You list an old sofa online. A buyer messages within minutes, agrees to your price, and says, “I’ll send the money now. Just scan this QR code to receive it.” You scan, your UPI app asks for your PIN, and you type it in. A moment later, your balance drops.
That scam works because it flips the one thing most people assume about QR codes. This guide explains how the trick works, the seven versions you’re most likely to meet, and a short checklist that stops almost all of them. If you run a shop or sell online, there’s a section for you too.
Information in this article was last checked on 29 October 2026. Scam methods and app features keep changing, so treat this as a guide to the pattern, not a complete list.
Quick Answer
- You never need your UPI PIN to receive money. The PIN exists only to send money out.
- Scan a QR code only when you want to pay. Nobody has to scan a code to send you money.
- Read the name on the confirmation screen before you enter your PIN.
- Stop the moment anyone asks you to approve, scan, or “verify” to get a refund or prize.
NPCI, the body that runs UPI, publishes the same advice on its safety page: enter your PIN only to send money, scan a QR code only to pay, check the receiver’s name, and don’t install screen-sharing apps at a stranger’s request.
Why QR Scams Work
UPI itself is not broken. The scam happens at the human layer. A QR code is just a shortcut that fills in payment details. When you scan one, your app opens a screen that prepares a payment from you. Whether that screen shows “Pay” or “Receive” depends on what the code contains, and many people don’t read the screen closely.
Scammers add three things to make you skip the reading: urgency (“the buyer is waiting”), authority (“I’m from your bank”), and a believable story (“a refund,” “cashback,” “verification”). Each pushes you to act before you think.
The fix is simple, and it’s a rule you can remember in a second: money goes out only when you enter your PIN. If a story ends with you typing your PIN, it ends with you paying.
Seven QR and Payment Scams to Recognise
1. “Scan this to receive your money”
A buyer, a “courier,” or a “lottery officer” sends you a QR code and says scanning it will credit your account. It debits your account instead. This is the classic version, and a bank’s public awareness page describes a case where a victim scanned such a code and entered the PIN, then lost a large sum.
2. The fake collect request
You receive a “request money” notification styled like a refund or prize. Approving it and entering your PIN sends money out. One 2026 guide says person-to-person collect requests have been discontinued on UPI, which would close this route for personal requests. I couldn’t confirm that from an official page, so keep the rule anyway: never approve a request you didn’t expect.
3. Sticker-swap on shop QR codes
A fraudster pastes a fake QR code over a merchant’s real one. Customers scan it and pay the wrong account. A cooperative bank’s cybersecurity page warns about exactly this and advises you to verify the merchant’s UPI ID on the confirmation screen.
4. The marketplace “advance” trick
On classified or social-media sites, fake buyers (some posing as army or government officers) ask you to scan their QR code to “verify your account” before they pay. The same bank page lists this pattern. A real buyer scans your code or enters your UPI ID.
5. Refund and “customer care” calls
A caller says a payment failed and offers a refund. They guide you to scan, approve, or enter your PIN. Real refunds arrive without you doing anything.
6. Lookalike UPI handles
Scammers use IDs that mimic official ones, for example by swapping the letter O for a zero, adding a hyphen, or tacking “support” or “help” onto a brand name. One finance blog describes these tricks. Always read the full ID, character by character.
7. Screen-sharing and remote-access apps
The caller asks you to install an app so they can “fix” the problem. They then see your screen and can watch your PIN. NPCI’s safety page warns against screen-sharing and SMS-forwarding apps that an unknown person asks you to install.
A Seven-Second Checklist Before You Pay
- Am I paying or receiving? If someone says “receive,” stop.
- Whose name appears? Check the name on the screen against who you meant to pay.
- Is the UPI ID spelled correctly? Read it slowly.
- Is the amount correct? A ₹10 “test” that turns into ₹10,000 is a red flag.
- Am I rushed? If someone pressures you, slow down.
- Is a stranger on the phone? End the call and use official channels.
For a first payment to a new person, some guides suggest sending a small test amount (such as ₹1) first and checking that the right name receives it. That works well for friends and vendors you know, but it won’t protect you from a scam in which you’re asked to approve something.
If You Sell Online or Run a Shop
- Never scan a buyer’s QR code. Share your own code or UPI ID instead.
- Don’t accept a “payment request” workflow. If a buyer says they sent a request to you, ignore it.
- Check your own account for the credit, not a screenshot. Screenshots are easy to fake.
- Inspect your shop’s QR code regularly. Look for stickers placed over it. Laminate or fix it so nobody can overlay it easily.
- Don’t let others use your account to receive or move money, even as a “favour.” You could become part of a money trail.
A Worked Example (Hypothetical)
This scenario is invented to illustrate the process. It isn’t a real case.
Rohit sells a used gaming chair for ₹4,500. A buyer says, “I’ll pay by UPI, send me your number.” After a minute, the buyer writes, “Payment failed. Scan this QR code to receive it instead.”
Rohit remembers the rule. He replies, “I’ll receive when you scan my code.” He sends his own QR code. The buyer disappears. Rohit lost nothing, and he blocks the number.
Now the other version. Suppose Rohit had scanned the buyer’s code. His app would have shown a payment screen with a stranger’s name and an amount. At that point, any PIN he typed would have sent money out. The warning sign wasn’t technical. It was the instruction to scan to receive.
What to Do If You Already Entered Your PIN
Move fast, and report in this order:
- Call 1930, the national cyber fraud helpline, and note the reference number.
- Call your bank through its official number and report the transaction.
- File at cybercrime.gov.in with screenshots and the transaction ID.
- Keep every chat and call record.
Your chances of freezing the money improve the sooner you report. Nobody can guarantee recovery.
Common Mistakes to Avoid
Believing the scammer knows you, so they must be genuine. Fraudsters often hold your name, number, and recent transaction details from leaked data.
Trusting a screenshot as proof of payment. Check your actual balance or account history.
Entering the PIN “just to see.” The PIN screen is the final step before money moves.
Scanning unknown QR codes from WhatsApp or email. A cooperative bank’s safety page advises against it.
Ignoring small unexpected requests. Fraudsters sometimes start small to test whether you’ll approve.
Searching for “customer care” numbers online. Use only the number inside the app or on the card.
Frequently Asked Questions
1. Do I ever need to scan a QR code to receive money?
No. The person paying you scans your code or enters your UPI ID.
2. Can scanning a QR code alone steal my money?
Scanning usually opens a payment screen, and money moves only after you enter your PIN. Still, don’t scan codes from strangers, because some may lead to harmful links.
3. Why does my app ask for a PIN when I get a refund?
It shouldn’t. A genuine incoming payment needs no PIN. A PIN prompt means money is leaving.
4. How do I check that a shop’s QR code is genuine?
Compare the name on your confirmation screen with the shop’s name, and look for stickers over the printed code.
5. Is a ₹1 test payment safe?
It’s a reasonable check for a known recipient. It doesn’t help if the scam asks you to approve or scan something to “receive” money.
6. What if I shared my PIN?
Report at once to 1930 and your bank. Banks may treat shared credentials as customer negligence, but reporting still gives you the best chance.
Conclusion
You can beat almost every UPI QR scam with one rule and one habit. The rule: you never need your PIN or a scan to receive money. The habit: read the name and the action on the screen before you type anything.
Share the rule with someone who’s new to UPI today, such as a parent or a younger sibling. Those first-time users are the ones scammers target most.