Skip to content

Lost money to a cyber fraud? Call 1930 now and file at cybercrime.gov.in. The first hour matters.

What to do, step by step →
Cyber Crime Help Desk An initiative from Kramate for Society
Scams explained 6 min read

QR Code Scams: Why "Scan to Receive Money" Is Always a Lie

The QR code scam has one trick: convincing you that scanning and entering a PIN will bring money in. It never does. OLX buyer, swapped sticker, and the rule.

By Editorial team, Research and writing · Published
Wooden letter tiles spelling the word phishing

In short

  • Scanning a QR code and entering your UPI PIN sends money. It cannot receive money. There is no exception in any app.
  • The classic QR code scam is the OLX buyer who "pays" by sending you a QR; the army officer who is being transferred is the same character.
  • To receive money you share your UPI ID or show your own QR. If the other person wants you to scan theirs, stop.
  • Read the recipient name the app shows before any PIN, and check that a shop's QR sticker has not been replaced.
  • If you lost money, dial 1930 and raise the dispute in the app the same hour; ignore any recovery agent who calls later.

Who this is for: Anyone who sells things online, pays at shops by UPI, or has ever been told to scan a code to receive a refund, prize or payment.

A QR code is a printed address. When you scan one with PhonePe, Google Pay, Paytm or BHIM, your app reads the address, asks you for an amount if the code does not already contain one, and then asks for your UPI PIN to send money there. That is the whole mechanism. It has no reverse gear. Every QR code scam in India is built on persuading you, for about ten seconds, that it does.

This explainer covers the three versions that account for nearly every complaint: the online buyer who "pays" with a QR, the swapped sticker at a shop, and the QR that is really a link. It ends with the one rule and the one habit that make all three fail.

Why "scan to receive" is a lie in every QR code scam

UPI has two directions. To pay, you scan a code or enter a UPI ID and authorise with your PIN. To receive, you give the other person your UPI ID or show them your own QR code, and they authorise on their phone. You do nothing on your side except wait for the credit. There is no feature in any app where scanning plus a PIN results in money arriving. NPCI, which runs UPI, has said this repeatedly in its customer-safety material.

Scammers rely on three things: that the word "receive" in a message overrides what the screen says, that the payment screen looks much like any other confirmation, and that you will enter the PIN out of habit. Your UPI PIN is only ever a "send" instruction. If you are typing it, money is leaving.

The three versions

The OLX buyer, and the army officer who cannot come

You list a scooter, a fridge or a phone on OLX, Quikr or Facebook Marketplace. A buyer messages within minutes, accepts the price, and explains they cannot visit: they are an army officer being transferred, a CISF or CRPF jawan on duty, a doctor on night shift. They will pay now and send someone to collect. They want your UPI ID, which is fine. Then they send a QR code or a collect request "so the payment reaches you", sometimes with an ID card photo for credibility. If you scan and enter the PIN, you have paid them. Some buyers send ₹1 or ₹10 first, which arrives, to prove the method "works", then send a QR for the full amount plus a "security deposit" that empties your account.

The army officer is a stock character because it explains the absence, invites respect and discourages questions. Real buyers who cannot come send money to your UPI ID and wait for your confirmation.

The swapped QR sticker

Shops, petrol pumps, temples and parking lots display printed QR codes. Overnight, or during a busy hour, someone pastes a different sticker over the original, pointing to a mule account. Customers pay, the soundbox stays silent, and the owner discovers it when the day's collections do not match. The customer loses nothing; the merchant loses every payment until the sticker is found. The same trick appears with donation drives and charity QR codes shared on WhatsApp, where a copied poster carries a changed code.

Not every QR code opens a payment. Some open a website or an app download. A "scan to claim your reward" code on a flyer, a "scan to track your parcel" code in an email, or a code sent by a "customer care executive" can lead to a phishing page that asks for card details, or to an APK that reads your SMS. If your phone opens a browser rather than a payment screen after a scan, close it.

Collect requests: the same lie without a code

A collect request is a payment request that arrives inside your app, often with a note. Scammers send one labelled "Refund", "Cashback" or "Receive payment", and the victim approves it with a PIN believing they are accepting money. Approving a request pays the requester; that is all it can do. The UPI fraud guide covers this and the other tricks in detail, and shows how to switch collect requests off where the app allows.

What to do if you scanned and paid

In the first hour

  • Dial 1930 with the transaction ID, the receiving UPI ID and the exact time; the receiving bank can hold whatever is still in the account.
  • Raise a dispute inside the payment app on that transaction.
  • File on cybercrime.gov.in and keep the acknowledgement.
  • Write to your bank the same day. Under the RBI's 6 July 2017 circular, third-party fraud reported within three working days carries zero customer liability; banks will say you authorised it, and the reply is that you were deceived by a third party.
  • Screenshot the chat, the buyer's profile, the QR image and the phone number before blocking.

The full order of steps is on our reporting page, and what the app-level dispute can and cannot achieve is in our NPCI dispute explainer. Merchants who find a swapped sticker should also report the mule UPI ID on cybercrime.gov.in; it is the thread the police follow.

After any loss, expect a call from a "recovery agent" or a "UPI reversal team" who knows your exact figure and offers to retrieve it for a fee. The details came from the same network. Nobody can guarantee recovery and no agency contacts victims unasked. Our financial fraud response service handles the bank and police follow-ups for a fixed fee if you want it done for you.

Setting up so the mistake is small

Link UPI to an account that holds spending money only, set a daily limit in the app, and keep savings in an account with no UPI; our secure UPI setup guide walks through each setting. Sellers should insist on receiving money to their UPI ID and waiting for the bank SMS before handing anything over. Shopkeepers should check their QR sticker daily and never accept a screenshot as proof. Contactless variants of the same trick, including NFC tap frauds, are in QR, NFC and contactless frauds, and the wider category is on the online financial fraud page.

Someone wants you to scan a QR to receive money? No such thing exists. If you already paid: dial 1930, dispute in the app, write to the bank today.
Helplines by state →

Frequently asked questions

How does scanning a QR code take my money if I am supposed to be receiving?

A UPI QR code encodes the other person's UPI ID and often an amount. When you scan it, your app sets up a payment from you to them, and your PIN authorises it. There is no kind of QR that pulls money into the scanner's account; the protocol does not work that way. If you are told otherwise, the person telling you is the one who will be paid.

What exactly does the OLX buyer do?

The buyer agrees your price without haggling, says they cannot come in person because they are posted with the army or CISF, and offers to pay in advance. They send a QR code or a collect request "for you to receive the money". If you scan and enter your PIN, you pay them. Some send a small genuine payment first to build trust, then a QR for a larger "balance" that drains your account.

I only scanned the code and did not enter the PIN. Is anything lost?

No. A scan on its own does nothing; the PIN is the authorisation. Close the payment screen and do not go back. If the QR led to a website rather than a payment screen, do not enter anything there either; some codes open phishing pages or app downloads. Delete anything that was downloaded and block the person who sent it.

How do shopkeepers get cheated with QR codes?

Two ways. A fraudster replaces the shop's printed QR sticker with one pointing to their own account, so customers' payments go elsewhere until the owner notices the soundbox is silent. Or a customer shows a fake "payment successful" screen and leaves. The defence is the same: confirm every payment on your own device or soundbox, and check that the sticker on your counter is yours every morning.

Can I get money back after a QR code scam?

Sometimes, if you act within the hour. Dial 1930 with the transaction ID, the receiving UPI ID and the time, raise a dispute in the app, and write to your bank the same day. The receiving bank can hold what is still in the account. Release needs a court order and takes months. Anyone who later offers to recover it for a fee is running the follow-up scam.

If you want help with this

  • Online financial fraud response · Money gone through UPI, net-banking, card or wallet. We get the complaint, bank dispute and regulator escalation right, in the order and at the speed that gives frozen money a chance.
  • Citizens' cyber safety session · training · A 90-minute session, in Hindi or English, that teaches any group to recognise the four moves of a scam and to hang up at move two.
Talk to us
E

Written by

Editorial team

Research and writing

Keep reading