UPI QR Code Scams ("Quishing"): How They Work and How to Avoid Them
TL;DR: QR code scams ("quishing") exploit a common misunderstanding: scanning a UPI QR code and entering your PIN authorizes a payment out of your account, never in. Scammers posing as buyers on resale marketplaces or claiming to "refund" you send a QR code and ask you to scan it — doing so sends them money instead.
👉 See if your data's already leaked — free 30-second check →
QR code scams work because the mechanics of UPI QR codes run opposite to what feels intuitive — and scammers exploit that gap deliberately.
The core misunderstanding scammers exploit
In UPI, scanning a QR code and entering your PIN always authorizes a payment out of your account — never in. There is no legitimate scenario where you need to scan a code or enter your PIN to receive money. If someone asks you to scan a QR code or enter your UPI PIN to get a payment, refund, or prize, that request itself is the scam.
How it typically plays out
- Resale marketplace scams: A "buyer" on OLX, Facebook Marketplace, or a similar platform says they've sent payment and asks you to scan a QR code to "confirm receipt" — scanning it and entering your PIN sends money to them instead.
- Fake refund scams: Someone claiming to be from customer support says a refund is being processed and asks you to scan a code or share a "collect request" approval to receive it.
- Fake cashback or prize scams: A QR code shared over WhatsApp or SMS claims scanning it will credit a cashback or prize amount.
The rule that stops all three
To receive money via UPI, you never scan anything and never enter your PIN. If a "payment" requires you to scan a QR code, approve a collect request, or type your PIN, someone is asking you to pay, not receive.
Physical QR code tampering
A separate but related risk: fraudulent QR code stickers placed over legitimate ones at shops, parking meters, or payment counters, redirecting a genuine payment to a scammer's account instead of the business. Before scanning a QR code at a physical location, check that the sticker isn't layered over another one, and confirm the recipient name shown in the UPI app matches the business before approving.
If you've already scanned and lost money
Treat this exactly like any UPI fraud — call 1930 immediately. See The First Hour After Sending Money to a Scammer and UPI Fraud Recovery: The Bank Dispute Process for what to do next.
Selling online safely
If you sell on resale platforms regularly, treat any "scan to receive" request as an automatic red flag, and verify a payment has actually landed in your account (check your bank app or UPI app directly) before handing over any item — never trust a screenshot of a "successful" payment shown to you by the buyer. This is one entry in our running field guide to what's actually circulating right now — see Common Scams in India Right Now (2026) for the rest.
Frequently Asked Questions
Can scanning a QR code send money out of my account?
Yes — this is the core mechanic scammers exploit. Scanning a UPI QR code and entering your PIN always authorizes an outgoing payment, never an incoming one.
Do I ever need to scan a QR code to receive money via UPI?
No, never. To receive money, you only need to share your UPI ID or QR code for others to scan — you never scan anything or enter your PIN to receive a payment.
How do resale marketplace QR scams typically work?
A 'buyer' claims they've sent payment and asks you to scan a QR code to 'confirm' or 'unlock' it — scanning it and entering your PIN sends money to the scammer instead of receiving any.
What is a physical QR code tampering scam?
Scammers place a fraudulent QR sticker over a legitimate one at a shop or payment counter, redirecting payments intended for the business to their own account instead.
What should I do if I already scanned a scam QR code and lost money?
Call 1930 immediately and follow the same recovery steps as any other UPI fraud — the fund-freeze mechanism works the same way regardless of how the scam was delivered.
Curious what's already out there about you? Scan My Shadow checks your phone number and email across 1,500+ sources and sends you a clear report — no guesswork, just facts. Start your scan.
- Results within about 5 minutes
- Clear, plain-English report
- Delivered straight to your inbox
- No login or passwords required
- Scan data deleted after report is generated