Prevent UPI Collect Request Scams

What Is a UPI Collect Request

The UPI collect request, also known as a pull payment, is a feature that allows one party to send a payment request to another party's UPI ID. Unlike a standard push payment where the sender initiates the transfer, a collect request requires the recipient to approve and authenticate the transaction using their UPI PIN before any money moves. This feature is legitimately used by merchants, billers, and service providers to request payment from customers. However, fraudsters have widely exploited the collect request mechanism to trick unsuspecting users into authorising payments they believe are incoming deposits rather than outgoing transfers.

How Scammers Exploit the Collect Request Feature

The most common fraud pattern involves a scammer posing as a buyer, employer, or government official who tells the victim that they are sending money. Instead of initiating a push payment, the fraudster sends a UPI collect request. When the victim receives the notification, they may mistake the request for a credit alert and enter their UPI PIN to confirm, not realising they are actually authorising a debit from their account. Scammers often accompany this with social engineering tactics, urging the victim to act quickly and assuring them the PIN entry is needed to receive the money. This misunderstanding of the collect flow is the core vulnerability these fraudsters exploit.

Common Scenarios Used in Collect Request Fraud

Collect request scams appear in several recurring situations. Online marketplace fraud is one of the most frequent, where a fake buyer contacts a seller on a classified platform, expresses interest in purchasing an item, and sends a collect request claiming it is a payment. Refund scams are another variant, where the fraudster pretends to be a customer service representative offering a refund and sends a collect request instead of a payment. Job offer scams involve fake recruiters requesting a registration fee through a collect request. In each case, the victim is manipulated into believing they are receiving money rather than authorising a transfer out of their account.

How to Identify a Fraudulent Collect Request

The single most important rule is to remember that you never need to enter your UPI PIN to receive money. A collect request is always a request to send money, not receive it. If someone tells you that entering your PIN will credit your account, it is a scam without exception. Always read the collect request notification carefully before responding. A legitimate collect request will clearly display the name of the requesting party, the amount, and a description. If the requesting VPA is unfamiliar, if the description does not match the context, or if you did not initiate a transaction that would require someone to bill you, decline the request immediately.

Steps to Decline and Block Fraudulent Requests

Most UPI applications provide a decline option for incoming collect requests. Never approve a collect request unless you are certain of its legitimacy and have independently verified the requesting party through a trusted communication channel. To block a specific VPA from sending further requests, use the block or report feature available in your UPI application. Reporting the fraudulent VPA within the app also flags the sender to the Payment Service Provider for review and potential action. If you have already fallen victim to a collect request scam, report the transaction immediately through your bank's customer care and file a complaint on the national cyber crime reporting portal.

Best Practices to Protect Yourself from Collect Request Fraud

Enable transaction notifications on your mobile device so that every UPI activity generates an immediate alert. Treat every unsolicited collect request as suspicious, especially those that arrive alongside a phone call or message claiming you are about to receive money. Verify the identity of anyone requesting payment through a collect mechanism by calling them back on an independently sourced phone number rather than the one provided in the conversation. Avoid using the same UPI ID across multiple public listings or classified platforms without adequate caution. Educating family members, particularly elderly relatives, about the collect request mechanism significantly reduces household vulnerability to this class of fraud.

What to Do If You Have Already Been Scammed

If you realise you have approved a fraudulent collect request and money has left your account, act immediately. Call your bank's customer care helpline to raise a dispute and request a freeze on further transactions if possible. File a complaint on the national cyber crime reporting portal and report the incident to the local police cybercrime cell. Provide the transaction reference number, the fraudster's UPI ID, and details of the conversation as evidence. While UPI transactions are generally irreversible, prompt reporting improves the chances of investigation and, in some cases, recovery of funds through coordinated action between banks and law enforcement.

UPI transactions are governed by NPCI guidelines. Stashfin is an RBI-registered NBFC. Please ensure transaction details are correct before confirming payment.