UPI QR Code Scams: How to Stay Safe
Receiving money through UPI never requires scanning a QR code or entering your PIN, only paying does. Scammers exploit this by sending a QR code and claiming you need to scan it and enter your PIN to receive a refund, prize or payment, when scanning actually authorises a payment out of your account instead.
Receiving money through UPI never requires you to scan a QR code or enter your PIN; only paying money does. Scammers rely on this confusion, sending a QR code and claiming that scanning it and entering your PIN will let you "receive" a refund, prize or payment, when in reality that action authorises a payment out of your account to them.
The one rule that stops most of these scams
UPI is built so that receiving funds needs nothing from you beyond sharing your UPI ID or a QR code that others scan to pay you. Your PIN exists solely to authorise a payment you are making, never one you are receiving. If any message, call or in-person interaction tells you to scan a code or enter your PIN in order to get money, that instruction alone is the giveaway that something is wrong, regardless of how convincing the rest of the story sounds. RBI puts it plainly: never scan any QR code to receive money, and if an app asks for your PIN to complete a transaction, you are sending money, not receiving it.
Before acting on a QR code someone sends you, check exactly what it is asking with the QR code scanner, which shows the destination or payment request before you approve anything.
Common scam patterns
- The fake refund or cashback: a "buyer" or "support agent" claims they accidentally sent extra money, or that you have a refund waiting, and asks you to scan a QR code and enter your PIN to "receive" it.
- The "request money" trick: RBI's BE(A)WARE booklet describes fake buyers on online sales platforms who, instead of paying, send a UPI collect request and insist you approve it with your PIN. Approving it sends your money to them.
- The online marketplace deal: someone buying an item you listed online sends a QR code claiming it is how they will pay you, when scanning it and entering your PIN actually sends money from your account to theirs.
- The fake delivery or courier fee: a message claims a small payment confirmation is needed to release a parcel or reward, using the same scan-and-PIN trick.
- The impersonation call: someone claiming to be from a bank, a government scheme or a company asks you to scan a code to verify your account or receive a benefit.
How the scam actually works technically
A UPI QR code encodes a payment request, including the recipient's UPI ID and sometimes an amount. Scanning it opens your UPI app's payment screen, pre-filled with that request. If you enter your PIN at that screen, you are approving a payment to whoever the code points to. Genuine incoming money needs none of this; it simply lands in your account once someone else pays you, without any action from your side.
Checks to make before you scan or approve anything
- Ask yourself whether you are trying to pay or receive money. If you are meant to receive it, no scan or PIN should be needed at all.
- If someone insists you must scan a code and enter your PIN to receive money, treat that as a clear warning sign and stop.
- Read the payee name and amount shown on your UPI app's screen carefully before entering your PIN for any transaction.
- Never share your PIN, OTP or full card details with anyone over a call, message or chat, regardless of who they claim to be.
- For an unfamiliar QR code, check where it actually leads using scanning a QR code from a screenshot or photo before acting on it directly through your payment app.
If you have already lost money to a scan-to-receive scam
Report the incident immediately to the National Cyber Crime Reporting Portal (cybercrime.gov.in) or call the cybercrime helpline 1930, and inform your bank right away so they can flag the transaction. Report as quickly as you can: the sooner the bank and the police know, the better the chance of stopping the money before it moves further.
Running a shop or business that receives UPI payments
If you display your own QR code for customers to pay you, that code is meant to be scanned by the payer, who then enters their own PIN to complete the payment to you. You, as the person receiving, never scan anyone else's code or enter your PIN as part of that transaction. See the UPI QR code for shop guide for setting up a genuine receiving QR code correctly.
Why these scams keep working despite the awareness
Most cases are not a technical hack at all; they succeed through social engineering, where a scammer builds urgency or a believable story so the victim acts quickly without pausing to check the payee name and amount on their own screen. A scammer posing as an interested buyer for something you are selling online, or someone claiming a small verification payment is needed, both rely on the same underlying trick dressed up differently each time.
The single most reliable defence is not any app feature but the habit of pausing before entering a PIN: read exactly what the screen says you are about to do, and if it says you are paying someone when you expected to be receiving money, stop immediately.
Common mistakes
- Scanning a code and entering a PIN because someone convincingly claimed it was needed to "receive" money.
- Not checking the payee name and amount on the confirmation screen before entering a PIN for a legitimate payment.
- Sharing a PIN or OTP with anyone claiming to be from a bank or company over phone or chat.
- Delaying a scam report, which reduces the chance of recovering the money.
- Assuming a scam only happens through messages, when it can also happen through a QR code shown in person or on a poster.
UPI QR Code Generator
Same settings as the full tool page.
Runs in your browser. Nothing you type is sent to our server. Open the full UPI QR Code Generator page
Tools for this
Frequently asked questions
Do I ever need to scan a QR code to receive money on UPI?
No. Receiving money on UPI never requires scanning a QR code or entering your PIN. Only paying money requires those steps.
Someone said scanning a QR code will give me a refund. Is that real?
No genuine refund process requires you to scan a QR code and enter your PIN. This is a common scam pattern; scanning and entering your PIN in that situation actually sends money out of your account.
What should I do if I already scanned a scam QR code and lost money?
Report it immediately to the National Cyber Crime Reporting Portal (cybercrime.gov.in) or call 1930, and inform your bank right away so they can try to flag or reverse the transaction.
How can I check what a QR code actually does before scanning it?
Use a QR scanner that shows the payment request or destination link before you approve anything, and read it carefully rather than entering your PIN automatically.
Is it safe to display my own UPI QR code for customers?
Yes, that is the normal way for customers to pay you. You are only ever the one who scans and approves a payment when you are paying someone else, not when customers pay you.
Sources
- Reserve Bank of India, BE(A)WARE: modus operandi of financial fraudsters (checked 2026-09)
- National Cyber Crime Reporting Portal (helpline 1930) (checked 2026-09)
Rules and limits change. Always check the latest official notification or portal before you submit a form.