Scam & Payment Safety

In short

• Stataa will never ask for your UPI PIN, OTP, card CVV or password.
• You never need to enter your UPI PIN to receive money. A PIN is only for sending money.
• Pay only inside the Stataa app. Customers never pay at the shop, and refunds go back automatically to the payment method you used.
• We contact you only in the app or from an @stataa.com email address. Do not trust phone numbers you find on search engines or social media.
• If you have lost money, call 1930 at once and report it at cybercrime.gov.in. Then tell us at trust@stataa.com.

What Stataa will never do

• Ask for your UPI PIN, OTP, card CVV, bank password or Stataa password, by phone, chat, email or in person.
• Send you a UPI payment request, payment link or QR code for a refund.
• Refund you by personal UPI, bank transfer or cash.
• Ask you to install a screen-sharing or remote-access app (such as AnyDesk or TeamViewer).
• Ask you to pay for an order outside the app, or to pay a shop directly.
• Charge shops a joining, registration, verification or "payout activation" fee.
• Offer you money for rating shops, "tasks" or reviews.
• Use an email domain other than stataa.com.

What Stataa does

• Takes all payments inside the app through our payment partner, a payment aggregator authorised by the Reserve Bank of India.
• Sends refunds only to your original payment method. You do not need to do anything to receive them.
• Gives every support request a ticket reference like STA-12345, so you can track it.
• Lets shops hand over orders only when they enter your pickup code in the app.
• Collects a shop's payout bank account or UPI ID only inside the Stataa app (Money → Where we pay you), verifies it before the first payout, and holds payouts for 48 hours whenever it changes, telling the shop at once.

Common scams and how to spot them

"Enter your PIN to receive money"

A scammer sends a payment request, payment link or QR code and says you will receive a refund or prize when you approve it. Approving it with your UPI PIN sends money out of your account. Since 1 October 2025, UPI no longer allows person-to-person collect requests, but scammers still use requests from merchant accounts, payment links and QR codes. Remember: entering your PIN always means paying.

Fake customer care numbers

Scammers post fake "Stataa customer care" numbers on search engines, maps and social media. When you call, they ask for your OTP, ask you to install a screen-sharing app, or send a payment request. Contact Stataa only through the app, the contact form on stataa.com or the email addresses on our Grievance Redressal & Contact page. If we ever add a phone line, we will list it there and in the app, nowhere else.

Fake "refund by UPI"

Someone says there is a problem with your refund and offers to send it by UPI if you scan a code, share an OTP or confirm a request. Stataa refunds go back automatically to the method you paid with. Nobody needs your PIN or OTP to refund you.

Fake payment screenshots

At the shop, someone shows a screenshot of a "payment" and asks for food, or says they have paid for an order when they have not. Stataa orders are paid only in the app. Shops: the only proof of a Stataa order is the pickup code you enter in the app. Never accept a screenshot, cash or UPI for a Stataa order.

QR code swaps

A fraudster pastes their own QR code over a shop's code, or asks a customer to scan a code "to confirm the order". Customers never pay at the shop for Stataa orders, so any request to scan a code there is wrong. Shops: check your counter, and do not let anyone put up a "Stataa" QR code.

Fake Stataa staff or sellers' team

Someone calls a shop, says they are from Stataa, and asks for a fee, bank details, an OTP or documents over WhatsApp. Stataa never charges shops a fee to join. Upload documents only inside the Stataa app. Payout details go only into the Stataa app itself, never over a call, WhatsApp or a link someone sends you.

Look-alike links and apps

Messages with links to sites that look like Stataa but have a different address, or apps not published by Stataa. Check the address is exactly stataa.com. Install the app only from the official app store listing linked from stataa.com.

Account takeover

Someone asks you to "read back" an OTP you just received. That OTP lets them log in to your account or approve a payment. Never share an OTP with anyone.

Task and job scams

Messages offering money for liking or rating shops "on Stataa", then asking you to deposit money to unlock earnings. Stataa does not run such schemes.

If you have been targeted

• If you have lost money: call the national cybercrime helpline 1930 immediately. Reporting quickly gives the best chance of stopping the money. Also report it at cybercrime.gov.in.
• Call your bank or card issuer to block your card or UPI, using the number on your card or in your bank's official app. The faster you report unauthorised transactions, the better Reserve Bank of India rules protect you.
• Change your Stataa password and log out of other devices.
• Report suspicious calls, SMS or WhatsApp messages on the government's Chakshu facility at sancharsaathi.gov.in.
• Tell us at trust@stataa.com, with screenshots, the phone number or link used, and your ticket reference or order number. We will block the accounts involved and help the police where the law allows.

Reporting a security vulnerability

If you find a security weakness in Stataa, email security@stataa.com with the details and steps to reproduce it. Please:

• do not access, change or delete other people's data;
• do not disrupt the service or run automated attacks;
• give us reasonable time to fix the problem before you tell anyone else.

We will acknowledge your report and keep you updated. We are grateful for good-faith research that follows these rules.