SafeNetGuide
Act Now
high Risk ThreatTier 1 Priority

UPI & QR Code Fraud

Scammers abuse QR codes and UPI collect requests, tricking you into believing you must enter your UPI PIN to receive a payment or refund. Entering a PIN always sends money.

At a Glance

Contact Channelswhatsapp, sms, app, call
Common Targetssellers, seniors, students, everyone
Scammer's Goalmoney, account-access
Harm Severityhigh

What is it?

What is it?

Unified Payments Interface (UPI) is one of the most reliable payment ecosystems in the world. However, fraudsters exploit widespread confusion about how UPI works: specifically, the difference between sending money and receiving money. By sending “Collect Requests” masked as refunds or sharing deceptive QR codes, criminals trick victims into authorizing debits from their own bank accounts.

The Immutable Rule of UPI

  • To RECEIVE money: You only need to share your mobile number or UPI ID. You never enter a PIN, you never scan a QR code, and you never press “Pay” or “Approve”. Money arrives automatically.
  • To SEND money: You must enter your secret UPI PIN. Entering your PIN is your digital signature authorizing money to leave your bank account.

How it Works (Step by Step)

Written from the victim's perspective to help you spot each stage before damage occurs.

  1. 1Step 1: The fraudster contacts you posing as an eager online buyer, utility refund representative, or contest sponsor.
  2. 2Step 2: They claim they are trying to transfer money to you, but state that your UPI handle requires 'confirmation'.
  3. 3Step 3: They generate a payment 'Collect Request' or a debit QR code and send it over WhatsApp or email.
  4. 4Step 4: They instruct you to open your UPI app, scan the code, and type your 4 or 6-digit UPI PIN to 'release the funds'.
  5. 5Step 5: The moment you enter your PIN, the money is instantly debited from your account and credited to the scammer's wallet.

Red Flags to Watch For

  • Anyone telling you to 'scan this QR code to receive your refund or cashback'.
  • A prompt on Google Pay, PhonePe, or Paytm asking for your UPI PIN to 'accept' money.
  • Buyers on marketplaces (OLX, Facebook Marketplace) demanding to pay advance deposits via QR code.
  • Customer support agents instructing you to install screen-sharing apps (AnyDesk, RustDesk, TeamViewer) to fix UPI errors.
  • Receiving an unexpected 'Collect Request' notification from an unfamiliar UPI handle.

Example (made up): The 'Army Buyer' Resale QR Trick

Fictional Scenario

"Priya listed an old bicycle on an online resale marketplace for Rs 6,000. Within 15 minutes, a buyer claiming to be an army officer agreed to buy it without bargaining. He sent a QR code on WhatsApp and texted: 'Madam, I have sent a barcode. Please scan it on PhonePe and enter your PIN so Rs 6,000 is credited.' Priya recognized that PINs are only for sending money, refused to enter it, and blocked the scammer."

Why this was a trap:

  • ⚠️Instant buyer without bargaining -> Rushes victim before they can think.
  • ⚠️Army officer persona -> Fabricated trust credential.
  • ⚠️Scan QR to receive money -> Technical impossibility in UPI architecture; QR scans only debit funds.

What to Do

  • ✓Remember the golden rule: You NEVER need to enter a UPI PIN or scan a QR code to RECEIVE money.
  • ✓Verify the recipient name shown in your UPI app before entering your PIN for legitimate payments.
  • ✓Set a daily UPI transaction limit through your bank's mobile banking app.
  • ✓If you sent money by mistake or fraud, call 1930 immediately within the first hour.

What NOT to Do

  • ✕Do NOT enter your 4-digit or 6-digit UPI PIN when someone promises to send you money.
  • ✕Do NOT approve unknown Collect Requests in your payment applications.
  • ✕Do NOT download screen-sharing or remote-control apps on instructions from customer care.
  • ✕Do NOT trust payment screenshots sent by buyers; verify your actual bank balance directly.

If It Already Happened: Immediate Steps

View Full Emergency Flow
  1. 1Call 1930 immediately: UPI transfers can sometimes be frozen in inter-bank transit if reported within minutes.
  2. 2Raise a dispute inside the payment app (Google Pay / PhonePe / Paytm / BHIM) under 'Report Fraudulent Transaction'.
  3. 3Block the scammer's UPI ID and mobile number in the app.
  4. 4Save the transaction ID (UTR number), screenshot of the request, and mobile number as evidence.

💬 Tell Your Family (WhatsApp Message)

< 60 words

Safety reminder: Entering your UPI PIN or scanning a QR code ALWAYS sends money OUT of your bank account. You never need a PIN to receive money or refunds. If someone asks for your PIN to pay you, it is a 100% scam.

Related Scams

Digital Arrest Scam

Criminals pose as police, CBI, or customs on video calls, threatening immediate arrest unless you transfer money to a 'safe account'. Real police never do this.

Fake Job & Task Scams

Scammers promise guaranteed daily earnings for liking videos or rating places. After paying small initial bonuses, they lock victims into depositing tens of thousands in fake 'task wallets'.

Verified Primary Sources & Evidence

Facts verified on: 2026-10-22
Reviewed by: Editorial Review Panel • Last review: 2026-10-22
Back to top ↑