Payment
UPI request and QR code fraud
You are sent a 'collect request' or a QR code and told to scan it to receive money. Scanning sends money out, never in.
Warning signs
- Asked to scan a QR to receive a payment
- Asked to enter your UPI PIN to 'confirm receipt'
How the fraud works
UPI has two directions and they look almost identical on a phone screen. A 'pay' request sends money from your account. A 'collect' request asks you to approve sending money to someone else. Fraud here works entirely on that confusion.
The fraudster poses as a buyer, a refund desk, or a customer support agent, and sends either a collect request or a QR code with the message that approving it will credit your account. Your PIN is what authorises the outgoing transfer.
The usual sequence
Contact is made as a buyer, a seller, or a support agent.
A small real payment is sent first to establish trust.
A collect request or QR code arrives with instructions to approve it.
Your UPI PIN authorises money leaving your account.
The number goes silent, or asks you to repeat because 'it failed'.
Who is targeted most
People selling items on classifieds apps, small shopkeepers accepting UPI, and anyone expecting a refund.
How to protect yourself
- A UPI PIN is only ever needed to send money. Receiving requires nothing.
- Read the app screen before approving. It states whether you are paying or receiving.
- Treat any QR code sent to you as a payment request, not a receipt.
Related fraud types