A UPI PIN is a personal code used to authorize transactions through India’s Unified Payments Interface. It acts as an authentication step when approving a payment, so it should be entered only in the intended payment app and never shared with another person.
In cyber attacks, malware may try to capture a PIN by abusing Android accessibility permissions to observe or control app interactions, or by placing a deceptive overlay above a genuine screen. Such techniques describe a risk, not proof that a PIN was stolen or a transaction succeeded. Users should be wary of unexpected permission requests and suspicious PIN prompts. Payment apps can reduce exposure by protecting sensitive screens against overlays and obscured taps.