QR Code UPI Payment Scam — How to Identify & Stay Safe

INDIA — By BharatSecure Threat Intelligence Team · Updated May 25, 2026

Severity: CRITICAL | View Full Scam Details

QR Code UPI Payment Scam in India 2026: Stay Alert Against This Rising Digital Fraud

The QR Code UPI Payment scam is a critical cyber threat sweeping across India in 2026, targeting vendors and everyday users through WhatsApp and SMS to steal money via fake payment requests.

What Is the QR Code UPI Payment Scam?

This scam exploits India’s widely used Unified Payments Interface (UPI) system, combined with QR codes, to trick victims into authorizing fraudulent payments. Scammers pose as buyers or customers—often reaching out via WhatsApp or SMS—claiming they want to pay for goods or services quickly. They send fake QR codes or manipulate genuine ones, prompting sellers or individuals to scan and confirm payments, unknowingly transferring money to the fraudsters.

Primarily targeting small business owners, street vendors, and social media sellers, this scam thrives because UPI is trusted for fast, hassle-free transactions. The scam’s reach has grown sharply in 2025–26, especially in metro and tier-2 cities where QR code payments are common. According to warnings from CERT-In (India’s Computer Emergency Response Team), and advisories from RBI, this scam is categorized as a critical threat with a risk score of 9/10. The Indian government’s I4C (Indian Cyber Crime Coordination Centre) also highlights that the combination of instant payments and social media contact makes users vulnerable.

How This Scam Works — Step by Step

1. Initial Contact: Fraudsters first contact sellers or vendors via WhatsApp or SMS, often after spotting their products on social media platforms like Facebook Marketplace or Instagram. They may pose as genuine buyers expressing interest.

2. Creating Urgency: The scammer insists on instant payment through UPI to secure the deal, sometimes offering to pay extra or “refund” any extra amount for goodwill.

3. Sending the Fake QR Code: The fraudster sends a QR code image to the victim, purportedly for payment. However, this QR code is either fake or linked to a wallet or account controlled by the scammer.

4. Prompting Payment Confirmation: The victim scans the QR code using their UPI app (Google Pay, PhonePe, Paytm) and proceeds to authorise the payment. Often, the fraudster instructs them to scan the code multiple times, sending confusing instructions to keep the victim engaged.

5. Unauthorized Payment: When the victim authorizes the payment, the money goes directly to the scammer’s account. Because UPI transactions are mostly irreversible, the victim cannot get the money back through the app.

6. False Refund Requests: Sometimes, scammers claim they sent an extra amount by mistake and ask the victim to refund the difference. This tricks victims into sending more money back.

7. Blocking and Disappearing: Once the scammer has the money, they block the victim on WhatsApp and disappear.

Real Warning Signs to Watch For

• Unsolicited WhatsApp or SMS messages from unknown buyers asking for immediate payment via QR code.
• Payment requests that pressure you to act quickly or follow confusing instructions.
• QR codes sent as images rather than official UPI payment links.
• Buyers wanting to “refund” extra money or asking for multiple payments.
• Requests to scan QR codes multiple times or to approve transactions unusual for your business.
• Refusal to discuss terms over voice call or unwillingness to share real contact details.
• Contacts appearing new or with limited profile information on WhatsApp.

What Happens to Victims

Victims of this scam often lose significant amounts of money, sometimes thousands or even lakhs of INR, especially if they are business owners relying on daily sales. Because UPI payments do not have a straightforward reversal process (unlike credit card chargebacks), the money usually can’t be recovered easily.

Besides financial loss, many victims face emotional distress. They feel violated, embarrassed, or worried about their financial security. Cases also surface where scammers misuse Aadhaar-linked mobile SIM cards after SIM swaps to intercept OTPs, worsening the damage by draining linked bank accounts or taking loans fraudulently.

Simultaneously, victims’ trust in digital payments like UPI—which is promoted by the government for convenience—increases hesitation towards QR code payments, impacting local businesses.

What RBI and CERT-In Say

The Reserve Bank of India (RBI) and CERT-In have issued warnings against frauds involving QR codes and UPI payments. They remind users:

• Never to scan QR codes sent by unknown contacts without verifying authenticity.
• To avoid sharing OTPs or UPI PINs with anyone, even if they claim to be support staff.
• That legitimate payment apps never ask for PINs or passwords over calls or messages.

CERT-In’s cybercrime helpline (1930) is available to report such cases, and RBI’s customer helpline supports fraud reporting related to UPI transactions. Both emphasize the importance of timely reporting because once UPI funds are transferred, recovery is difficult.

The Indian Cyber Crime Coordination Centre (I4C) encourages users to stay informed about trends in payment frauds and to be cautious with digital QR code payments.

How to Protect Yourself

1. Verify buyers personally—call the buyer on the phone before accepting payment or sending goods.
2. Use only official UPI apps to scan QR codes from known, trusted sources.
3. Never authorize payments based on images sent via WhatsApp or SMS unless you have verified the sender in person.
4. Avoid “refund” transactions or paying back “extra” money unless you have proof of the original transaction.
5. Enable UPI transaction alerts via SMS and email linked to your bank account.
6. Keep your UPI PIN, OTPs, and Aadhaar details private—never share these with anyone.
7. Regularly check your bank and UPI app statements for unauthorized transactions.

What to Do If You’ve Been Targeted

• Immediately contact your bank or UPI app’s customer care to report the fraudulent transaction and request blocking of further payments.
• Report the scam to the National Cyber Crime Reporting Portal at cybercrime.gov.in.
• Call the CERT-In helpline at 1930, mentioning details of the scam.
• File a complaint with local police, providing WhatsApp/SMS screenshots and transaction details.
• Inform your mobile service provider if you suspect SIM swap or Aadhaar misuse.
• Change all related passwords and UPI PINs immediately.
• If possible, get your Aadhaar linked bank accounts checked for suspicious activity by your bank branch.

Frequently Asked Questions

Q: Can I reverse a fraudulent UPI payment made to a scammer?
A: Unfortunately, UPI transactions are designed to be instant and usually cannot be reversed. You must report the fraud quickly to your bank and cybercrime authorities to try and freeze accounts or initiate investigation, but refunds are not guaranteed.

Q: How can I be sure a QR code payment request is genuine?
A: Always verify the QR code source physically or through trusted channels. Avoid scanning QR codes sent as images or through WhatsApp/SMS from unknown persons.

Q: What should I do if I receive a suspicious payment request on WhatsApp?
A: Don’t respond directly. Verify the person’s identity independently, do not scan any QR codes sent, and report the message to cybercrime.gov.in or through BharatSecure.app’s verification tools.

Stay safe and always verify suspicious payment requests and messages. If you ever doubt a UPI QR code or payment link, take a moment to check its authenticity at BharatSecure.app — your trusted guide against digital fraud in India.