You appear to be offline. Lookups will resume automatically when your connection returns.
IFSCBank Guide
Englishবাংলাहिन्दी
Fraud defence 6 min read Checked 29 October 2026

QR code scams: 4 rules to follow before you scan

A QR code is for paying someone. You never need to scan one, or enter your UPI PIN, to receive money. If someone asks you to do that, it is a scam. This page gives you four rules, a one-minute quiz, and a card that bank staff can print for the counter.

By Ayan Mandal

The 4 rules

Scan only to pay

Scan a QR code only when you are the one sending money, and you have checked who you are paying.

Your UPI PIN is for money going out

Nobody needs your PIN to pay you. If anyone asks for it so that money can come in, stop.

Read the name before you confirm

Your UPI app shows the name of the person or shop you are paying. If it is not the name you expected, cancel.

Close any page that asks for more

A QR that opens a form for an OTP, card number, CVV, an app download or screen sharing is a trap. Close it. Banks do not ask for these.

Paying vs receiving, side by side

The QR code looks the same either way. What matters is the direction the money is going.

You are paying someone

  1. Scan the shop’s QR code
  2. Check the name on your UPI app
  3. Enter the amount and confirm with your UPI PIN
  4. Money leaves your account, as you intended

Someone says “scan to receive money”

  1. Scan the QR or accept the request
  2. They ask for your UPI PIN or an OTP
  3. Stop. Money never comes to you with a PIN

An invented example, based on a real warning

1-minute quiz

Five questions, about a minute. Pick one answer for each, then press “Check my answers”.

1. A buyer says, “Scan this QR to receive ₹2,000 for the bicycle.” What do you do?

2. Your app shows “Sharma Traders”, but the shop board says “Sri Ram Stores”. What do you do?

3. After you scan a QR, a page asks for your card number and CVV to “complete verification”. What do you do?

4. Which statement is true?

5. A caller says your account will be blocked unless you install an app so they can “help” you. What do you do?

If you already paid

If you already paid, act in this order, and act fast:

  1. Call 1930 now. It is the national cyber crime helpline. Have the transaction ID, the time and the amount ready.
  2. Tell your bank right away. Call the number on its official website or on the back of your card, and ask for a complaint number.
  3. Report at cybercrime.gov.in and keep the acknowledgement number.

For the full list, including what to do with your phone and accounts, read the first 24 hours guide.

For bank staff: a 5-minute counter briefing

Use this page in a morning huddle or at the counter. Print the card below and keep it where customers can see it.

  • Say the four rules out loud, in the customer’s own language. Many customers do not know that getting paid never needs a PIN.
  • Never ask a customer for an OTP, PIN, CVV or password, not even to “verify” them. The RBI’s safe-banking advice is the same.
  • If a customer says they scanned a QR and lost money, note the transaction ID (UTR), the amount and the time straight away.
  • Ask them to call 1930 now, then give them your bank’s complaint number and write it on their slip.
  • Do not suggest they pay again to “reverse” it. That is the second scam.
  • If you spot a suspicious QR sticker, report it to your branch’s fraud or security team.

QR safety: 4 rules

  1. Scan only to pay Scan a QR code only when you are the one sending money, and you have checked who you are paying.
  2. Your UPI PIN is for money going out Nobody needs your PIN to pay you. If anyone asks for it so that money can come in, stop.
  3. Read the name before you confirm Your UPI app shows the name of the person or shop you are paying. If it is not the name you expected, cancel.
  4. Close any page that asks for more A QR that opens a form for an OTP, card number, CVV, an app download or screen sharing is a trap. Close it. Banks do not ask for these.

Scammed? Call 1930 now, then your bank. Report at cybercrime.gov.in.

Questions people ask

Can scanning a QR code take money from my account on its own?

A payment QR only opens a payment screen in your own UPI app. Money leaves only after you confirm the payment there. A QR that opens a website is a separate risk: the page can ask for your details or push you to install an app.

What if I see a different sticker on a shop’s QR code?

Do not pay through it. Tell the shopkeeper and ask for the shop’s own printed code. If you have already paid, follow the steps in “If you already paid” above.

Is the quiz a certificate?

No. It is practice only. Your answers are not sent anywhere and nothing is saved.

Where this comes from

This guide is general information, not legal advice. The facts come from these public sources:

Rules, limits and phone numbers change. Confirm the current details at cybercrime.gov.in, rbi.org.in or with your bank before you act.

All guides Back to top

More guides