QR code scam: you never scan to receive money
Last updated:
You never receive money by scanning a QR code or entering your UPI PIN. Scanning a QR and entering your PIN always means you are paying, not being paid.
So anyone who says "scan this QR to get your refund / prize / payment" or "just enter your UPI PIN to receive the money" is running a scam — that action can only debit your account. To actually receive money you do nothing at all, or at most share your UPI ID or phone number. No scan, no PIN, no "approve" — those are only ever needed to pay.
Do you need a QR code and PIN to receive money?
No — you never need to scan a QR code or enter your UPI PIN to receive money. Receiving money is passive: the sender pushes it to your UPI ID and it simply arrives. You are never asked to scan, to type your PIN, or to approve a "collect" request to get money. Your UPI PIN is the key that sends money out — entering it can only take money from you, never add money to you. If a "payment" needs your PIN, it is a debit dressed up as a credit.
Is the warning "never scan a QR code to receive money" true?
Yes — the warning "never share your UPI PIN or scan a QR code to receive money" is true: scanning a QR code and entering your PIN can only send money out of your account. A message asking you to do either to "receive" money is the scam itself.
To pay vs to receive
| What you do | To PAY someone | To RECEIVE money |
|---|---|---|
| Scan a QR code | Yes — a QR is a "pay to this account" code. | No — you never scan to receive. |
| Enter your UPI PIN | Yes — the PIN authorises money leaving your account. | No — receiving never needs your PIN. |
| Approve a "collect" / payment request | Yes — approving sends money out. | No — you don't approve anything to be paid. |
| Share your UPI ID or phone number | Not needed to pay. | Yes — this is all a genuine sender needs. |
The scammer's whole trick is to make a debit look like a credit. They send a QR, a "collect request", or a link and say it will bring money in. Every one of those, once you scan or enter your PIN or tap approve, sends money out. Read the amount and the direction on your own screen before you ever enter a PIN — your app shows whether you are paying or being paid.
Common versions of this trick
- A "buyer" on a marketplace who insists on sending an advance "by QR" and needs you to scan or enter your PIN.
- A "refund", "cashback", "prize", or "lottery" that asks you to scan a QR or approve a request to claim it.
- A "customer-care" or "support" contact who sends a QR or collect request to "return" money to you.
In every case the safe answer is the same: to be paid, you never scan and never enter your PIN.
If you already scanned or entered your PIN and money left
Act fast — the sooner you report, the better the chance that 1930 and your bank can freeze the money at the receiving account before it is withdrawn. Because you entered your PIN yourself, a bank can treat the transfer as authorised, so a refund is not assured — but fast reporting is still your best chance. Recovery is possible but never guaranteed.
- Call 1930 and report the fraud; note the reference number.
- File at cybercrime.gov.in to create the official record.
- Tell your bank immediately to flag the transaction as unauthorised and block further debits, and change your UPI PIN.
Beware a second scam: the only ways to report are 1930, cybercrime.gov.in, and your own bank. Anyone who phones or messages offering to recover your lost money for a fee — a "recovery agent", "refund officer", or fake "cyber cell" — is a fresh fraud. Never pay to get your money back.
The full first-hour steps are here: UPI fraud — what to do in the first hour.
If the bank does not help
Keep every complaint acknowledgement number. If your bank does not resolve the matter, you can escalate to the RBI Ombudsman (cms.rbi.org.in). You must have complained to your bank first. If it has not replied within 30 days (or a longer time that RBI, NPCI or card-network rules set), or its reply does not satisfy you, you can file with the Ombudsman. File within 90 days of that waiting period ending or of the bank's last reply, whichever is later. You can also seek redress through the National Consumer Helpline (1915). All of these are linked below so you can act directly.
Was this helpful? (anonymous — no sign-up, nothing stored about you)