What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
An unexpected UPI collect request is asking you to approve a payment—not accept incoming money. Do not approve it or enter your UPI PIN unless you recognize the request and intend to pay. If you already authorized it or see an unexplained debit, contact your bank promptly, report it in your UPI app, and report suspected financial cyber fraud by calling 1930 or using the National Cyber Crime Reporting Portal.
What does a UPI collect request mean?
A collect request asks you to authorize a payment to the person or business shown in the request. Check the amount and payee before approving; enter your UPI PIN only when you mean to make that payment. NPCI’s UPI FAQ explains that a PIN completes payment after a collect request.
A PIN is not needed to receive money. NPCI warns that scanning a QR code and entering a UPI PIN is for making a payment, not receiving one. Do not follow instructions to scan a code, enter your PIN, share an OTP, or provide credentials to release a refund, prize, sale proceeds, or incoming transfer. See NPCI’s fraud-awareness guidance.
What should you do if the request is still pending?
- Decline or leave an unexpected, unclear, or unverified request unapproved.
- Do not share your UPI PIN, OTP, or other credentials. NPCI says bank customer support will never ask for your UPI PIN.
- Do not scan a QR code or follow a link presented as a way to receive money.
- If the request might be legitimate, verify it with the supposed sender using a separate, trusted contact method before deciding. Do not rely on contact details or links supplied in a suspicious message or call.
Simply opening a UPI or bank app does not, by itself, approve a payment. In a January 2025 clarification, NPCI said a user must go to the request, explicitly choose “pay,” and authorize it with the UPI PIN. Still inspect every request before authorizing it. NPCI
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
What should you do if you approved it or money was debited?
- Contact your bank immediately. Use a phone number or reporting channel from the bank’s official app, card, or website—not one supplied by a caller or message. Report the transaction as suspected fraud or unauthorized, ask the bank to record your complaint, and ask what steps are needed to protect the account. RBI directions require banks to provide reporting channels and act after a report.
- Report the transaction in your UPI app. Open transaction history, select the transaction, and use its help or complaint option if available. NPCI says users can raise grievances or check transaction status through their participating UPI app.
- Report suspected financial cyber fraud. Call 1930 or file a complaint through the National Cyber Crime Reporting Portal. Have the transaction ID and date, bank or wallet name, relevant UPI or account details, and screenshots ready if possible.
- Keep the evidence. Retain messages, call details, payment notifications, and complaint acknowledgements while the bank or authorities review the incident.
These channels serve different purposes: the bank handles your account and transaction report; the UPI app offers transaction-specific complaint tools; and 1930 or the portal reports suspected cybercrime. NPCI’s UPI FAQ also explains app-based grievances. NPCI’s complaint page can facilitate transaction-status complaints routed to member institutions, but says suspected fraudulent, unidentified, or unauthorized transactions should be raised with your bank.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Will the bank refund the money?
There is no guaranteed refund for every scam. RBI’s customer-protection directions make liability dependent on the circumstances and how quickly the bank is notified. If customer negligence—such as sharing payment credentials—caused the loss, the customer bears it until reporting; subsequent loss is borne by the bank. In some third-party breach cases, where neither the customer nor bank is at fault, reporting within three working days of receiving the bank’s transaction communication can qualify for zero liability. A report after three but within seven working days may mean capped liability; later reports are handled under the bank’s board-approved policy.
Rank #2
- FIDO2 CERTIFIED: FIDO Alliance Certified FIDO2 v2.1 and CTAP Level 1 for 2FA and MFA on Google Microsoft Apple GitHub login.gov AGOV SwissID and any WebAuthn service
- PASSKEY READY: Works as a hardware passkey for passwordless sign-in where the service enables it and as a U2F and WebAuthn security key everywhere else
- CERTIFIED SECURITY: NXP JCOP 4.5 secure element rated Common Criteria EAL6+ (augmented)
- TAP OR INSERT: Dual NFC ISO 14443 and contact ISO 7816 interface in an ID-1 format smart card that is passive and battery-free
- BUILT TO LAST: Passive smart card made in Switzerland designed by Swiss company Cryptnox and backed by a 2 year manufacturer warranty
The directions also provide for a shadow credit within 10 working days in qualifying zero- or limited-liability cases. These are conditional rules, not a promise that a particular social-engineering payment will be reimbursed. If you knowingly entered your PIN but were deceived about why you were paying, report the transaction promptly and ask the bank to assess it under the applicable rules; do not assume either that it automatically qualifies as unauthorized or that recovery is impossible.
Quick Recap
Best Value
- HARDWARE 2FA AND MFA: FIDO Alliance Certified FIDO2 v2.1 with CTAP2 plus legacy U2F and CTAP1 for strong two-factor login and passwordless sign-in on services that support security keys
- BUILDING ACCESS ON ONE CARD: MIFARE DESFire EV2 4K applet with AES encryption adds office door and physical access control alongside digital authentication
- CERTIFIED SECURE ELEMENT: An NXP Common Criteria EAL6+ certified secure controller and Java Card platform protects your keys on a tamper-resistant chip
- DUAL INTERFACE SMART CARD: Contactless NFC ISO 14443 plus ISO 7816 contact reader support in an ISO 7810 ID-1 format that is passive and needs no battery
- SWISS ENGINEERED DESIGN: Built by Cryptnox as a single card for authentication and access control and backed by a 2 year warranty
Rank #4
- These are 5 pcs 13.56Hz key fobs (tags). Only support the frequency 13.56MHz.
- Read only. Not re-writable. Each key fob is already pre-programmed. You cannot re-program them by a card writer.
- Great for 13.56Hz RFID proximity access control system and ID management system. For example, register them to your RFID lock as new keys if applicable.
Rank #3
- 100 encrypted contactless cards for security access control
- DESFire technology ensures secure, encrypted communication
- ISO 14443-A compliant (13.56 MHz) for compatibility with most access control systems
- Reliable, fast, and secure contactless entry
- Perfect for use in both residential and commercial settings
Who should you contact?
| Route | When to use it | Purpose |
|---|---|---|
| Your bank | Immediately if you suspect an unauthorized debit or approved a suspicious payment | Record the report, assess the transaction, and advise on account protection and next steps |
| Your UPI app | For a specific transaction or its status | Submit a transaction complaint through the app’s help or grievance feature |
| 1930 or cybercrime.gov.in | When you suspect financial cyber fraud | Report suspected cybercrime to the national helpline or portal |
| NPCI complaint page | For eligible transaction-status complaints routed to member institutions | Facilitate status-related complaints; suspected fraudulent or unauthorized transactions should go to your bank |
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
