UPI Rule Change: Collect Request Updates

What Are UPI Collect Requests and Why They Matter

UPI’s collect request feature lets merchants or users request money instead of sending it. For example, when you receive a “Pay ₹500 to Merchant X” notification on your phone — that’s a collect request. It’s widely used by small businesses, gig platforms, and utility apps.

However, as Upi Collect Request System notes, this feature also became a gateway for fraudulent payment requests. Scammers exploited it to send fake “refund” or “KYC update” requests, tricking users into approving unintended payments.

To strengthen trust and usability, the National Payments Corporation of India (NPCI) introduced new security rules for collect requests in 2025. These updates ensure that users have clearer visibility, stronger verification, and fewer unwanted payment prompts.

Insight: A UPI collect request should feel like an invoice — not an alert that makes you panic.

What’s Changing in the 2025 NPCI Update

The new NPCI rules under Npci Upi Security Guidelines focus on three key areas: visibility, verification, and validity. These are designed to curb scams and bring transparency between users and merchants.

Here’s what’s new:

• Verified merchant tags: Only RBI-registered merchants can send recurring collect requests.
• Expiry timer: Every collect request must now expire within 2 hours — no indefinite requests allowed.
• Notification redesign: Payment prompts now show merchant logo, UPI ID, and transaction purpose before approval.
• Auto-decline feature: Pending requests older than 30 minutes are automatically cancelled by the system.
• Transaction limit update: Collect requests above ₹2 lakh require additional authentication (OTP or biometric).
• Request reporting: Users can now flag suspicious collect requests directly from their UPI app.

These rules apply to all UPI apps and Payment Service Providers (PSPs). Banks must update their app interfaces by December 2025 to remain compliant with NPCI’s directive.

Tip: If a collect request doesn’t mention the payment purpose, decline it immediately.

How It Improves User Safety and Merchant Trust

These rule changes are meant to balance both ends of the UPI ecosystem — protecting users from fraud while helping legitimate merchants improve conversion rates. According to User Protection Framework, NPCI’s internal tests show a 27% drop in fraudulent collect requests within three months of the pilot rollout.

Here’s how users benefit:

1. Clearer visibility: Merchant identity and transaction purpose shown upfront.
2. Less spam: Auto-decline and expiry timers remove unwanted pending requests.
3. Improved confidence: Users can easily spot unverified or fake merchants.
4. Better control: One-tap option to report or block suspicious UPI IDs.

For merchants, the changes mean fewer payment failures and more user trust. With verified merchant tags and faster approvals, businesses can expect smoother checkout experiences.

Insight: UPI’s security now works both ways — protecting users from fraud and merchants from failed payments.

What You Should Do After the Rule Change

For everyday users, the key takeaway is to treat collect requests like invoices — review, verify, and then approve. Under Merchant Upi Compliance, only verified merchants can initiate recurring collect flows, and your UPI app will highlight these with blue or green check marks.

Here’s how to stay safe and updated:

• Check verification badges: Only approve requests from verified sources.
• Review details: Ensure the amount and purpose match the transaction.
• Decline unknown requests: Don’t approve collect prompts from unfamiliar contacts.
• Use in-app reporting: Flag suspicious requests instantly — it helps NPCI track fraud.
• Update your UPI app: New versions have fraud-detection enhancements.

These simple steps help users enjoy faster, safer digital transactions — while maintaining full control over where their money goes.

Tip: The safest response to a suspicious collect request is always “Decline.”

With this rule update, NPCI and RBI are building a UPI ecosystem that values informed consent as much as instant payment. Fewer fake requests mean stronger trust — the currency that truly powers India’s digital payments revolution.

Frequently Asked Questions

1. What is a UPI collect request?

It’s a payment request where a merchant or individual asks for money instead of sending it — for example, “Pay ₹500 to Merchant X.”

2. What has changed in 2025?

NPCI introduced stricter expiry rules, verified merchant tags, and new limits to prevent fraudulent or spam collect requests.

3. Can users still get collect requests from anyone?

No. Only verified merchants or trusted contacts can send repeated or high-value collect requests.

4. What happens if I ignore a collect request?

It will automatically expire or be cancelled within 30 minutes to prevent misuse.

5. How can I stay safe from UPI fraud?

Always check merchant verification, decline unknown requests, and update your UPI app regularly for security alerts.