QR codes move more money in India than cards do, and wherever money moves, fraud follows. Is a UPI QR code scam real? The uncomfortable truth: the technology itself has never been hacked — the victim is always tricked into approving a payment they did not mean to make. This guide walks through the seven scams shopkeepers, stall owners and small businesses actually face, explains the one technical fact that defeats most of them, and gives you a checklist you can pin next to your counter.
Free printable: UPI QR safety counter poster
A one-page A4 poster with the 7 scams and the staff checklist, ready to laminate and put next to your payment code. Print it for your own counter — and share it with every shop on your street.
Download the A4 PDF — freeWhat Single Fact Kills Most QR Scam Myths?
Every UPI QR code - whether printed by your bank, generated by an app, or made with a free generator - encodes nothing more than a payment address. Scanning it can only START a payment FROM the scanner's account TO the address inside. There is no field, flag or hidden mode that lets a QR pull money INTO the scanner's wallet.
That single fact dismantles the most common scam pitch: a caller or chat message says 'scan this code and enter your PIN to RECEIVE your refund/cashback/prize.' Money never arrives by scanning and entering a PIN - a PIN always means you are paying. The moment someone tells you otherwise, the conversation is over.
How Do Sticker Swapping and Lookalike Codes Work?
The classic physical scam needs thirty seconds and glue: a fraudster covers a shop's genuine payment QR with their own lookalike sticker. Customers scan, the payer name looks plausible, and the day's takings land in a stranger's account. Busy stalls, night counters and unattended self-service points are prime targets.
Defence is procedural, not technical: check the printed payee name on your own sticker weekly, keep codes behind a laminated frame that shows tampering, and take a photo of your displayed code each morning so you can prove a swap happened. Merchants who generate their own QR control the artwork and can reprint instantly at zero cost instead of waiting for a bank kit.
How Do Screen Share, Fake Support and Collect Requests Work?
Remote fraud follows a script: a 'bank executive' calls about a stuck payment, asks you to install a screen-sharing app, then watches you open your UPI app while talking you through 'verification'. Everything they need - balances, PIN entry, approval screens - happens on camera. No legitimate support team ever needs your screen or your PIN.
The other remote favourite is the collect request: a notification appears asking YOU to approve receiving money, often dressed as cashback. Approving it actually authorises a debit. Rule of thumb: if a request mentions receiving money but your app asks for a PIN, it is a debit wearing a costume. Decline, then report the handle inside the app.
How Do Overpayment Tricks and Fake Apps Work?
Marketplace sellers meet the overpayment con: a buyer sends a doctored screenshot claiming they paid 5,000 for a 500 item and demands an urgent refund of the difference. Screenshots are not settlements - always confirm money in your OWN bank balance or app passbook before refunding anything.
Finally, sideloaded 'scanner' apps from WhatsApp forwards harvest everything you type, including PINs. Stick to the official app stores and the scanner built into your UPI app itself. If a customer's phone cannot read your code with a mainstream app, suspect their app - never 'fix' it by switching to some stranger's recommended scanner.
What Should Your Counter-Side Defence Checklist Include?
- Verify the payee name preview before confirming any payment you make.
- Print your own code so you know exactly what it should look like, and audit the physical sticker weekly for swaps.
- Refuse screen-share requests from anyone claiming to be support.
- Treat screenshots as fiction until your own balance actually moves.
- Brief staff that PIN means paying, always.
If fraud does slip through, speed matters: call your bank's fraud line and the national cybercrime helpline 1930 within the golden hour, and file at cybercrime.gov.in. Reports raised fast have the best chance of freezing funds before withdrawal.