The Golden Rule of QR Payments
The most important thing to remember is simple: you only scan a QR code to send money, never to receive it. Scammers often exploit this confusion, especially in online sales or peer-to-peer transactions. They will pose as a buyer and send you a QR code,
claiming that scanning it will allow you to receive their payment. In reality, scanning the code opens a payment request in your UPI app, and entering your PIN authorises a transfer from your account to theirs. If anyone ever tells you to scan a code to get paid, it is almost certainly a scam.
Beware of Tampered Physical Codes
In physical locations like shops, restaurants, and parking areas, be wary of QR codes that look altered. Scammers often place a sticker with their own malicious QR code directly over the legitimate one. Before you scan, take a moment to inspect it. Look for signs of tampering, such as mismatched logos, peeling edges, or a sticker that feels freshly placed. Genuine businesses typically display professionally printed and integrated QR codes. If the name that appears on your UPI app after scanning does not match the merchant's name, do not proceed with the payment. Always confirm the recipient's name before entering your PIN.
Quishing: The QR Code Phishing Scam
A growing threat known as "quishing" (QR phishing) uses QR codes to lead you to malicious websites. These codes often arrive in emails, text messages, or on social media, disguised as urgent notifications about account updates, deliveries, or special offers. Because you cannot see the destination URL hidden within the code, it bypasses many traditional security filters. Once scanned, you might land on a fake login page designed to steal your banking credentials or a site that automatically downloads malware onto your device. Be suspicious of any unsolicited QR code, especially if it creates a sense of urgency.
How to Verify Before You Scan
If you are unsure about a QR code, there are ways to check it. Some scanner apps or phone features like Google Lens can show you a preview of the destination link before opening it. Examine the URL carefully. Warning signs include misspelled company names, random characters, or a web address that does not start with "https." For payments, always use trusted and official UPI apps, which have built-in security features. The Reserve Bank of India (RBI) mandates that payment operators use interoperable and secure QR codes, such as UPI QR and Bharat QR, to protect consumers.
Protecting Yourself in Online Transactions
When buying or selling items on online marketplaces, be extra cautious. Fraudsters posing as buyers are a common source of QR code scams. They may build trust by quickly agreeing to a price and then rushing you to complete the transaction by scanning a code they send via WhatsApp or email. Similarly, scammers might create fake e-commerce websites with QR codes for payment. These can lead to fraudulent payment portals that steal your financial details. Stick to reputable platforms and be skeptical of any payment process that deviates from the standard, secure checkout system.
What to Do If You've Been Scammed
If you suspect you have scanned a malicious QR code and lost money, act immediately. First, contact your bank to report the fraudulent transaction and see if the payment can be stopped or reversed. You should then report the incident to the National Cyber Crime Reporting Portal at cybercrime.gov.in or by calling the helpline number 1930. Preserve all evidence, including screenshots of the fraudulent QR code, chat messages, and transaction details, as this will be crucial for the investigation. Finally, change the passwords for your banking and email accounts to prevent further unauthorised access.
