The UPI QR refund scam: why scanning to receive money always debits you
19 September 2026
The trick, step by step
You list something for sale. A buyer agrees instantly, "overpays" by mistake, and sends you a QR code to scan so you can "receive the refund". You scan it, enter your UPI PIN — and money leaves your account.
Nothing malfunctioned. A QR code in UPI can encode a collect request (pay me) as easily as a receive address. The buyer simply labelled a debit as a refund, and your PIN authorised it.
The one rule
Receiving money on UPI never needs a PIN, a scan, or an OTP. Sending does. If anyone asks you to scan, enter a PIN, or approve a request in order to receive funds, stop — that is the scam, every time.
Red flags
- A buyer who overpays and rushes you to "return the extra"
- Payment happening over chat instead of the marketplace's own checkout
- Refusal to meet, video-call, or speak on a verifiable number
- Pressure language: "do it now or the offer lapses"
What to do
- Never approve a collect request from a stranger — decline it in your UPI app.
- Before paying any unknown seller, run the domain check and scam-link scan on this site.
- Already paid a scammer? Report immediately at cybercrime.gov.in and call 1930 (India's cyber fraud helpline) — fast reporting is what makes reversal possible.
- Read India's threat landscape for the other UPI lures running right now.