QR code scams in India and how to avoid them

QR codes have made payments simple, and fraudsters have taken advantage of that. Nearly every QR payment scam relies on a single misunderstanding, so one rule protects you from most of them.

The rule: you never need to scan a QR code or enter your UPI PIN to receive money. Scanning and entering a PIN are only ever for sending money. If someone says otherwise, it's a scam.

How the common scams work

The "scan to receive" trick

You're selling something online, say an old sofa. A "buyer" agrees quickly, often without bargaining, and sometimes claims to be in the army or away on a posting. They send a QR code and say that scanning it will put the money in your account. In fact, your UPI app opens a payment from you, and entering your PIN approves it. They may even suggest "testing" with a small amount first, to gain your trust before the larger one.

The fake sticker

A fraudster pastes their own QR code over a shop's real one. Customers pay as normal, and the money goes to the fraudster. The shop finds out only when the money doesn't add up. This also happens with parking, donation and petrol pump QR codes.

The fake "refund" or "cashback"

You get a message or call about a refund, a prize or cashback, with a QR code or link to "claim" it. Any genuine refund goes back to your account without you scanning anything or entering a PIN.

The malicious link

Not every QR code is for payments. Some simply open a website, and a fake one can lead to a page imitating your bank's login, or prompt you to install a harmful app. These turn up on posters, parcels and fake parking notices.

The "helpful" caller

A caller posing as bank or customer support asks you to install a screen-sharing app, so they can "fix" a problem. With that, they can see what you type, including your PIN and OTPs.

Habits that keep you safe

1. Read the screen before entering your PIN. Your UPI app shows the name of who you're paying and the amount. If you see an unfamiliar name, stop, even if the sticker says it's the right shop.
2. Check where the code leads. A QR reader that shows you the contents before opening them lets you look at the web address first. Be wary of misspellings and long, strange addresses.
3. Look at physical QR codes closely. If one looks like a sticker placed on top of something, ask staff.
4. As a shop owner, check your own code each day, and watch for real payment alerts rather than the customer's screen. There's more on this in our guide to setting up a UPI QR code.
5. Never share your UPI PIN or OTP with anyone, including people who say they're from your bank.
6. Don't install apps because a stranger told you to, and only install from the official app store.
7. Slow down if you feel rushed. Urgency, a too-good price and a sudden prize are all warning signs.

If you've lost money

Speed matters, as the first hours give the best chance of stopping the money from moving on.

1. Call 1930, the national cyber crime helpline, straight away.
2. Report it online at cybercrime.gov.in.
3. Contact your bank using the number on your card or the bank's official website, not one from a search result or a message. Ask them to block further transactions.
4. Report it in your UPI app, and keep screenshots of the chat, transaction ID, phone numbers and QR code.
5. If you've shared your PIN, change it immediately. If you installed a screen-sharing app, delete it and tell your bank.

General safety information. Your bank and the National Cyber Crime Reporting Portal can give advice for your situation. Recovery of lost money isn't guaranteed.