Short answer: In a QR code scam, a fraudster sends you a QR code and says scanning it will let you receive money. In fact, scanning it and entering your UPI PIN sends money from your account. Remember one rule: you never need to scan a QR code or enter your UPI PIN to receive money. If you are cheated, call the cybercrime helpline 1930 immediately and inform your bank.
Last updated: 13 October 2026.
UPI has made payments instant, and that speed is exactly what fraudsters exploit. QR code scams are among the most common UPI frauds reported by sellers on classifieds sites, people renting out property, and small shopkeepers. This guide explains how the scam works in 2026, the variations to watch for, what to do in the first hour if it happens to you, and how to protect your money.
How the QR code scam works
- The bait: you list a sofa, a bike or a flat for rent online. Someone contacts you quickly, agrees to your price without bargaining, and is in a hurry.
- The trust builder: they often claim to be from the army, police or a government department posted to your city, and may send photos of an ID card.
- The QR code: they say they will pay an advance and send a QR code on WhatsApp, asking you to scan it to “receive” the money.
- The trap: when you scan, your UPI app shows a payment screen with an amount. You are told to enter your PIN to “accept”. The moment you do, money leaves your account.
- The repeat: they then claim it was a mistake and ask you to scan again to “get a refund”, taking more each time.
The key fact: a QR code contains payment instructions. Scanning a code with a UPI app sets up a payment from you to whoever created the code. Your UPI PIN is only for authorising money going out. Receiving money needs nothing from you except your UPI ID or account details.
Common variations in 2026
| Variation | What happens | Red flag |
|---|---|---|
| Fake buyer or tenant | Sends QR code or collect request to “pay advance” | Asks you to scan or enter PIN to receive money |
| Collect request | You get a UPI request titled “refund” or “cashback” | Any request that needs your PIN is a debit |
| Tampered shop QR | A sticker is pasted over a shop’s genuine QR code | Name shown in app does not match the shop |
| Phishing QR (quishing) | QR on a poster, parking meter or email opens a fake website | Site asks for card details, OTP or login |
| Fake refund or customer care | “Support” sends QR to process your refund | Real refunds go back to source; no QR needed |
| QR for parcel or KYC update | Message says scan to reschedule delivery or update KYC | Urgency plus a link or QR |
How to protect yourself
- Never enter your UPI PIN to receive money. If an app asks for your PIN, you are paying.
- Check the payee name shown in your UPI app before you pay a shop or person. If it does not match, stop.
- Treat urgency as a warning. “Pay now or lose the deal” is a pressure tactic.
- Decline unknown collect requests. A request that says “you will receive” but asks for a PIN is fake.
- Use your UPI app’s built-in scanner, not a random third-party QR app, and keep the app updated.
- Do not open links from QR codes in unexpected messages, posters or emails, and never type OTPs or card details on such pages.
- Shopkeepers: check your displayed QR code daily for stickers pasted over it, and use the payment sound box to confirm receipts.
- Set a lower daily UPI limit in your banking app if you rarely make large payments. It limits damage.
Many of the same tricks show up in loan fraud. Read our guides on common loan scams and how to avoid financial frauds.
What to do if you have been scammed
Speed matters. Money moved through UPI can be traced and sometimes frozen if you report quickly, before fraudsters move it onward.
- Call 1930, the national cybercrime helpline, immediately. Keep your transaction ID (UTR number) ready.
- Report online at the National Cyber Crime Reporting Portal (cybercrime.gov.in), and note the acknowledgement number.
- Inform your bank through its official helpline or app and ask them to raise a fraud complaint. Ask about blocking UPI on your account if you think your device or PIN is compromised.
- Report in your UPI app using the help or dispute option for that transaction.
- Save evidence: screenshots of chats, the QR image, the fraudster’s number and UPI ID, and the debit SMS.
- Change your UPI PIN and passwords if you shared anything beyond the PIN, and scan your phone if you installed any app on their advice.
If your bank does not respond satisfactorily within 30 days, you can escalate to the RBI’s Integrated Ombudsman Scheme through the Reserve Bank of India complaint channels. Our guide to RBI rules for borrowers explains the grievance route.
Will the bank refund the money?
RBI rules limit a customer’s liability for unauthorised electronic transactions, especially when they are reported quickly. However, in a QR scam you usually authorised the payment yourself by entering your PIN, so the bank may treat it as a customer-authorised transaction. Recovery then depends on the police and banks tracing and freezing the money in the fraudster’s account. That is why calling 1930 within the first hour matters more than anything else.
The money angle: limit your exposure
- Keep your main savings in an account that is not linked to UPI apps, and keep only a working balance in your UPI-linked account.
- Consider personal cyber insurance; some policies cover losses from UPI and online fraud, subject to conditions such as reporting within a set time.
- Keep an emergency fund so a fraud loss does not push you towards a high-cost loan.
- Check your bank statement weekly so you notice unusual debits early.
Example: Meena (illustrative) lists her old fridge for ₹8,000. A “buyer” sends a QR code for a ₹2,000 advance. Her app shows “Pay ₹2,000”. She realises the app says pay, not receive, and declines. Had she entered her PIN, she would have lost ₹2,000, and the “refund” trick that usually follows could have taken more. If she had lost money, the right step would have been to call 1930 at once.
If fraud has left you short of cash
Losing money to a scam can leave a gap in rent or bills. Before borrowing, check whether family support, salary advance from your employer or an EPF advance can help. If you do borrow, use only lenders regulated by the RBI; scammers also run fake loan apps that target people in distress. You can check whether a loan app is RBI-approved and see the RBI digital lending app list. The RBI Sachet portal also lets you check registered entities and report unauthorised ones.
Need a short-term loan from a regulated lender? Compare offers from RBI-regulated banks and NBFCs.
Frequently asked questions
Do I need to scan a QR code to receive money on UPI?
No. You never need to scan a QR code or enter your UPI PIN to receive money. The PIN is only for paying.
Can someone hack my account just because I scanned a QR code?
Scanning a UPI QR code alone does not move money; you must still enter your PIN. But a QR code can open a phishing website, so never enter OTPs, card details or passwords on a page opened by an unknown QR code.
What is the cybercrime helpline number?
1930. You can also report at the National Cyber Crime Reporting Portal, cybercrime.gov.in.
Will I get my money back after a QR code scam?
It depends on how fast you report and whether the money can be traced and frozen. Because you entered your PIN, banks may treat it as authorised, so report within the first hour.
How do I know a shop’s QR code is genuine?
Check that the payee name displayed in your UPI app matches the shop’s name before entering your PIN, and look for stickers pasted over the original code.
Sources
Disclosure: FundsTiger (Gatimaan Finance Advisors Pvt. Ltd.) is a loan marketplace and lending service provider for RBI-regulated lenders. Aparampaar Finance Pvt. Ltd. (Omozing), one of those lenders, is a related party of FundsTiger. This article is general information, not financial advice. Read your loan agreement and KFS before you decide.