What does entering the PIN mean?
A payment application may ask the customer to authorise an action involving their account. The PIN is part of that authorisation process. It should be entered only after the customer understands what the screen is asking them to approve.
NPCI’s BHIM UPI guidelines explain the PIN and warns users not to share it. The practical lesson at a service counter is straightforward: the customer controls their own authentication. An operator can explain a screen without asking the customer to disclose the code.
Do not turn “enter your PIN” into a general instruction disconnected from the amount, recipient or action displayed.
How is it different from other codes?
| Code or identifier | What it is for |
|---|---|
| UPI PIN | Authorising supported UPI actions |
| OTP | A one-time verification code for the request that generated it |
| ATM/card PIN | A credential used in the applicable card or ATM process |
| Phone-unlock PIN | Access to the phone itself |
| UPI ID | A payment address, not a secret authorisation code |
These are separate roles even when a customer has chosen similar-looking numbers. A retailer should never advise reusing a secret merely because another service asks for a numeric code.
Do I enter a UPI PIN to receive money?
An ordinary incoming account credit does not require the recipient to enter a UPI PIN merely to receive the funds. Official bank guidance, including Indian Overseas Bank’s UPI safety tips, makes this distinction clear.
A request presented as a refund may actually ask the customer to authorise an outgoing payment or another action. Read what the application says rather than trust the caller’s description.
If the instruction and the promised purpose disagree, stop. Contact the organisation through its independently verified support channel. A caller who knows an order number is not automatically authorised to control the customer’s payment application.
What about payments that use another method?
Do not claim that every UPI transaction always needs a manually entered PIN. Features such as UPI Lite and certain authorised arrangements have their own authentication behaviour. NPCI has also issued guidance on additional authentication methods.
The relevant question is which legitimate action the current application is performing and what that feature requires. The absence of a PIN prompt does not make an unknown application trustworthy, while the presence of a PIN prompt does not prove a caller’s story is true.
Use the current instructions from the bank, app and NPCI for the feature involved. This page explains the PIN’s role rather than every product’s setup procedure.
An example at a recharge shop
Illustrative example: A customer says a caller has promised to refund a failed recharge. The caller asks them to scan a code and enter their UPI PIN while staying on the phone.
The retailer asks the customer to stop and read the application’s action and recipient details. If the screen is asking them to pay, that is different from receiving a refund. The retailer does not ask to see the PIN or complete the action on the customer’s behalf.
The customer checks the original recharge record and uses the provider’s official complaint route. Our failed-recharge guide explains which transaction information to retain.
Questions about UPI PINs
What if I enter the wrong PIN?
NPCI notes that repeated incorrect attempts can lead to a bank-imposed restriction. Use the bank or app’s official recovery process instead of continuing to guess.
Should support ask me to tell them the PIN?
No. A PIN is an authorisation secret, not the transaction reference needed to investigate a payment.
Can the shop enter it for me?
The customer should control the authentication and keep the secret private. Explaining the payment process does not require the retailer to learn the PIN.