UPI Guide: Limits, Security and Best Practices (India, 2026)
How UPI works, the real 2026 transaction limits for P2P, merchants, UPI Lite and Autopay, why P2P UPI is free, and the security rules including collect request bans that protect you from India's most common payment scams.
Contents▾
- 1. How UPI actually works
- 2. UPI transaction limits in 2026
- 3. Is UPI actually free?
- 4. UPI Lite and 123Pay: what they are for
- 5. The scam: "scan this QR to receive money"
- 6. Other UPI-adjacent scams to know
- 7. What should you do if you already got scammed?
- 8. How do you keep your UPI app secure day to day?
- Related Guides
- Disclaimer
Say your phone buzzes with a payment request that says "Tap to receive your refund of ₹2,000." You are mid-conversation, distracted, and it looks exactly like every other UPI notification you get five times a day. You tap it, enter your UPI PIN like you always do to complete a transaction, and ₹2,000 leaves your account instead of arriving in it. That single tap is one of the most common frauds in India today, and understanding why it works is the difference between losing money and never falling for it.
This guide covers how UPI actually works, the real transaction limits in 2026, what is free and what is not, and the security rules that will protect you from the scams that are actually happening right now.
1. How UPI actually works
UPI (Unified Payments Interface) links your bank account to a UPI ID or QR code, so you can send or receive money instantly, 24x7, without knowing the other person's account number or IFSC code. It runs on NPCI's (National Payments Corporation of India) infrastructure and sits on top of your actual bank account, it does not hold your money itself, your bank does.
Every UPI payment you make requires your UPI PIN. Every UPI payment you receive requires nothing from you at all. That one asymmetry is the single most important fact in this entire guide, and it is what almost every UPI scam tries to exploit.
Core rule: your UPI PIN exists to authorise you sending money. It has no role whatsoever in receiving money. If entering a PIN is ever presented to you as a step to "receive" a payment, it is a lie.
2. UPI transaction limits in 2026
Limits are not one flat number, they depend on what kind of payment you are making and to whom.
| Transaction type | Per transaction limit | 24 hour cap |
|---|---|---|
| P2P (person to person) | ₹1 lakh | Bank-specific, often ₹25,000 to ₹1 lakh |
| P2M (person to merchant), general | Up to ₹2 lakh (NPCI ceiling) | Most banks cap policy at ₹1 lakh |
| Verified merchant: capital markets, insurance, government payments, travel, loan collection | ₹5 lakh | ₹10 lakh |
| Verified merchant: credit card bill payment | ₹5 lakh | ₹6 lakh |
| Verified merchant: forex via BBPS, digital account/term deposit opening | ₹5 lakh | ₹5 lakh |
| Verified merchant: jewellery | ₹2 lakh | ₹6 lakh |
| UPI Lite | ₹1,000 per transaction | ₹5,000 wallet balance |
| UPI 123Pay (feature phones) | ₹10,000 per transaction | - |
| UPI Autopay / e-mandate (general) | ₹15,000 | - |
| UPI Autopay: mutual fund SIPs, insurance premiums, credit card bills | ₹1 lakh | - |
The higher merchant limits (₹2 lakh to ₹5 lakh) came from an NPCI circular effective 15 September 2025, and they apply only to verified merchant categories, not to ordinary person-to-person transfers, which remain capped at ₹1 lakh. Your individual bank may also set its own lower daily cap on top of the NPCI ceiling, so check your specific bank's app if you are near a limit.
A note on "hospital and education limits": you may see claims online that hospitals or education payments get a dedicated ₹5 lakh UPI limit. This is not confirmed in the official NPCI circular, those payments fall under general merchant category limits. Do not assume a specific higher limit exists for these without checking directly with your bank first.
3. Is UPI actually free?
Yes. Ordinary bank-account UPI, both sending and receiving, is completely free for you as a user. There is no MDR (merchant discount rate) charged to you on standard bank-account UPI transactions. The only fee that exists in the UPI ecosystem is a small interchange fee on wallet or prepaid-instrument funded merchant payments above ₹2,000, and that fee is paid by the merchant or wallet provider, never by you, and never on plain bank-to-bank UPI.
Core rule: if anything or anyone tells you that you need to pay a fee to receive a UPI payment, that is a scam, full stop. Receiving money on UPI never costs anything and never requires an action from you beyond having the app open.
4. UPI Lite and 123Pay: what they are for
UPI Lite is a lower-friction mode for small, frequent payments, useful for things like chai stalls, autos, or small daily purchases. You preload a small wallet balance (up to ₹5,000) and payments up to ₹1,000 per transaction go through without needing your UPI PIN each time. That no-PIN convenience is exactly why the balance cap is kept low, it limits your exposure if the phone is compromised.
UPI 123Pay exists for feature phone users without a smartphone, letting them make UPI payments up to ₹10,000 per transaction through IVR calls, missed calls, or app-based feature phone options. This has meaningfully extended UPI access to people without smartphones.
5. The scam: "scan this QR to receive money"
Here is exactly how the scam that opened this guide plays out, step by step, because recognising the pattern matters more than memorising a rule.
You are selling something on a second-hand marketplace, or someone owes you a refund, or claims to be from customer support fixing a failed transaction. They tell you they are sending you money and ask you to "scan this QR code to receive it" or to open a payment request and "enter your PIN to accept the refund." Because scanning a QR and entering a PIN is exactly what you do dozens of times a month to pay for things, your hands do it on autopilot before your brain catches up. The moment you enter that PIN, you have authorised an outgoing payment, not accepted an incoming one. The money leaves your account and goes to them.
This scam has a name in fraud circles: the collect request or "pull" scam. A collect request is a UPI feature that lets someone request money from you, which pops up looking almost identical to a payment you are receiving. Scammers relied on this confusion for years.
What changed: NPCI discontinued all P2P (person-to-person) collect requests from 1 October 2025, specifically to shut this fraud pattern down. If you get what looks like a P2P collect request today, that itself is a red flag, since it should not exist anymore for individual-to-individual payments. Merchant collect requests (from verified businesses) still exist and remain legitimate.
Core rule: you never need to scan a QR code or enter your UPI PIN to receive money. Ever. Not for a refund, not for a "prize," not because customer support asked you to. Receiving is passive, it needs no action, no PIN, no scan.
6. Other UPI-adjacent scams to know
| Scam | How it works |
|---|---|
| QR code scam | Scanning a QR and entering your PIN always sends money, never receives it, regardless of what the sender claims |
| Fake customer care numbers | Search-engine-poisoned fake helpline numbers talk victims into sharing OTP or installing screen-share apps |
| Phishing / smishing | Fake SMS or email links (fake delivery fees, prize claims, fake bank alerts) harvest your credentials or OTP |
| KYC update fraud | "Your account will be blocked, update KYC now" links harvest credentials or install malware |
| Digital arrest | Fake police, CBI, or ED video calls coerce victims into transfers while being kept on camera |
Core rule: no genuine bank, UPI app, or government agency will ever ask you for your OTP or your UPI PIN over a call, message, or "verification" screen. Anyone asking for either is committing fraud in that exact moment.
7. What should you do if you already got scammed?
Speed matters more than anything else here. Report immediately to the cybercrime helpline 1930 or the cybercrime.gov.in portal. There is a real "golden hour" effect, reporting within roughly the first hour dramatically raises the chance that the transferred funds can still be frozen before the scammer moves them out. The National Cyber Crime Coordination Centre (I4C), under the Ministry of Home Affairs, coordinates this response across banks. Do not wait until the next morning to report, every hour that passes reduces the odds of recovery.
8. How do you keep your UPI app secure day to day?
A few habits eliminate almost all realistic UPI risk:
- Never share your UPI PIN with anyone, including someone claiming to be your bank.
- Never enter your PIN or scan a QR code to "receive" anything.
- Set a lower per-transaction or daily limit in your UPI app's settings if you rarely make large payments, this caps your worst-case exposure if your phone is ever compromised.
- Double check the payee name shown on the confirmation screen before you approve any payment, not just the amount.
- Enable your phone's screen lock and never install screen-sharing or remote-access apps at a stranger's request, even someone claiming to be tech support.
Related Guides
Disclaimer
This guide is for educational purposes only and does not constitute financial or security advice. UPI limits, categories, and NPCI rules can change, and individual banks may apply their own lower caps. Figures are based on rules current in 2026 and may change. Evaluate your own situation and consult your bank or a qualified professional before acting, and report suspected fraud immediately to 1930 or cybercrime.gov.in.