QR-code 'receive money' scam: why scanning only ever pays (India)
Last updated: 2026-07-11
You never receive money by scanning a QR code or entering your UPI PIN. Scanning a QR and entering your PIN always means you are paying, not being paid.
So anyone who says "scan this QR to get your refund / prize / payment" or "just enter your UPI PIN to receive the money" is running a scam — that action can only debit your account. To actually receive money you do nothing at all, or at most share your UPI ID or phone number. No scan, no PIN, no "approve" — those are only ever needed to pay.
The one rule
Receiving money is passive: the sender pushes it to your UPI ID and it simply arrives. You are never asked to scan, to type your PIN, or to approve a "collect" request to get money. Your UPI PIN is the key that sends money out — entering it can only take money from you, never add money to you. If a "payment" needs your PIN, it is a debit dressed up as a credit.
To pay vs to receive
| What you do | To PAY someone | To RECEIVE money |
|---|---|---|
| Scan a QR code | Yes — a QR is a "pay to this account" code. | No — you never scan to receive. |
| Enter your UPI PIN | Yes — the PIN authorises money leaving your account. | No — receiving never needs your PIN. |
| Approve a "collect" / payment request | Yes — approving sends money out. | No — you don't approve anything to be paid. |
| Share your UPI ID or phone number | Not needed to pay. | Yes — this is all a genuine sender needs. |
The scammer's whole trick is to make a debit look like a credit. They send a QR, a "collect request", or a link and say it will bring money in. Every one of those, once you scan or enter your PIN or tap approve, sends money out. Read the amount and the direction on your own screen before you ever enter a PIN — your app shows whether you are paying or being paid.
Common versions of this trick
- A "buyer" on a marketplace who insists on sending an advance "by QR" and needs you to scan or enter your PIN.
- A "refund", "cashback", "prize", or "lottery" that asks you to scan a QR or approve a request to claim it.
- A "customer-care" or "support" contact who sends a QR or collect request to "return" money to you.
In every case the safe answer is the same: to be paid, you never scan and never enter your PIN.
If you already scanned or entered your PIN and money left
Act fast — the sooner you report, the better the chance that 1930 and your bank can freeze the money at the receiving account before it is withdrawn. Because you entered your PIN yourself, a bank can treat the transfer as authorised, so a refund is not assured — but fast reporting is still your best chance. Recovery is possible but never guaranteed.
- Call 1930 and report the fraud; note the reference number.
- File at cybercrime.gov.in to create the official record.
- Tell your bank immediately to flag the transaction as unauthorised and block further debits, and change your UPI PIN.
Beware a second scam: the only ways to report are 1930, cybercrime.gov.in, and your own bank. Anyone who phones or messages offering to recover your lost money for a fee — a "recovery agent", "refund officer", or fake "cyber cell" — is a fresh fraud. Never pay to get your money back.
The full first-hour steps are here: UPI fraud — what to do in the first hour.
If the bank does not help
Keep every complaint acknowledgement number. If your bank does not resolve the matter within a reasonable time, you can escalate to the RBI Ombudsman (cms.rbi.org.in) and seek redress through the National Consumer Helpline (1915). All of these are linked below so you can act directly.
Was this helpful? (anonymous — no sign-up, nothing stored about you)