Digital payments have made everyday transactions faster and more convenient. From UPI payments and online shopping to mobile recharges, bill payments and banking services, people can now complete transactions within seconds.
But convenience also comes with responsibility.
Many payment frauds do not require a person to physically access your bank account. Fraudsters may try to trick you into revealing confidential payment information through fake calls, messages, emails, links, customer-support scams or other social-engineering techniques.
The Reserve Bank of India (RBI) specifically advises users not to share sensitive information such as PINs, passwords and OTPs, including with people claiming to be bank staff.
In this guide, we explain 5 important payment details you should never share with anyone, along with common fraud situations and what to do if you accidentally reveal sensitive information.
5 Payment Details You Should Never Share
The five most important categories to protect are:
- OTP
- UPI PIN
- Debit/Credit Card PIN
- CVV and Card Security Details
- Internet Banking Password and Login Credentials
Let’s understand each one.
1. Never Share Your OTP
OTP means One-Time Password.
It is a temporary authentication code sent to your registered mobile number or email for certain banking or payment activities.
An OTP may be requested for activities such as:
- Login verification
- Payment authentication
- Card transactions
- UPI PIN-related processes
- Account or service verification
- Other security-sensitive activities
Why should you never share an OTP?
If someone asks you to tell them an OTP, they may be attempting to authorize an action using your account.
RBI’s digital-banking safety guidance says users should never share OTPs or mobile-banking PINs with anyone, including bank staff.
RBI’s fraud-awareness material also warns about fraudsters impersonating financial institutions and convincing users to disclose OTP or PIN information.
Example of an OTP scam
You may receive a call saying:
“Your account will be blocked. Please tell me the OTP you just received so I can verify your account.”
This is a major warning sign.
Do not share the OTP.
If you did not initiate the transaction or action that generated the OTP, check your account and contact the relevant institution through its official channel.
2. Never Share Your UPI PIN
Your UPI PIN is a confidential authentication credential used to authorize certain UPI transactions.
It should remain private.
NPCI’s UPI documentation describes the UPI PIN as an authentication factor for transaction authentication in the existing UPI flow.
Important rule
You do not need to tell your UPI PIN to another person to receive money.
If someone says:
“Enter your UPI PIN to receive this refund.”
Stop and verify the request.
Entering a UPI PIN is generally associated with authorizing a transaction, not simply receiving money.
Never share your UPI PIN with:
- Friends
- Relatives
- Unknown callers
- Fake customer-care agents
- Delivery agents claiming to need verification
- Sellers or buyers
- Social-media contacts
- People claiming to be bank representatives
Even if someone knows your name, phone number or other basic information, that does not mean they should receive your UPI PIN.
3. Never Share Your Debit or Credit Card PIN
Your card PIN is another highly sensitive security credential.
It should never be disclosed to another person.
NPCI’s card-safety guidance specifically advises customers to keep the PIN secret and not disclose it to anyone.
Be especially careful if someone says:
- “I am calling from your bank.”
- “Your card needs verification.”
- “Your card will be blocked.”
- “We need your PIN to activate your card.”
- “Tell me your PIN to process your refund.”
These requests should be treated as suspicious.
Remember:
A legitimate support representative should not need you to reveal your confidential card PIN over a phone call or message.
4. Never Share Your CVV and Other Card Security Details
Your CVV is a security code associated with your debit or credit card.
Depending on the card, it may be a three-digit or other security value printed on the card.
Other sensitive card information can include:
- CVV
- Full card number
- Expiry date
- Card PIN
- OTP
- Other authentication information
NPCI’s card-safety guidance explicitly advises customers not to share the card number, PIN, CVV, OTP or expiry date with anyone.
Be careful with fake verification requests
A fraudster may say:
“We need your card details to verify your cashback.”
or:
“Your refund cannot be processed until you provide your CVV.”
Do not provide sensitive card information simply because someone claims to represent a bank, merchant or payment company.
Use the organization’s official website or app to verify the request.
5. Never Share Your Internet Banking Password or Login Credentials
Your internet-banking credentials can provide access to sensitive financial information and banking services.
These may include:
- Username
- Login password
- Transaction password, where applicable
- Security answers
- Authentication codes
- Other confidential login information
RBI advises users not to share internet-banking IDs, passwords, OTPs or mobile-banking PINs with anyone.
Never send banking credentials through:
- SMS
- Social media
- Unknown websites
- Phone calls
- Unverified customer-support chats
Also avoid entering banking credentials on suspicious or untrusted websites.
What About Your Bank Account Number?
Your bank account number is different from your UPI PIN, OTP or password.
An account number may be legitimately required for certain transactions or account-related activities, but you should still avoid posting financial information publicly or sharing unnecessary information with unknown people.
The key point is:
Never assume that because someone knows your account number, they are authorized to receive your confidential authentication credentials.
Never combine basic account information with sensitive credentials such as:
- OTP
- UPI PIN
- Card PIN
- CVV
- Password
A Simple Rule: “Receive Money” Does Not Mean “Enter Your PIN”
One of the most common misconceptions in digital-payment fraud is that you must enter a UPI PIN to receive money.
Be cautious if someone tells you:
“I am sending you money. Enter your UPI PIN to receive it.”
Before approving any UPI request, carefully check:
- Who is requesting the payment?
- Is the amount correct?
- Are you actually sending money?
- Is the request expected?
- Does the recipient name match your intention?
NPCI’s official UPI information explains that users review payment details and enter their PIN to authorize a UPI payment.
Common Payment Scams You Should Know
Fake Bank Customer-Care Calls
A fraudster may pretend to be a bank representative and claim that your account or card has a problem.
They may ask for:
- OTP
- PIN
- CVV
- Password
- Card details
Do not share them.
Instead, independently find the bank’s official contact information and contact the bank yourself.
Fake KYC Update Scams
You may receive a message claiming:
“Your KYC will expire today. Click this link to update your account.”
The link may lead to a fake website designed to steal credentials.
RBI has warned about fraud methods involving malicious links and fake applications that can access critical information.
What should you do?
Don’t click suspicious links.
Open the official bank or service website/app directly.
Fake Refund Scams
A fraudster may claim that you are eligible for a refund.
They may ask you to:
- Scan a QR code
- Approve a UPI request
- Enter your UPI PIN
- Share an OTP
- Provide card details
Before accepting any refund or payment request, verify it independently.
Fake Delivery or Courier Scams
Someone may claim:
“Your parcel has a small unpaid charge. Pay immediately using this link.”
The link may lead to a fraudulent payment page.
Never provide sensitive payment information simply because a caller or message claims to represent a courier company.
Fake Customer-Support Scams
Fraudsters may create fake customer-care numbers on search engines, social media or websites.
They may pretend to provide support for:
- Banks
- Payment apps
- Shopping websites
- Recharge services
- Bill-payment platforms
- Courier companies
RBI recommends accessing official websites and using trusted channels rather than relying on suspicious contact details.
Fake QR Code Scams
QR codes can be useful for making payments, but you should always understand what action you are authorizing before scanning or approving a payment.
Before making a payment:
- Check the recipient.
- Check the amount.
- Confirm the purpose.
- Don’t enter your UPI PIN simply because someone tells you to.
- Stop if anything looks suspicious.
Never Install an Unknown App for “Payment Support”
Fraudsters may ask users to install an app for:
- Refund processing
- KYC verification
- Customer support
- Account activation
- Payment troubleshooting
RBI has specifically warned about users being tricked into downloading fraudulent applications that may access sensitive information stored on devices.
Only install apps from trusted sources and verify the developer and purpose before installation.
How to Identify a Payment Scam
Be suspicious when someone:
Creates Urgency
“Pay within five minutes or your account will be blocked.”
Requests Confidential Information
“Tell me your OTP so I can verify you.”
Sends an Unexpected Link
“Click here to update your KYC.”
Requests a UPI PIN
“Enter your PIN to receive the refund.”
Asks You to Install Software
“Install this app so I can help you.”
Pretends to Be an Official Representative
“I am calling from your bank/payment company.”
When something feels unusual, stop the transaction and verify it through an official channel.
What Should You Do If You Accidentally Shared a Payment Detail?
If you accidentally reveal sensitive information, act quickly.
Step 1: Stop Communicating With the Fraudster
Do not provide additional information.
Step 2: Contact Your Bank or Payment Provider
Use the official website, app or verified customer-support channel.
Tell them what happened.
Step 3: Secure Your Account
Depending on what was exposed, consider changing relevant passwords or blocking/replacing cards through official channels.
Step 4: Check Recent Transactions
Review your bank and payment accounts for unauthorized activity.
Step 5: Report Unauthorized Transactions Immediately
RBI advises customers to inform their bank immediately in case of unusual or unauthorized transactions.
Step 6: Report the Fraud
If money has been lost or an unauthorized transaction has occurred, use the appropriate official financial-fraud reporting and grievance channels.
Do not wait unnecessarily.
What Khatriji Users Should Remember
When using Khatriji or any other digital-payment service, the same basic security principles apply.
Never share:
- OTP
- UPI PIN
- Card PIN
- CVV
- Internet-banking password
Khatriji users should also be careful when receiving messages or calls claiming to represent a payment service.
Always verify the source through the official Khatriji website or the relevant financial institution’s official support channel.
5-Second Payment Safety Checklist
Before approving a digital payment, ask yourself:
1. Did I initiate this transaction?
2. Is the recipient correct?
3. Is the amount correct?
4. Am I being asked for an OTP, PIN or password?
5. Is someone creating unnecessary urgency?
If something doesn’t look right, stop and verify before proceeding.
Difference Between Payment Information and Secret Credentials
Not every payment-related detail has the same level of sensitivity.
| Information | Should You Share It? |
|---|---|
| OTP | ❌ Never share |
| UPI PIN | ❌ Never share |
| Card PIN | ❌ Never share |
| CVV | ❌ Never share |
| Internet Banking Password | ❌ Never share |
| Card Number | ⚠️ Share only through trusted payment channels when genuinely required |
| Account Number | ⚠️ Share only when necessary and with a trusted recipient/institution |
| UPI ID | ✅ May be shared when you need to receive money, but remain alert to payment requests |
The exact information required for a legitimate transaction depends on the service. When in doubt, verify directly with the institution using an official channel.
Frequently Asked Questions
Can I share my OTP with bank customer care?
No. RBI advises customers never to share OTPs with anyone, including people claiming to be bank staff.
Can I share my UPI PIN to receive money?
No. Do not enter or disclose your UPI PIN simply because someone claims that it is required to receive money.
Should I tell someone my card PIN?
No. Keep your debit and credit card PIN confidential. NPCI specifically advises customers not to disclose their PIN.
Is CVV safe to share over a phone call?
You should not disclose your CVV to unknown callers or unverified contacts. NPCI advises customers not to share CVV and other sensitive card details with anyone.
Can a payment company ask for my OTP?
You should not disclose an OTP to a caller or support representative. If an authentication step is required, complete it yourself through the official payment interface rather than telling the code to someone.
What should I do if someone asks for my UPI PIN?
Stop the interaction and verify the request through the official bank or payment provider.
What if I receive an OTP without making a transaction?
Do not share it. Check your account and contact the relevant institution through its official channel if necessary. RBI advises customers to monitor SMS/email alerts for OTPs generated without their knowledge.
Can I share my UPI ID?
A UPI ID may be shared when someone needs it to send you money, but remain alert to unexpected payment requests and never share your UPI PIN.
What if I accidentally shared my OTP?
Contact the relevant bank/payment provider immediately, secure your account and check for unauthorized transactions.
What if money was deducted without my permission?
Contact your bank/payment provider immediately and report the unauthorized transaction through the appropriate official channel. RBI recommends informing the bank immediately about unusual or unauthorized transactions.
Conclusion
Digital payments are convenient, but your payment security depends heavily on protecting confidential credentials.
The most important rule is simple:
No legitimate-looking urgency should convince you to disclose your OTP, UPI PIN, card PIN, CVV or banking password.
Fraudsters may use fake customer-care calls, KYC messages, refund offers, QR codes, malicious links or fake applications to convince users to reveal sensitive information.
Before approving any transaction, stop and verify the recipient, amount and purpose.
If you accidentally disclose sensitive information or notice an unauthorized transaction, contact your bank or payment provider immediately and take steps to secure your account.
For digital payments and supported services, always use trusted platforms and official channels, including the official Khatriji website.
Stay alert. Keep your payment details private. Think before you approve.
Tags: Banking Security, Card PIN Safety, Credit Card Security, CVV Safety, Debit Card Security, Digital Payment Fraud, Digital Payment Safety, digital payments, khatriji, Online Banking Safety, Online Payment Fraud, OTP Safety, Payment Security, UPI PIN Safety, UPI Safety