The Core Deception of QR Scams
The entire scam hinges on a simple but critical misunderstanding: QR codes are used to make payments, not to receive them. Fraudsters exploit the public's trust and habits built from countless legitimate transactions at shops and restaurants. The scam typically
plays out in one of two ways. In online marketplaces, a scammer posing as a buyer will agree to purchase an item and offer to pay instantly via UPI. They then send a QR code via WhatsApp or another messenger, telling the seller to scan it to receive the money. In physical locations, fraudsters may paste their own malicious QR code sticker over a genuine one at a shop, petrol pump, or even a temple donation box. In both scenarios, the goal is the same: to trick you into authorising a payment from your account to theirs, under the false pretence that you are authorising money coming in.
The Unbreakable Rule of Digital Payments
To protect yourself, there is one golden rule you must never forget: you never need to scan a QR code or enter your UPI PIN to receive money. Legitimate buyers or senders do not require you to scan anything for them to transfer funds to your account. Any person who insists you must scan a code they provide to get paid is attempting to scam you. This is the most significant red flag. Once you scan their code, your payment app will open a screen asking you to approve a debit transaction. The scammer will then pressure you to enter your UPI PIN to “authorise” or “confirm” the receipt of funds. Remember, your PIN is an authorisation to send money out, not to bring it in.
Your Pre-Payment Safety Checklist
Fraudsters rely on you being rushed or distracted. Before you ever enter your UPI PIN, develop the habit of pausing and running through a mental checklist. First, look at the physical QR code itself. Does it look like a sticker has been pasted over another one? Second, after scanning, carefully check the recipient's name and UPI ID displayed on your phone's screen. Does it match the person or business you intend to pay? Scammers often use personal accounts that have names completely unrelated to the merchant. Third, always verify the amount being debited. Some QR codes can have a pre-filled amount. If someone is telling you to enter a specific amount to "receive" an item, it's a scam. Never approve unexpected payment or collection requests.
Other Common Red Flags to Watch For
Beyond the core deception, several other warning signs can alert you to a potential scam. Be wary of anyone creating a false sense of urgency, with claims like “this is a limited-time offer” or “the payment will expire soon.” This is a social engineering tactic designed to make you act without thinking. Treat any QR code sent to you unsolicited by a stranger via email, SMS, or a messaging app with extreme suspicion. Also, be cautious if scanning a code redirects you to a website instead of your UPI app's payment interface. This could be a phishing attempt to steal your login credentials or banking information. A legitimate payment link should always start with 'https://' and be free of spelling errors.
What to Do If You've Been Scammed
If you realise you have fallen victim to a QR code scam, you must act quickly to maximise the chances of recovering your money. The first and most crucial step is to call the national cybercrime helpline number 1930 immediately. It's recommended to do this within the first two hours to help authorities try and freeze the fraudster's account. Next, report the fraudulent transaction to your bank and the UPI payment app you used (such as PhonePe, Google Pay, or Paytm). You should also file a formal complaint on the National Cyber Crime Reporting Portal (cybercrime.gov.in). When reporting, gather all possible evidence, including the fraudulent transaction ID, screenshots of the payment confirmation and chat messages with the scammer, and their phone number.
