UPI QR Code Scam: What to Do If You Scanned a Fake QR

"I scanned the QR at the counter, paid ₹1,800, and the shopkeeper says nothing came in." Or: "A buyer sent me a QR code to receive payment, I entered my PIN, and the money went out." Either way, the first step is the same: call 1930 or file at cybercrime.gov.in now, then report the transaction to your bank's fraud line. The faster you report, the better the chance the money is frozen before it moves on.

QR scams work because a QR code hides who it pays. This guide explains the common variants as of October 2026, the steps in the first hour and day, what RBI rules let you recover, and a complaint you can copy. For the related request-based trick, see our guide on UPI collect request fraud.

Why it happens

A UPI QR code is just a UPI ID and sometimes an amount, printed as a dot pattern. Your app reads it and opens a payment screen. Nothing about the printed square proves it belongs to the shop it is stuck on. Fraudsters exploit that in a few ways:

The rule that defeats almost all of them: scanning and entering a UPI PIN only ever sends money. If someone tells you otherwise, it is a scam.

Step-by-step: what to do

In the first hour

1. Call 1930 or file at cybercrime.gov.in. The National Cyber Crime Reporting Portal alerts the banks involved so they can try to place a lien on the money. Write down the acknowledgement number.
2. Report to your bank through its 24x7 fraud number, app or net banking. Ask for a complaint reference number.
3. Raise a dispute in your UPI app on that exact transaction, choosing fraud or unauthorised as the reason. This lets the app, its partner bank and NPCI see the complaint.
4. Screenshot the payee details from the transaction: the payee name, UPI ID and the 12-digit UPI reference number.
5. If the QR opened a website or app, uninstall that app, change your UPI PIN and net banking password from a clean device, and tell your bank you may have entered details on a fake page.

On the first day

6. If you are the customer at a shop, tell the shopkeeper and show the payee name. They may not know their sticker was replaced. Both of you should report; the shop's report helps police link several victims.
7. If you are the shop, remove and photograph the fake sticker, report it at cybercrime.gov.in, and check your own payment history and soundbox alerts. Ask your bank or payment provider for a fresh QR.
8. Report the phone number that sent a "scan to receive" QR on the Sanchar Saathi portal's Chakshu facility.
9. File a police complaint if the bank or portal asks for one, especially for larger amounts.

If it is still unresolved

10. Write to the bank's grievance or nodal officer with your 1930 acknowledgement and dispute number.
11. Escalate in the UPI system in NPCI's order: UPI app, its partner bank, your bank, then NPCI through the dispute redressal option at npci.org.in or the "UPI Help" section in your app.
12. Approach the RBI Ombudsman at cms.rbi.org.in if the bank rejects your complaint or does not reply within 30 days. Under the Integrated Ombudsman Scheme, 2026, file within 90 days of the bank's last reply or its response deadline. See what to do when the bank is not resolving your complaint.

What you can recover

Be realistic: a QR payment you approved with your own PIN is legally different from a hacked account.

Transactions up to 31 December 2026 fall under RBI's 2017 customer liability framework. A payment you authorised yourself is usually treated as your liability until you report it, so recovery depends mainly on how much the cybercrime system can freeze in the receiving account.

Transactions from 1 January 2027 fall under RBI's revised directions issued in June 2026. A transaction approved by the customer under deception counts as fraudulent, the bank carries the burden of proving your liability, and a one-time compensation is available for small frauds: for a gross loss up to ₹50,000, the lower of 85% of the net loss or ₹25,000, once in a lifetime, if you report to 1930 or cybercrime.gov.in and to your bank within five calendar days. Your bank's customer protection policy has the details.

The RBI turnaround-time rule with ₹100 a day compensation applies to failed transactions only. A QR scam payment usually shows "successful", so that rule does not help here.

Worked example

Meena pays ₹1,800 at a sweet shop by scanning the QR on the counter on 24 January 2027. The shopkeeper's soundbox stays silent. Her app shows the payee as an unknown individual, not the shop. She calls 1930 within 20 minutes and her bank the same evening.

• Police find ₹1,200 still in the mule account and it is returned. Net loss: ₹1,800 − ₹1,200 = ₹600.
• Under the 2027 rules, compensation is the lower of 85% of ₹600 (₹510) and ₹25,000, so ₹510.
• Meena's final loss: ₹600 − ₹510 = ₹90.

If the same payment were made in November 2026, she would likely get back only the ₹1,200 that was frozen, a loss of ₹600. Either way, the 20-minute call made the difference. Figures are illustrative; actual outcomes depend on the bank's verification and what can be frozen.

Ready-to-copy complaint message

Subject: Fraudulent UPI payment via fake/swapped QR code - Ref [UTR]

Dear Sir/Madam,

On [date] at [time], Rs [amount] was debited from my account ending
[last 4 digits] when I scanned a QR code at [shop name / place / chat].
The payee shown was [name, UPI ID], not the intended recipient.
UPI Reference (UTR/RRN): [number].

I was deceived into this payment. I reported it to 1930 / the National
Cyber Crime Reporting Portal on [date, time], acknowledgement [number].

Please:
1. Treat this as a fraudulent transaction and ask the beneficiary bank
   to freeze and return the funds.
2. Confirm my liability and any reversal or compensation due under RBI's
   customer liability rules and your customer protection policy.

Evidence attached: transaction screenshot, photo of the QR code, SMS.
Name: [your name]   Registered mobile: [number]

What not to do

• Do not enter your PIN after scanning a QR someone sent you to "receive" money.
• Do not skip reading the payee name on the confirmation screen; it is the one check a fake sticker cannot fake.
• Do not scan QR codes with your phone camera for payments; scan inside your UPI app so it opens a payment screen, not a website.
• Do not install apps or enter card details on any page a QR code opens.
• Do not pay a "recovery agent" who promises to get your money back for a fee. That is often a second scam; see our guide on cyber fraud money recovery.
• Do not delete chats, photos or SMS. They are your evidence.

Keeping only spending money in your UPI-linked account and your emergency fund in a separate account or FD (size it with our FD calculator) limits what one wrong scan can cost. For other UPI tricks, read UPI scams and what to do.

Key takeaways

• Scanning a QR and entering your UPI PIN always sends money. It never receives it.
• Before entering the PIN, read the payee name your app shows and match it to the shop or person.
• Report to 1930 or cybercrime.gov.in and your bank within the hour; freezing the money is the main route to recovery.
• Up to 31 December 2026 a PIN-approved scam is usually your loss; from 1 January 2027 a one-time compensation of up to ₹25,000 applies to small frauds reported within five calendar days.
• Escalate in order: UPI app, bank grievance officer, NPCI, then the RBI Ombudsman at cms.rbi.org.in after 30 days.