The one fact that explains every QR scam
Scanning a QR code can only ever send money out of your account. It can never pull money in. Every UPI QR scam works by getting round that fact, either by making you send money to the wrong person, or by convincing you that sending money is how you receive it.
Once you hold onto that, the individual tricks stop looking clever.
The QR swap
A fraudster prints a QR that pays their own UPI ID and pastes it over the shop's QR at the counter. Customers scan it, pay in good faith, and the shopkeeper never sees the money. It often runs for days, because nobody checks the sticker and the shopkeeper only notices at closing.
What stops it: the payer reading the account holder name in their app before confirming, and the shopkeeper physically checking the display at open and close. If you run a shop, laminate the QR, fix it under glass or behind acrylic, and look at it daily. Insist that customers show you the completed payment screen rather than a screenshot of one.
The refund and cashback trap
You are told you are owed a refund for a cancelled order, a failed transaction, or an insurance claim. To receive it, you are asked to scan a QR or approve a request. The moment you enter your UPI PIN, money leaves your account.
What stops it: knowing that a genuine refund needs nothing from you. It simply appears. No legitimate refund has ever required a PIN.
The collect request
UPI lets anyone request money from anyone. Fraudsters send a collect request labelled to look like a payment arriving, sometimes with a note such as "Payment received, approve to credit". Approving it authorises a debit.
What stops it: reading whether your app says you are paying or receiving. Receiving money never needs approval. Decline every collect request you did not personally initiate, and turn the feature off in your app if you never use it.
The marketplace seller and buyer
On classified and resale sites, a "buyer" claims to have sent an advance and shares a QR or a request for you to "confirm receipt". Or a seller demands a token payment to hold an item that does not exist. Fake payment confirmation screenshots are common and take seconds to produce.
What stops it: only ever treating money as received when you see it in your own bank or UPI app balance. A screenshot is a picture, not a payment.
The QR in an email or a PDF
An invoice arrives from what looks like a known supplier, with a QR in the footer. The email is spoofed, or a real invoice was intercepted and its QR replaced. This one targets businesses and the amounts are large.
What stops it: reading the QR before paying it. Drop the invoice QR into the UPI QR checker and compare the UPI ID against the one your supplier gave you previously, over a channel you initiated. For a first payment to any new supplier, confirm the UPI ID by phoning a number you already had, never a number printed on the invoice.
Warning signs worth memorising
- Any pressure to act quickly. Urgency exists to stop you thinking.
- Being asked for a UPI PIN, an OTP, a card number, or a CVV, by anyone at all.
- Being asked to install AnyDesk, TeamViewer, or any other screen sharing app.
- A QR sent alongside a promise of a refund, prize, cashback, or KYC deadline.
- A payment address that does not match the business name, when you have no other reason to expect a mismatch.
- A QR image that opens a website rather than a payment screen.
If it has already happened
- Call your bank and ask them to raise a dispute and flag the beneficiary account. Do this first, and do it now. Speed decides whether anything can be frozen.
- Report it on the 1930 cyber financial fraud helpline, or at cybercrime.gov.in.
- Keep everything: the QR image, the chat or email, the UPI reference number, and the timestamp.
- If a shop QR was swapped, tell the shop. They are a victim too and may not know yet.
Recovery is genuinely possible when the report is fast, and genuinely unlikely when it is not. This website is independent, has no connection to any bank, the NPCI, or the police, and cannot recover money or intervene on your behalf.