QR codes are now part of daily life in India, from paying for tea to joining WiFi and reading menus. Fraudsters have noticed. The good news is that QR scams rely on a few simple tricks, and a handful of habits protect you against almost all of them.
Scam 1: "Scan this QR to receive money"
This is the most common UPI fraud. You list something for sale online, a "buyer" agrees to your price and sends you a QR code, saying you need to scan it and enter your PIN to receive the payment. Scanning it actually opens a request to pay them.
Scam 2: Fake QR stickers over real ones
Fraudsters paste their own QR code over a shop's, a parking machine's or a temple donation box's genuine code. Customers pay the fraudster without realising. Before paying, check that the name shown in your UPI app matches the shop or organisation. If you run a business, inspect your printed QR codes regularly, place them where staff can see them, and ask customers to confirm the name before paying.
Scam 3: QR codes that lead to fake websites (quishing)
A QR code can hide any web address. Scammers put codes on posters, parking tickets, fake delivery notes or emails that open look-alike websites for banks, courier companies or government services, and ask you to "log in" or "pay a small fee". This is called quishing — phishing with QR codes.
- Before opening a link from a QR code, read the address your camera shows. Check the spelling of the domain carefully.
- Be suspicious of codes that ask you to log in, pay a small fee to release a parcel, or update KYC.
- Never enter passwords, card details or OTPs on a site you reached by scanning an unexpected code.
- Type well-known addresses (your bank, the income tax portal) directly instead of using a code.
Scam 4: Apps and payments disguised as offers
Some codes advertise cashback, lottery prizes or job offers and lead to app downloads outside the Play Store or App Store. Only install apps from the official stores, and treat any offer that asks for an upfront payment as a scam.
Safety checklist for everyone
- Look at the link or payee name before acting on any scan.
- Your UPI PIN is only for sending money — never for receiving it.
- Check physical codes for stickers placed on top of the original.
- If something feels urgent or too good to be true, stop and verify through an official number.
Checklist for businesses that display QR codes
- Print your business name next to every payment QR so customers can match it.
- Use a sound box or payment notification to confirm each payment before handing over goods.
- Check codes daily if they are outside or unattended, and use tamper-evident lamination.
- Keep the links behind your dynamic QR codes pointing to your own, secure (https) pages.
If you have been scammed
Act quickly. Call the national cybercrime helpline 1930 or report at cybercrime.gov.in, and inform your bank immediately so they can try to freeze the transaction. Keep screenshots of the QR code, chat messages and the transaction ID.
Frequently asked questions
Can scanning a QR code hack my phone?
Scanning alone is very unlikely to harm a modern phone. The risk comes from what you do next — opening a fake website, entering a PIN or password, or installing an app from outside the official stores.
How do I check whether a payment QR is genuine?
After scanning, your UPI app shows the payee name before you pay. Make sure it matches the shop or person you intend to pay.
Where do I report a QR code fraud in India?
Call the cybercrime helpline 1930 or file a complaint at cybercrime.gov.in, and contact your bank straight away.