UPI QR Code Scam: How It Works and How to Stay Safe

Scanning a QR code has become the most natural way to pay in India, from tea stalls and petrol pumps to parking lots and online sellers. That speed and familiarity is exactly what fraudsters count on. They know most people scan without a second look, so they find ways to put their own QR code in front of you.

The good news is that almost every QR code scam depends on one simple misunderstanding, and once you know it, you are far harder to fool. This guide explains how these scams work, the warning signs, and the exact steps to follow if something goes wrong, so you can keep scanning and paying with confidence.

What Is a UPI QR Code Scam?

A UPI QR code scam is a fraud where someone tricks you into scanning a QR code that sends money out of your account instead of bringing money in, or that leads you to a fake website or harmful app. The golden rule is simple: you never need to scan a QR code or enter your UPI PIN to receive money. A QR code is only ever used to pay.

Every UPI QR code carries the details of the person or business who will receive the money. When you scan it and enter your UPI PIN, you approve a payment to them. Fraudsters either swap a genuine code with their own, or convince you that scanning is how you will "receive" a refund, prize or payment. For a wider look at digital payment fraud, read our guide to common UPI frauds and how to prevent them.

How Does a UPI QR Code Scam Work, Step by Step?

Most QR code scams follow a familiar pattern.

• The hook. The fraudster creates a reason for you to scan: a buyer for something you are selling, a refund, a reward, a donation drive or simply a payment at a counter.
• The QR code. You receive a QR code on chat or email, or you see one at a shop that has been quietly replaced or covered with a fake sticker.
• The false instruction. You are told to scan and enter your UPI PIN "to receive the money." At a counter, you simply pay without checking the name that appears.
• The UPI PIN. Your app shows a payment screen with a payee name the fraudster hopes you will not read. The moment you enter your UPI PIN, money leaves your account.
• The pressure. If the first attempt "fails," you are asked to try again, often with a larger amount.

If any step asks for your UPI PIN while you are expecting money to come in, stop right there.

What Are the Common Types of UPI QR Code Scams?

Fake Buyers on Online Marketplaces

You list an old sofa, phone or bike on a classifieds platform. A "buyer" agrees to your price without bargaining, then sends a QR code and asks you to scan it to receive the payment. Scanning it and entering your UPI PIN sends money to them instead.

Tampered or Overlaid QR Stickers at Shops, Petrol Pumps and Parking

Fraudsters paste their own QR codes over genuine ones at shops, fuel stations, parking lots, toll plazas and temples. Customers believe they are paying the merchant, but the money goes to the fraudster. The shopkeeper often notices only when payments stop arriving.

Fake Donation and Payment QR Codes on Social Media

During festivals, disasters or medical emergencies, emotional appeals with a donation QR code spread quickly on social media and chat groups. Fake QR codes also appear in posts offering discounted products, event tickets or limited-time deals.

QR Codes That Lead to Phishing Sites or Harmful Apps

Some QR codes open a website that looks like a bank, courier company or government service and asks for card details, login details or OTP. Others prompt you to download an app that can read your messages or share your screen. A code that opens your messaging app or tries to send a text on its own is also a warning sign.

Collect Request and Refund Confusion

A payment request, often called a collect request, appears in your UPI app with a note like "refund" or "cashback," so you think you are receiving money. Approving a request with your UPI PIN always means you are paying.

Fake Payment Screenshots and Soundbox Tricks Against Merchants

Merchants are targets too. A customer may show an edited screenshot of a "successful" payment, or play a recorded payment alert from their own phone, and leave without paying. Some fraudsters call shopkeepers posing as a payment provider and ask them to scan a QR code to "activate" their account.

What Are the Red Flags of a QR Code Scam?

Watch out for these warning signs:

• Someone asks you to scan a QR code or enter your UPI PIN to receive money, a refund or a prize.
• A buyer agrees to your price instantly and pushes you to finish quickly.
• The payee name on your screen does not match the shop or person you intended to pay.
• A QR sticker looks pasted over another code or appears freshly printed.
• A scan opens a website, a login page or an app download instead of a payment screen.
• A message creates urgency, such as "offer ends in minutes" or "your account will be blocked."
• You are making a payment on an open public Wi-Fi network.

Safe QR Payment vs QR Code Scam: How Can You Tell the Difference?

How Can You Scan and Pay Safely?

A few simple habits make QR code payments safe. Our guide on how to safely make QR code payments covers everyday basics; these are the checks that stop scams.

• Scan only to pay. If you are expecting money, share your UPI ID or let the other person scan your QR code.
• Never enter your UPI PIN to receive money. Your UPI PIN is only for sending money out of your account.
• Check the payee name before you enter your UPI PIN. After scanning, your UPI app shows the name registered against the QR code. If it does not match the shop or person you are paying, cancel and ask.
• Check the amount. Confirm it is what you agreed to pay, and type it yourself where possible.
• Use your banking app's own scanner rather than a general camera or third-party scanner, so the code opens directly in a payment screen.
• Look at the sticker. At a counter, check that the QR code is not pasted over another one.
• Never share your UPI PIN, OTP or card details, even with someone who claims to be from your bank, and decline payment requests you did not expect.
• Pay on a secure connection. Use your mobile data or a trusted home network for payments, and avoid making payments on public Wi-Fi at cafés, stations or malls.

You can also keep our list of UPI dos and don'ts handy.

What Should Shopkeepers and Merchants Do to Stay Safe?

Merchants can protect both their income and their customers with a few routine checks:

• Check your QR stand or sticker at opening and closing time to make sure no one has pasted another code over it.
• Keep the QR code near the cash counter where staff can see it, and laminate or frame it if possible.
• Confirm every payment in your own app, bank statement or payment speaker before handing over goods. Never rely on a customer's screenshot or a sound from their phone.
• Never scan a QR code or enter your UPI PIN because a caller says it will activate or verify your merchant account.

What Should You Do If You Have Been Scammed?

If you think you have paid a fraudster or shared your details, act quickly. The sooner you report, the better your chances of stopping further loss.

• Block and report to your bank. If you bank with AU Small Finance Bank, call 24x7 customer care on 1800 1200 1200 and ask for your UPI and digital access to be blocked. You can also open the transaction in your recent transactions in the AU 0101 App and choose the report fraud option. See all channels on our Report Unauthorised Transactions page.
• Call 1930 or visit cybercrime.gov.in. Report the fraud on the national cyber fraud helpline or portal. Keep your transaction reference number, the fraudster's UPI ID or phone number, and screenshots ready.
• Raise a dispute in your UPI app against the specific transaction from your transaction history, so the case is recorded.
• Report the number on Chakshu. Use the Chakshu facility on the Sanchar Saathi portal to report the call, SMS or chat used to approach you.
• Secure your phone. Change your UPI PIN and passwords, and uninstall any app you downloaded on a fraudster's instructions.

How Does AU Small Finance Bank Keep You Safe?

AU Small Finance Bank builds safety into every UPI payment made through the AU 0101 App:

• UPI PIN on every payment. Every payment to a person or merchant needs your secret UPI PIN, and a wrong PIN stops the transaction.
• Verified setup. Your mobile number is verified through SMS and your debit card details are verified before you set your UPI PIN.
• Report fraud in the app. You can report a suspicious transaction directly from your transaction history.
• Card blocking on demand. You can block your debit or credit card temporarily or permanently from the app.
• 24x7 support on 1800 1200 1200 to help you report and block suspicious activity.

Learn more about UPI security in AU 0101.

Conclusion

QR codes remain a safe and simple way to pay when used the right way. Almost every QR code scam relies on one mistake: scanning or entering your UPI PIN when you expect to receive money. Remember that a QR code is only for paying, check the payee name and amount before you approve, and look twice at stickers in public places. If something does go wrong, inform your bank, report to 1930 or cybercrime.gov.in without delay, and keep enjoying everyday UPI payments through the AU 0101 App from AU Small Finance Bank with confidence.

Frequently Asked Questions (FAQs)

Do I need to scan a QR code to receive money through UPI?

No. You never need to scan a QR code to receive money. To receive a payment, share your UPI ID, mobile number or your own QR code and let the payer scan and pay. If anyone asks you to scan their QR code so money can come into your account, treat it as a scam.

Is a UPI PIN needed to receive money?

No. Your UPI PIN is needed only to send money or approve a payment from your account. Money coming into your account is credited without any PIN from you. If a caller, buyer or message asks for your UPI PIN to receive a refund, prize or payment, it is a fraud attempt.

How can I check if a QR code is genuine before paying?

Scan the code with your banking or UPI app and read the payee name before you enter your UPI PIN. It should match the shop, person or organisation you intend to pay. Also check that the sticker is not pasted over another code. If the name looks unfamiliar, cancel and confirm with the merchant.

Can scanning a QR code alone take money from my account?

Scanning a UPI QR code by itself does not move money. Money leaves your account only when you approve the payment with your UPI PIN. However, some QR codes open fake websites or prompt app downloads that try to steal your details, so close anything that is not a payment screen.

What should I do if I paid through a fake QR code?

Act quickly. Call AU Small Finance Bank's 24x7 customer care on 1800 1200 1200 to block your UPI and report the transaction, or use the report fraud option in the AU 0101 App. Then call 1930 or file a complaint at cybercrime.gov.in, and raise a dispute in your UPI app.

How do fake buyers on online marketplaces use QR codes?

Fake buyers usually agree to your asking price quickly and offer to pay in advance. They then send a QR code and ask you to scan it and enter your UPI PIN to receive the money. Doing so actually sends money to them. A genuine buyer only needs your UPI ID or your QR code.

How can shopkeepers protect themselves from fake payment screenshots?

Never hand over goods based on a customer's screenshot or a sound played from their phone. Confirm every payment in your own merchant app, bank statement or payment speaker. Check your QR stand daily for pasted stickers, and never scan a QR code because a caller claims it will activate your account.

What is the Chakshu facility and how does it help?

Chakshu is a facility on the Sanchar Saathi portal where you can report suspected fraud calls, SMS and chat messages. If someone approached you with a fake QR code or prize offer, reporting the number helps authorities act against it. Financial losses should still be reported at 1930 or cybercrime.gov.in.