UPI exposes a bank account. If $hit happens in a payment, the entire bank balance can get wiped out. Not to single out UPI, this vulnerability is common to all bank account linked payment methods including Zelle (USA), FPS (UK), NEFT (India), which are also known as Account-to-Account (A2) payments.
PSA: $hit happens in payments, like in many other things in life. But when it happens in UPI, debit card or any payment method that’s linked to a bank account, entire bank balance can be wiped out instantly. pic.twitter.com/Ux3i9m1Bru
— Ketharaman Swaminathan (@s_ketharaman) February 20, 2019
The exposure in the case of a Digital Wallet is limited to the typically small amount of money kept in the digital wallet.
So, digital wallet is safer than UPI.
If you don’t have a credit card and have no choice but to use UPI, then I strongly recommend that you link it to a bank account that’s ringfenced for UPI payments by keeping a small sum of money. In other words, treat that bank account like a digital wallet!
Uninstalled bank's app for my primary bank account. It's not connected to any UPI app either. I use UPI with a secondary account with limited funds.
— Shashikant Kore (@kshashi) October 19, 2021
I did that long ago for my limited use of UPI. Secondary bank a/c is like PayTM wallet. I ditched PayTM after it started levying 2% surcharge for credit card topup. After learning that Amazon Pay gives free credit card wallet topup, I've moved whatever little UPI use to it.
— Ketharaman Swaminathan (@s_ketharaman) October 19, 2021