Loading...
Loading...
How UPI actually moves money between banks, and the one rule that keeps it safe.
UPI (Unified Payments Interface) has become the default way most Indians move money — over ten billion transactions happen through it every month. But most people use it without ever understanding what actually happens between tapping "Pay" and the money landing in someone else's account. Understanding the mechanics makes it much easier to spot when something's gone wrong, and why UPI is built to be as safe as it is.
UPI is a payment system built and operated by the National Payments Corporation of India (NPCI), a not-for-profit entity set up by the RBI and Indian banks. This matters because UPI isn't owned by Google Pay, PhonePe, or Paytm — those are just apps (called Third-Party App Providers, or TPAPs) that plug into the same underlying NPCI infrastructure. Your money always moves bank-to-bank; the app is simply the interface you use to authorize it.
Because every app ultimately routes through the same NPCI rails, a payment from a Google Pay user to a PhonePe user works exactly the same way as a payment between two Google Pay users — there's no separate "network" for each app the way there is with, say, different card networks.
A UPI ID, or Virtual Payment Address (VPA), is a unique identifier like yourname@bankname that maps to your actual bank account without ever exposing your account number or IFSC code to the person you're paying. When someone sends money to your UPI ID, NPCI's system looks up which bank and account that VPA is linked to and routes the transaction there.
You can have multiple UPI IDs across different apps, all pointing to the same or different bank accounts, and you can change or add UPI IDs at any time without affecting your actual account. Your registered mobile number can also serve as a UPI identifier in some apps, but the VPA remains the primary addressing system underneath.
The entire process typically completes in under 5 seconds, and unlike older methods like NEFT, it works 24/7, including weekends and holidays — there's no "banking hours" concept for UPI.
Not all QR codes work the same way, and knowing the difference matters for spotting fraud:
| QR Type | How It Works | Where You'll See It |
|---|---|---|
| Static QR | Fixed code tied to a VPA; you enter the amount yourself after scanning | Small shops, street vendors, printed stickers at a counter |
| Dynamic QR | Generated fresh for each transaction with the amount pre-filled | Larger retail billing counters, e-commerce checkout |
A common fraud pattern involves someone pasting a fake static QR sticker over a legitimate merchant's QR code, redirecting payments to a scammer's account. Merchants and customers verifying the displayed name after scanning — before confirming payment — catches most of these.
Besides sending money directly, UPI supports "collect requests" — where someone requests money from you, and you approve or decline it. This feature is legitimate and widely used (for example, splitting a bill), but it's also the basis for most UPI scams, because approving a collect request authorizes money to leave your account, not enter it.
Scammers exploit this by sending a collect request disguised as something else — a refund, a cashback, or a prize claim — hoping the victim approves it without reading carefully. The description field on a collect request can say anything the sender wants; it has no bearing on what the transaction actually does.
| Safety Feature | What It Does |
|---|---|
| Two-factor authentication | Requires both your phone (registered device) and your UPI PIN — neither alone is enough to authorize a payment |
| PIN never shared with the recipient | Your UPI PIN stays on your device and is never transmitted to the person you're paying |
| Device binding | UPI is linked to your specific registered mobile number and SIM, making it harder to use from an unauthorized device |
| No card or account number exposure | Payments happen via VPA, so your actual bank account number is never shared with the payee |
| Transaction limits | Daily and per-transaction caps limit maximum exposure if something does go wrong |
The one thing that breaks all of this: sharing your UPI PIN with someone else, or entering it to receive money. A UPI PIN is only ever needed to send or authorize a payment — no legitimate reason exists to enter it when someone is supposedly paying you.
| Method | Availability | Speed | Typical Use |
|---|---|---|---|
| UPI | 24/7, instant | Seconds | Everyday payments, up to ₹1 lakh typically |
| IMPS | 24/7, instant | Seconds to minutes | Instant transfers, higher limits than UPI at some banks |
| NEFT | 24/7 (batch-processed) | Within 30 minutes to a few hours | Larger transfers, no strict upper limit |
| RTGS | 24/7, real-time | Near-instant | High-value transfers, minimum ₹2 lakh |
1. Entering your UPI PIN to "receive" money. Receiving money never requires a PIN — if an app or person asks you to enter your PIN to get a payment, it's a scam, not a real transaction.
2. Approving collect requests without reading the amount and requester carefully. The description field can say anything; always check the actual amount and sender before approving.
3. Scanning QR codes from unverified sources to receive payment. Scanning a QR code is for sending money, not receiving it — a legitimate payment to you doesn't require you to scan anything.
4. Sharing your UPI PIN with anyone, including "bank support." No bank or app support representative will ever genuinely need your UPI PIN over a call or message.
5. Not verifying the payee name shown after scanning a merchant QR. A pasted-over fake QR sticker will often show a mismatched or unfamiliar name — check before confirming.
6. Forgetting about active UPI Autopay mandates. Old subscription mandates can keep auto-debiting long after you've stopped using the service — periodically reviewing active mandates in your UPI app avoids this.
Key Takeaway: UPI works by routing payments directly between banks through NPCI's shared infrastructure, using your UPI PIN as the one thing that authorizes money to leave your account — never to receive it. Collect requests, QR codes, and Autopay mandates all follow this same rule, and understanding it alone would prevent most UPI fraud. Next, see Net Banking vs Mobile Banking — Security Basics.
Yes, a feature called *99# lets you make basic UPI transactions over a simple USSD code from any phone, even without internet, though most people use the app-based experience with internet access.
Once authorized, a UPI transaction generally can't be reversed automatically. You'd need to contact your bank or the recipient's bank quickly and request a reversal, which isn't guaranteed if the recipient doesn't cooperate.
Yes, this is a standard feature, letting you choose which account to pay from at the time of each transaction, without any added security risk from linking multiple accounts.
The PIN authorization step is required for every transaction regardless of amount, since it's the core security mechanism confirming that you — not someone else with your phone — approved the payment. UPI Lite is the one exception, using a preloaded on-device balance for small payments.
Personal UPI transactions are free for users in India — banks and apps don't charge individuals for standard peer-to-peer or merchant UPI payments.
UPI is expanding internationally through partnerships in select countries (like Singapore and the UAE), but it isn't a universal option yet — most cross-border payments still require other methods like wire transfers or international cards.
Disclaimer: This article is for general educational purposes only and does not constitute personalized financial, investment, tax, or legal advice. Figures, rates, and rules mentioned may change over time — verify current details with an official source or a qualified professional before making financial decisions.