Payment
UPI request and QR code fraud
You are sent a 'collect request' or a QR code and told to scan it to receive money. Scanning sends money out, never in.
Warning signs
- Asked to scan a QR to receive a payment
- Asked to enter your UPI PIN to 'confirm receipt'
Who is targeted most
People selling items on classifieds apps, small shopkeepers accepting UPI, and anyone expecting a refund.
How the fraud works
UPI has two directions and they look almost identical on a phone screen. A 'pay' request sends money from your account. A 'collect' request asks you to approve sending money to someone else. Fraud here works entirely on that confusion.
The fraudster poses as a buyer, a refund desk, or a customer support agent, and sends either a collect request or a QR code with the message that approving it will credit your account. Your PIN is what authorises the outgoing transfer.
The usual sequence
- 1Contact is made as a buyer, a seller, or a support agent.
- 2A small real payment is sent first to establish trust.
- 3A collect request or QR code arrives with instructions to approve it.
- 4Your UPI PIN authorises money leaving your account.
- 5The number goes silent, or asks you to repeat because 'it failed'.
How to protect yourself
- A UPI PIN is only ever needed to send money. Receiving requires nothing.
- Read the app screen before approving. It states whether you are paying or receiving.
- Treat any QR code sent to you as a payment request, not a receipt.
Comment rules
- Do not share bank details, OTPs, card numbers, Aadhaar or complaint numbers.
- Do not name or accuse individuals. Make official reports at cybercrime.gov.in.
- Comments are reviewed before publication. Never pay anyone who offers to recover your money.