Legal information notice: this article provides general information and isn't a substitute for advice from a qualified lawyer.
QR codes feel harmless — you scan, the app opens, you’re done. That casual trust is exactly what makes them such an effective scam tool. A pasted-over sticker at a shop counter, a “scan to win” poster, or a QR code sent in a chat can all lead to the same result: money leaving your account instead of a prize, discount, or refund arriving. Here’s exactly how these scams work and what to do if you’ve been caught out.
Scanning a QR code by itself never sends you money — a QR code only ever opens a payment screen, and money moves only when you enter your UPI PIN on the screen that follows. Fraudsters rely on people not reading that follow-up screen carefully, especially when the QR code is framed as something you’re scanning to receive a payment, refund, or prize.
If you’re at a physical location, stop using that QR code immediately and pay through another verified method until it’s checked.
Use the “Report Fraud” or “Dispute Transaction” option on the specific payment — this flags the transaction and the recipient’s UPI ID.
Request an urgent freeze on the funds before they’re withdrawn or moved. Have the UTR number, amount, and time ready.
Go to cybercrime.gov.in and file under “Report Financial Fraud” for an official, trackable record.
If a fake sticker was pasted over a genuine merchant’s code, inform them immediately — other customers are likely being affected too, and they can remove or replace it.
Before scanning any QR code that claims to give you something — a prize, cashback, refund, or discount — pause and ask why a payment app’s PIN screen would ever be the mechanism for receiving that. It never is. Every legitimate reward, refund, or cashback lands in your account without you entering your UPI PIN at all.
For physical QR codes at shops, a quick habit helps: after scanning, check that the merchant name shown on your payment confirmation screen actually matches the shop you’re standing in, before entering your PIN. A mismatched or unfamiliar name is a clear sign the sticker has been tampered with.
Once you’ve stopped the immediate risk, here’s where to take your complaint next:
| Channel | Best For |
|---|---|
| 1930 Helpline | Immediate action to try and freeze the funds right after the fraud |
| cybercrime.gov.in Portal | A formal, trackable complaint record for investigation and bank dispute |
| Shop Owner / Event Organizer | Removing the fake sticker or poster before it affects other people |
No. Reporting in your UPI app, calling 1930, and filing on cybercrime.gov.in are all completely free.
Yes, for the reporting and initial recovery attempt. A lawyer becomes relevant mainly for large losses, or if your bank denies liability protection you believe you’re entitled to despite reporting promptly.
Need professional legal help with this?
Find a Lawyer on VidyodayIf the fake QR code was disguised as a payment request rather than a scan, the mechanics are nearly identical — see our guide on the UPI collect request scam. For the wider range of UPI fraud tactics, our general guide on UPI fraud reporting and recovery covers the full picture.
Scanning itself is safe — the risk is entering your UPI PIN on whatever screen it opens without carefully checking the amount and recipient name first.
Look for a sticker that seems pasted over an original, slightly misaligned or a different print quality — and always verify the merchant name shown on the confirmation screen before paying.
A standard payment QR code cannot install anything by itself, but some malicious QR codes can open unsafe links outside your UPI app — avoid opening links from QR codes sent through unfamiliar messages.
Report the transaction in your UPI app immediately, call 1930, file on cybercrime.gov.in, and alert the shop owner so they can check and replace the sticker.
Dynamic codes (generated per-transaction on a screen) are somewhat harder to tamper with physically than a printed sticker, but the same PIN-entry caution applies to both.
Avoid scanning it, and if possible report it to the event organizers or venue security — this protects other attendees as well.
Follow the standard reporting process — success depends on how quickly you report and whether the funds are still traceable, same as any other UPI fraud.
No — filing on cybercrime.gov.in automatically routes your complaint to the relevant cybercrime cell; a separate police station visit generally isn’t required for the initial complaint.
This article is for general information only and does not constitute legal advice. Fraud patterns and reporting procedures can change — verify current guidance on cybercrime.gov.in or with your bank before relying on this for a real case.
