QR Code Scam Guide: How Malicious QR Codes Are Used in Payment Scams

What Is a QR Code Scam? ** A QR code scam is a payment fraud technique where a scammer relies on a simple, widespread misunderstanding: that scanning a QR code can bring money into an account. In reality, every QR-code-based UPI transaction is a payment request that debits the scanner's account when confirmed with a PIN. Scammers exploit this by disguising an outgoing-payment QR as if it were a way to collect money. This makes QR scams particularly effective against people selling something online, since the transaction naturally starts with a promise of being paid. How the Scam Works** The pattern is consistent across most reported cases:

1. A buyer contacts a seller on a marketplace app (OLX, Facebook Marketplace, Quikr, or similar) expressing interest in an item.
2. The buyer says they'll pay via UPI and sends a QR code image or a link to scan, often claiming it's needed to "verify" or "process" the payment.
3. The seller scans the code and is prompted to enter their UPI PIN, believing this step completes a payment received.
4. Entering the PIN instead authorizes a payment out of the seller's account, sending money to the scammer.
5. The buyer disappears, and the seller realizes only after checking their bank balance that money left their account instead of arriving.** Where These Scams Happen**

• Online marketplaces — OLX, Facebook Marketplace, Quikr — where strangers transact directly.
• Fake parking or toll payment QR stickers pasted over legitimate ones in public spaces.
• Counterfeit donation or charity QR codes placed at religious sites or public events.
• Delivery agents or "technicians" who ask you to scan a QR to confirm a refund or service charge.** How to Verify a QR Code Before Scanning**
• Remember the golden rule: scanning a QR code can only send money, never receive it.
• If someone claims you need to scan to get paid, stop — this is always false.
• For public QR codes (parking, tolls, donations), check whether it looks like an official printed sign or a loose sticker pasted over one.
• Before confirming any payment, always read the payee name shown by your UPI app — not just the amount.
• If a stranger sends you a QR code during a sale, ask them to simply send the money directly to your UPI ID instead.** A Typical Scenario** A seller lists a used phone online. A buyer messages, agrees to the price, and says they've "already made the payment" but need the seller to scan a QR to confirm receipt due to a "technical issue" with their banking app. Under the pressure of not wanting to lose the sale, the seller scans the code and enters their PIN — and the money leaves their account instead of arriving. The buyer stops responding within minutes. The scenario changes in detail — sometimes it's a delivery refund, sometimes a rental deposit — but the mechanic is always identical: a QR code framed as the way to receive money.** Frequently Asked Questions** Can scanning a QR code alone steal my money, without entering a PIN? No. Scanning only opens the payment request in your UPI app — the transaction is not completed until you enter your PIN. If you scan and immediately close the app without entering a PIN, no money moves. Is there any legitimate reason to scan a QR code to receive a payment? No. Every UPI QR code is designed to initiate an outgoing payment from the scanner. Legitimate incoming payments simply appear as a credit in your account or app — no scanning required. How do I know if a public QR code, like a parking sticker, has been tampered with? Look for signs of a sticker placed over the original signage, misalignment, or a QR code that seems out of place compared to the surrounding print. When in doubt, pay by cash or through the vendor's staff directly. What should I do if I've already scanned and paid a scam QR code? Immediately call the national cybercrime helpline at 1930, report the transaction at cybercrime.gov.in, and inform your bank's fraud team to attempt a transaction freeze.