Scam guide · UPI
UPI QR code scams: what to check before you scan and pay
By Aman Gupta, 12+ years in cyber security · Updated 7 October 2026
The short answer
You never need to scan a QR code or enter your UPI PIN to receive money; entering the PIN always sends money. Before paying any QR code, read the payee name your UPI app shows on the confirm screen and check it matches the shop or person, because a sticker pasted over a shop's code looks identical to the camera.
The rule that stops most UPI scams
The UPI PIN is only for sending money. Nobody can pay you by making you enter it. If someone says "scan this to receive the refund" or "enter your PIN to accept the payment", it is a scam.
Common UPI QR and request scams
- "Scan to receive" on OLX, Quikr or Marketplace. A "buyer" sends a QR code for the advance payment. Scanning it and entering your PIN pays them.
- Collect requests. A request appears in your UPI app titled "refund", "cashback" or "KYC". Approving it sends money out.
- Pasted-over shop codes. A sticker with someone else's QR is stuck on top of a shop's code. You pay a stranger and the shop says it never received it.
- Fake payment screenshots. A buyer shows a "paid" screen that was never sent. Check your own bank or UPI app, not their phone.
The two-second check before every payment
- After scanning, stop on the confirm screen.
- Read the payee name and UPI ID your app shows. Does it match the shop or person?
- Check the amount. Only then enter your PIN.
For shops: check your printed QR every morning, and confirm payments in your own app or the soundbox, not on the customer's screen.
If you paid a scammer
- Call 1930 immediately and report at cybercrime.gov.in with the UPI transaction ID.
- Raise a complaint in your UPI app (Help or Report a problem on the transaction) and tell your bank.
Where SecureOne helps, and where it can't
SecureOne's QR code scanner shows what a code contains, including the UPI ID and the name the code claims, before anything opens, and it never opens a payment app by itself. It cannot tell whether a payment code belongs to the shop; only the shop can. SecureOnes Payment guard also checks where your UPI apps came from.
Get SecureOne for Android · See every feature and its limits
Quick answers
Do I need to enter my UPI PIN to receive money?
No. Entering your UPI PIN always sends money from your account. Anyone asking you to enter it to receive money is scamming you.
Can scanning a QR code hack my phone?
Scanning alone shows a link or payment request. The harm comes from what you do next: opening a scam link, or entering your PIN to approve a payment.
How do I check if a UPI QR code is genuine?
After scanning, read the payee name and UPI ID on your app's confirm screen and check it matches the shop or person before entering the PIN.
Lost money to a scam? Call 1930 (National Cyber Crime Helpline) and report at cybercrime.gov.in as soon as you can.