Do not approve a UPI request you did not initiate or cannot independently verify. A UPI PIN authorizes a payment; never share it with a person, website, or AI agent, and never enter it to receive money, a refund, cashback, or a prize. Before tapping Pay, check the recipient and amount on your UPI app’s authorization screen.
How to check a pending UPI request
- Pause. Do not tap Pay or enter your UPI PIN while you are unsure. You can leave the website or agent conversation without authorizing the request.
- Open your UPI app directly. Do not rely on a website or agent’s description of what the request does. NPCI says an online merchant payment request must be opened and explicitly authorized by choosing Pay and entering the UPI PIN. NPCI’s UPI FAQ explains that a payment already initiated cannot be stopped through a stop-payment request.
- Compare the payment with what you intended. On the app’s authorization screen, check the payee name or UPI ID, the amount, and the purpose. Also ask whether you initiated the purchase or transfer. This checklist applies NPCI’s authorization guidance; it is not an official scoring system.
- Decline or leave it pending if anything does not match. Do not approve a request you did not initiate or cannot verify through a channel independent of the website or agent.
Red flags: requests to receive money or claim a reward
Be especially cautious if a website, person, or AI agent tells you to scan a QR code or enter your UPI PIN to receive money, a refund, cashback, or a prize. NPCI’s Fraud Awareness guidance says scanning a QR code and entering a UPI PIN are for making payments, not receiving them. Treat such instructions as a strong warning sign and do not proceed.
Opening an app is not the same as approving a payment
Merely opening a UPI or bank app does not approve a transaction. NPCI’s 13 January 2025 press release says the user must navigate to a payment request, choose Pay, and authorize it with a UPI PIN. Still, do not treat a request as safe just because it appears in your app: verify the recipient, amount, and purpose before authorizing it.
What to do if you already sent the money
- Contact your bank promptly. Use the support channel or phone number listed in the bank’s official app or website. You can also raise a UPI grievance through the participating app, as described in NPCI’s UPI FAQ. A completed UPI payment cannot be stopped with a stop-payment request.
- Report suspected cyber financial fraud. Use the Government of India’s National Cyber Crime Reporting Portal or call 1930. The portal also provides a route to report suspicious website URLs through its suspect reporting facility.
- Keep useful details together. Have the transaction reference, payee details, time of payment, and the relevant website URL or messages available when contacting your bank or making a report.
These reporting routes do not guarantee that a payment will be reversed or recovered. Report promptly rather than waiting for a reply from the website or agent.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
What NPCI’s UPI HELP announcement does—and does not—mean
NPCI announced a pilot called UPI HELP, an AI-powered assistant for digital-payment queries, in a circular dated 8 October 2025. The circular says participating members could offer it through channels including bank customer interfaces such as websites and chatbots. That announcement describes a support assistant; it does not certify arbitrary AI agents that initiate or explain payments. Regardless of an agent’s explanation, check the actual payment details in your UPI app before authorizing anything.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.BHIM options for managing collect requests
NPCI’s BHIM product page lists pending collect request history, transaction issue reporting, and an option to block or mark users sending illicit collect requests. These are BHIM features; other UPI apps may use different labels or offer different workflows.
Quick Recap
Best Value
- HARDWARE 2FA AND MFA: FIDO Alliance Certified FIDO2 v2.1 with CTAP2 plus legacy U2F and CTAP1 for strong two-factor login and passwordless sign-in on services that support security keys
- BUILDING ACCESS ON ONE CARD: MIFARE DESFire EV2 4K applet with AES encryption adds office door and physical access control alongside digital authentication
- CERTIFIED SECURE ELEMENT: An NXP Common Criteria EAL6+ certified secure controller and Java Card platform protects your keys on a tamper-resistant chip
- DUAL INTERFACE SMART CARD: Contactless NFC ISO 14443 plus ISO 7816 contact reader support in an ISO 7810 ID-1 format that is passive and needs no battery
- SWISS ENGINEERED DESIGN: Built by Cryptnox as a single card for authentication and access control and backed by a 2 year warranty
Rank #4
- These are 5 pcs 13.56Hz key fobs (tags). Only support the frequency 13.56MHz.
- Read only. Not re-writable. Each key fob is already pre-programmed. You cannot re-program them by a card writer.
- Great for 13.56Hz RFID proximity access control system and ID management system. For example, register them to your RFID lock as new keys if applicable.
Rank #3
- 100 encrypted contactless cards for security access control
- DESFire technology ensures secure, encrypted communication
- ISO 14443-A compliant (13.56 MHz) for compatibility with most access control systems
- Reliable, fast, and secure contactless entry
- Perfect for use in both residential and commercial settings
Rank #2
- FIDO2 CERTIFIED: FIDO Alliance Certified FIDO2 v2.1 and CTAP Level 1 for 2FA and MFA on Google Microsoft Apple GitHub login.gov AGOV SwissID and any WebAuthn service
- PASSKEY READY: Works as a hardware passkey for passwordless sign-in where the service enables it and as a U2F and WebAuthn security key everywhere else
- CERTIFIED SECURITY: NXP JCOP 4.5 secure element rated Common Criteria EAL6+ (augmented)
- TAP OR INSERT: Dual NFC ISO 14443 and contact ISO 7816 interface in an ID-1 format smart card that is passive and battery-free
- BUILT TO LAST: Passive smart card made in Switzerland designed by Swiss company Cryptnox and backed by a 2 year manufacturer warranty
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
