Mon–Sat, 9:00 AM – 7:00 PM IST India · Remote
Advisory

A ₹1 trial can hide a recurring UPI AutoPay mandate

The screen that charges you one rupee today may be authorising a standing debit. What to read before you enter the PIN, and how to audit what you have already approved.

8 Oct 2026 4 min read Somendra Nath Tiwari, CISSP · discussion on LinkedIn

UPI AutoPay is a legitimate and useful feature. It is how subscriptions, SIPs and utility payments run without someone re-approving them every month. The problem is not the mechanism. The problem is that the approval screen for a one-time payment of one rupee and the approval screen for an open-ended monthly mandate look very similar at a glance, and both end with the same PIN entry.

A “₹1 trial” is the classic framing. The rupee is real. What the rupee buys is your authorisation for a recurring debit at a much larger amount, starting after the trial ends, which you then have to notice and cancel.

Read three things before the PIN

  1. Is this a payment or a mandate? The screen says. A mandate will show a frequency — monthly, weekly, as presented — and usually a validity period. A one-time payment shows neither.
  2. Who is the merchant, in full? Not the brand name you were shown on the previous page. The payee string on the approval screen is the one that will actually be debiting you, and it is often a payment aggregator you have never heard of.
  3. What is the maximum amount? A mandate carries a cap, and the cap is frequently far above the advertised price. ₹1 today against a ₹4,999 monthly cap is a very different agreement from the one being described.
The tell

If the approval screen shows a frequency and a maximum amount, you are not buying anything for one rupee. You are signing a standing instruction. That may still be fine — but decide it knowingly.

Audit what is already running

Every UPI app exposes this, usually under AutoPay, Mandates or Subscriptions in the profile or payments section. It takes about two minutes and most people find at least one thing they had forgotten.

  • Open the AutoPay or Mandates list in each UPI app you use — they are per-app, so checking one is not checking all of them.
  • Cancel anything you do not recognise or no longer use. Cancelling a mandate does not cancel the underlying service, so close the account separately if you want it gone.
  • Note the next debit date on the ones you keep, so a price rise is something you decide about rather than discover.

Why this is worth a calendar reminder

Mandates are designed to be invisible once approved — that is the feature. The failure mode is not fraud so much as drift: a dozen small standing debits, each individually unremarkable, none of them ever reviewed. A twice-yearly check costs four minutes and is the only thing that catches it.

If money has already gone

Call the national cybercrime helpline 1930 or file at cybercrime.gov.in. Report within the first few hours if you can — the sooner the bank is notified, the better the chance the transfer can be frozen before it is withdrawn.

Join WhatsApp Community

Frameworks we work against

ISO/IEC 27001ISO/IEC 42001SOC 2PCI DSSRBI Cyber Security FrameworkDPDP Act 2023CERT-In DirectionsNIST CSFplus custom frameworks, mapped on request