Loading page
About this tool
Weighted 15-step PhonePe hardening checklist covering app lock, UPI PIN discipline, autopay mandates, transaction limits and UPI scam patterns.
This guide is a weighted, 15-control checklist for PhonePe and UPI: app lock, a UPI PIN that is not guessable, autopay mandate cleanup, transaction limits, and the PIN discipline that stops the scams behind most UPI losses. The single most important rule is an NPCI rule rather than a PhonePe setting: a UPI PIN authorises money leaving your account and is never needed to receive money. Five controls are marked critical and the score is capped at 69% until all five are done. It is general security information, not financial advice; contact your bank and the 1930 helpline for anything involving an actual loss.
Open PhonePe Security Setup Guide on AltFTool — it loads instantly in your browser.
Add your input to the workspace.
Adjust the options until the result looks right.
Copy or download the output and put it to work.
Most UPI losses come from an authorised payment made under pressure, so the habits are scored as heavily as the settings.
Limits and PIN behaviour come from the UPI rules that apply across every app, so the guidance holds if you switch apps.
The checklist runs in your browser and never asks for your UPI ID, PIN, bank details or phone number.
No. Under UPI rules the PIN authorises a debit from your account, so it is only ever required when money leaves. Anyone asking for a PIN, or sending a QR code, so you can accept a refund, a sale payment or a prize is arranging a payment out of your account.
NPCI sets the ceiling for most UPI transfers at Rs 1,00,000 per transaction and per day, and a newly registered user is capped at Rs 5,000 in the first 24 hours. Some categories such as hospitals, education and capital markets have higher ceilings, and your own bank may apply a lower limit of its own.
Call 1930, the national cybercrime financial-fraud helpline, and file at cybercrime.gov.in, then report it in the app under Help and inform your bank. Speed matters because a transfer reported early can sometimes be held before it is withdrawn further down the chain.
Those apps give the caller a live view of your screen and, in many cases, control of the phone, which lets them read OTPs and watch you type the UPI PIN. No genuine bank, payment app or government helpline needs remote access to your device, so treat the request itself as proof the call is fraudulent.