBI's 2017 customer liability framework applies. If the loss is due to your own negligence, such as sharing or entering your PIN on a fraudster's request, you bear the loss until you report it. Recovery then depends mainly on the cybercrime system freezing the money in the receiving account, which is why reporting within the first hour matters so much.

For transactions from 1 January 2027, RBI's Commercial Banks (Responsible Business Conduct) Third Amendment Directions, 2026, issued on 24 June 2026, change the picture:

• A "fraudulent" transaction explicitly includes one approved by the customer under coercion or deception, not just unauthorised ones.
• The burden of proving customer liability lies on the bank.
• Even where you were negligent, a one-time compensation is available: for a gross loss up to ₹50,000, the lesser of 85% of the net loss or ₹25,000, once in a lifetime. You must report to 1930 or cybercrime.gov.in and to your bank within five calendar days, and the bank must pay within five calendar days of your application. This applies to frauds in the first year of the new rules.
• Banks must decide your complaint within 45 calendar days for domestic fraud.

Similar directions were issued for small finance banks, regional rural banks and urban co-operative banks. Your bank's customer protection policy, published on its website, sets out the details.

Worked example

Anil is selling a used cycle online. On 20 January 2027, a "buyer" sends a request through a merchant handle labelled "Payment for cycle, approve to receive". Anil enters his PIN. ₹18,000 leaves his account.

• He reports to 1930 and to his bank the same evening, well within five calendar days.
• Suppose the cybercrime system freezes ₹6,000 still lying in the receiving account and it is returned. His net loss is ₹18,000 − ₹6,000 = ₹12,000.
• Compensation is the lower of 85% of ₹12,000 (₹10,200) and ₹25,000, so ₹10,200.
• Anil's final loss: ₹12,000 − ₹10,200 = ₹1,800.

Had the same thing happened in November 2026, the old framework would apply. Anil would likely recover only the ₹6,000 frozen, leaving a ₹12,000 loss. Either way, the first hour decides how much can be frozen. (Figures are illustrative; actual compensation depends on the bank's verification.)

Ready-to-copy complaint message

Subject: Fraudulent UPI transaction via collect/payment request - Ref [UTR]

Dear Sir/Madam,

On [date] at [time], Rs [amount] was debited from my account ending
[last 4 digits] through a UPI request sent by [sender name / UPI ID].
UPI Reference (UTR/RRN): [number].

I was deceived into approving this request. The sender claimed I would
[receive payment / get a refund / get cashback]. I did not intend to pay.

I reported this on the National Cyber Crime Reporting Portal / 1930 on
[date, time]. Acknowledgement number: [number].

Please:
1. Treat this as a fraudulent transaction and request the beneficiary bank
   to freeze and return the funds.
2. Block further debits through UPI on my account if required.
3. Confirm my liability and any reversal or compensation due under the
   RBI customer liability rules and your customer protection policy.

Evidence attached: screenshots of the request, chat and SMS.

Name: [your name]   Registered mobile: [number]

What not to do

• Do not enter your UPI PIN on any request you did not start. Decline it.
• Do not trust the request's label. Fraudsters type "refund", "receive" or "cashback" in the note field.
• Do not wait to see if it reverses. Approved UPI payments do not reverse on their own.
• Do not pay a "recovery agent" or "cyber lawyer" who contacts you promising to get the money back for a fee. That is often a second scam.
• Do not share the 1930 acknowledgement or bank details with callers claiming to be police or bank staff; follow up only through official channels.
• Do not delete chats or call logs. They are your evidence.

If the request was for a recurring mandate rather than a one-time payment, see our guide on cancelling a UPI AutoPay mandate. Keeping only day-to-day spending money in your UPI-linked account, and your emergency fund in a separate account or fixed deposit (plan it with our FD calculator), also limits what any one mistake can cost.

Key takeaways

• A collect request asks you to pay. Your UPI PIN always sends money; it is never needed to receive it.
• NPCI stopped person-to-person collect requests from 1 October 2025; merchant requests remain, and fraudsters now pose as merchants or use QR codes and links.
• Report to 1930 or cybercrime.gov.in and your bank within the hour to maximise the chance of a freeze.
• Up to 31 December 2026, a PIN-approved scam is usually your loss; from 1 January 2027, a one-time compensation of up to ₹25,000 applies to small frauds reported within five calendar days.
• Escalate through the bank's grievance officer, then the RBI Ombudsman within 90 days.