Ask someone how they lost money to UPI fraud and you'll usually hear "I don't know how, I never shared my OTP." They're telling the truth. The most common form of UPI fraud in India right now doesn't need your OTP, your PIN, or any access to your phone at all. It needs one thing: your approval on a screen that's designed to look like money coming in, when it's actually money going out.
This is the collect request scam, and understanding the one mechanical detail behind it is enough to make you immune to it.
How UPI "collect" actually works
UPI has two directions a payment can move:
- Pay: you send money to someone. You enter their UPI ID, the amount, and confirm with your PIN.
- Collect: someone requests money from you. You get a notification, and if you approve it and enter your PIN, money leaves your account and goes to them.
The "collect" feature exists for legitimate reasons — a shopkeeper requesting payment, a friend splitting a bill. The problem is that the approval screen for a collect request looks, to an unfocused eye, almost identical to the screen for receiving money. Both show a notification, an amount, and a name. The difference is a single word — "Pay" vs "Collect" — often in small text.
Scammers typically approach through OLX, Facebook Marketplace, or Instagram — anywhere people sell used items. They pose as a buyer, insist on paying via UPI "for the advance," and then send a collect request instead of a payment. It arrives with a message designed to make you stop reading and just tap "approve."
What the message actually looks like
That single line — "it will show as a collect request, just approve it" — is the entire scam. It pre-explains the red flag away before you see it, so when you do see "Collect ₹3,500," it feels expected rather than suspicious.
Why this works even on careful people
Three things make this scam unusually effective:
- It happens inside a transaction you already expect. You're mid-conversation with a "buyer," you're expecting a notification, and you're primed to approve something quickly.
- UPI apps don't make the distinction loud enough. "Approve" is the same button language regardless of direction. The amount is the biggest text on screen; the direction is not.
- PIN entry feels like a security step, not a payment step. Because we're trained to treat "enter your PIN" as the safe, verifying action, people don't register that entering it here is the transaction itself — there's no separate "receiving" action that requires a PIN at all.
You never need to enter your UPI PIN to receive money. Not once, not ever, not "just this time." If any screen asks for your PIN and you're expecting to get paid, stop and close the app. This single fact defeats the entire scam category regardless of how it's worded.
Other collect-request variations to know
- The refund scam: "I overpaid you by mistake, please refund the difference" — followed by a collect request for the "refund," which is really just a second charge.
- The customer-care impersonation: a fake support agent (often reached via a number found through a fraudulent Google search for a company's "customer care") sends a collect request framed as a refund for a complaint.
- The QR code swap: a scammer shows you a QR code to scan claiming it will send you money — scanning a QR and entering your PIN is always a payment, never a receipt.
What to actually do
- Read the verb, not just the amount: "Pay" or "Collect / Payment Request." If it says Collect and you expect to be paid, decline.
- Check your bank balance or transaction history directly — don't trust a screenshot someone sends you as "proof" of payment.
- If someone insists a request "will show as collect, just approve it" — that sentence alone is the scam. No legitimate payment requires this explanation.
- For marketplace sales, prefer meeting in person or using the platform's built-in payment protection over UPI transfers with strangers.
If you've already approved a fraudulent request
- Call your bank's fraud helpline immediately and freeze the account/UPI ID if possible.
- File a complaint on the National Cyber Crime Reporting Portal at cybercrime.gov.in, or call the national cyber helpline at 1930 — both work faster the sooner you report, since banks can sometimes halt a transfer within a short window.
- Report the scammer's UPI ID/number to your bank and to the police cyber cell.