UPI's New Safety Rules in 2026 — What Protects You Now, and What Still Doesn't

UPI moves more money in India than any payment system in history — and fraudsters moved with it. Official figures show UPI-related frauds of about ₹805 crore across 10.6 lakh incidents in just April–November 2025. In response, NPCI and RBI have rolled out a series of rule changes through 2025 and 2026 that quietly make everyday payments safer. Here is what changed, and where you still have to protect yourself.

What the new rules do for you

1. You now see the real, bank-verified name before paying

Since 30 June 2025, UPI apps must show only the banking name of the receiver — fetched directly from the bank via NPCI's validation API — on the payment confirmation screen, not a nickname or a name typed by the receiver. A scammer can no longer set their display name to "SBI Refund Desk".

2. Higher limits — but only where they make sense

Person-to-person transfers remain capped at ₹1 lakh per day. But verified merchants in specific categories — tax payments, education fees, healthcare, IPO and RBI retail schemes — can now accept much larger UPI payments, in some categories up to ₹10 lakh. The higher limits apply only to verified, whitelisted merchants, so a fraudster posing as an individual cannot use them against you.

3. Stronger two-factor authentication

From April 2026, UPI transactions must carry two-factor authentication that includes at least one dynamic factor (something generated fresh for that transaction, not just your static PIN). Apps are rolling this out through 2026 — expect device biometrics or on-device checks alongside your PIN, especially for larger payments.

4. Cleaner background traffic, fewer failures

NPCI has also moved recurring payments (autopay for SIPs, subscriptions, EMIs) into off-peak processing windows and limited balance-check API abuse, which means fewer "payment pending" states — the confusion scammers exploit to say "it failed, pay again".

5. Banks are moving to bank.in domains

Under an RBI directive, Indian banks are migrating their websites to the exclusive .bank.in domain (for example, a genuine bank site would end in bank.in). Migration is still uneven, but as it completes, one glance at the address bar will separate real banking sites from phishing clones.

What the rules still can't stop

Every rule above hardens the system. But most UPI fraud never breaks the system — it convinces you to authorise the payment. These still work in 2026:

The golden rule survives every rule change: receiving money never requires your PIN, a QR scan, or approving a request. Anyone who says otherwise is running a script.

If something goes wrong

1. Call 1930 (Cyber Crime Helpline) immediately — reporting within the first hour gives the best chance of freezing the money mid-transfer.
2. File at cybercrime.gov.in and note the acknowledgement number.
3. Report in your UPI app and to your bank's fraud helpline; under RBI's zero-liability rules, unauthorised transactions reported within 3 working days can qualify for full protection.

The bottom line

2025–26 brought the biggest safety upgrade in UPI's history: verified payee names, purposeful limits, and dynamic authentication. Use the verified-name screen religiously, keep the golden rule, and the remaining risk shrinks to almost zero — because in UPI fraud, the last line of defence was never NPCI. It is the three seconds before you press "Pay".