QR Code Scam: Never Scan QR to Receive Money — How to Identify & Stay Safe

Severity: CRITICAL | View Full Scam Details

Beware the QR Code Scam in 2026 India: Never Scan QR Codes to Receive Money

Scammers in India are using fake QR codes to steal money via UPI apps—beware before you scan any QR code to receive payments.

What Is the QR Code Scam: Never Scan QR to Receive Money?

In 2026, India continues to push digital payments, especially through UPI apps like Google Pay, PhonePe, and BHIM. While this has made paying and receiving money effortless, scammers have found new ways to exploit the trust people place in UPI. One rising threat is the QR Code Scam, where fraudsters trick victims into scanning a malicious QR code to receive money but end up losing their own bank funds instead.

This scam mostly targets everyday Indians who use online marketplaces such as OLX, Quikr, or WhatsApp groups to buy or sell goods. Scammers pretend to be interested buyers or sellers and push victims into scanning a QR code that supposedly confirms a payment. However, the QR code is rigged to do the opposite—it initiates unauthorized money transfers from the victim’s bank account.

The scam is alarmingly widespread across India, with many reports coming from metro hubs like Delhi, Mumbai, Bengaluru, and also tier-2 cities where digital payment adoption is rapidly increasing. The Indian government’s Computer Emergency Response Team (CERT-In) and the Ministry of Home Affairs’ Indian Cyber Crime Coordination Centre (I4C) have issued warnings about this scam due to its sophistication and rising cases.

How This Scam Works — Step by Step

1. Fake Listing or Response: The scam begins when you post an ad selling a product online or respond to a seller’s post on platforms like OLX or WhatsApp Marketplace.

2. Engagement by Fraudster: The scammer contacts you, acting interested and friendly, often quickly building trust by offering to pay upfront or asking for swift closure of the deal.

3. Introducing the QR Code: To "facilitate" the payment or request one, the fraudster sends you a QR code to scan, claiming it’s for you to receive money via UPI.

4. Victim Scans the QR: You use your UPI app to scan the QR code, expecting to receive payment or verify the transaction.

5. Unauthorized Transaction Triggered: Instead of crediting your account, the QR code initiates an outgoing payment from your bank account to the scammer’s account. This happens silently without additional authentication because UPI transactions are already linked to your Aadhaar-verified mobile number.

6. Urgency and Reassurance: Meanwhile, the scammer keeps messaging to maintain calm or assert that the transaction is being processed—lulling you into a false sense of security.

7. Victim Realizes the Loss: After some time, you notice money missing from your bank or UPI-linked account. The scammer may block you or disappear, making recovery difficult.

Real Warning Signs to Watch For

• Unsolicited or sudden requests to scan a QR code for receiving money.
• Pressure or urgency to complete the payment or deal quickly.
• QR codes sent via WhatsApp, SMS, or email from unknown numbers/accounts.
• Fake listings or profiles with little information or inconsistent details.
• Promises of overpayment or refund via QR scan.
• Lack of willingness to confirm payment via official UPI transaction statements or bank SMS alerts.
• Suspicious grammar or spelling mistakes typical of phishing messages.

What Happens to Victims

Victims of this scam often face direct financial loss, with amounts withdrawn instantly from their bank accounts linked to UPI. Unlike failed transactions, these unauthorized payments are challenging to reverse as the scam exploits genuine UPI mandates from trusted apps on Aadhaar-registered mobile numbers. Some victims report that their SIM cards were cloned or misused in SIM swap frauds to approve these transactions, causing a ripple effect where attackers gain further control over their smartphones and accounts.

Beyond monetary loss, victims suffer emotional distress, anxiety, and a loss of trust in digital payments. For lower and middle-income Indians, even small fraudulent withdrawals of a few thousand rupees can cause severe hardship and distrust in national digital progress.

What RBI and CERT-In Say

The Reserve Bank of India (RBI) and CERT-In have issued repeated advisories cautioning users against scanning unsolicited QR codes. The RBI stresses that payment should only be made to or received from verified sources and warns users never to scan QR codes on unknown or suspicious platforms.

CERT-In recommends vigilance while using UPI apps: verifying payees, checking transaction details before approval, and immediately reporting unauthorised transactions via the 1930 cybercrime helpline or the RBI customer grievance portal.

Both organizations participate in public awareness drives under I4C, emphasizing that no legitimate buyer or seller will pressure you to scan an unknown QR code without proper transaction authorization.

How to Protect Yourself

1. Only scan QR codes received through trusted sources and verified contacts.
2. Never scan QR codes sent unsolicited via WhatsApp, SMS, or email.
3. Confirm UPI transaction details before approving any payment or receipt requests.
4. Use the UPI app’s integrated scanner in the app itself rather than any third-party QR reader.
5. Enable Two-Factor Authentication (2FA) and PINs on your UPI app and bank accounts.
6. Regularly monitor your bank and UPI statements for any unusual transactions.
7. Avoid sharing your Aadhaar-linked mobile number or OTPs with anyone.

What to Do If You've Been Targeted

• Immediately block your UPI payment app or bank account, if possible, using the app or bank’s customer service.
• Call the Indian Cyber Crime Coordination Centre (I4C) helpline 1930 to report the fraud.
• File an online complaint at cybercrime.gov.in, specifying the details of the QR code scam.
• Inform your bank and lodge a written complaint requesting transaction reversal or compensation.
• Change your UPI PIN and Aadhaar-linked mobile SIM’s security settings to prevent further breaches.
• Inform close contacts to be alert for similar scams using your compromised details.

Frequently Asked Questions

Q: Can scanning a QR code to receive money ever be safe?
A: Yes, but only if you generate the QR code yourself from your UPI app or receive it from a trusted, verified contact. Never scan QR codes sent unsolicited or from strangers.

Q: Why does scanning a QR code lead to money being taken from me instead of received?
A: Fraudulent QR codes can encode payment instructions that trigger outgoing transfers from your bank account without your full knowledge, exploiting trust in the UPI system.

Q: Will my bank refund me if money is lost through this scam?
A: RBI guidelines obligate banks to investigate and resolve such cases, but recovery is not guaranteed if the victim authorizes the payment unknowingly. Always report promptly to increase chances of reimbursement.

Stay safe and always verify suspicious QR codes and payment requests before scanning. If you receive any strange payment links or QR codes, check with BharatSecure.app first to protect your money and data.