QR Code Scams in India: Types, Warning Signs, and Prevention

A QR code scam is a type of digital fraud in which a fraudster uses a deceptive QR code or payment request to trick a person into making an unintended payment or sharing sensitive information. Scammers may send QR codes through messages, emails, or social media, replace genuine merchant QR codes, or falsely claim that scanning a code is necessary to receive a refund, cashback, prize or payment. When scanned, the code may open a payment interface or redirect the user to a fraudulent website designed to collect personal or financial information. If the user proceeds with an unfamiliar payment and enters their UPI PIN, the transaction may be authorised, and money can be debited from their account. A UPI PIN authorises payments and is not required to receive money. Before proceeding, verify the recipient's name and transaction amount, confirm that you initiated the payment, check the source of the QR code, and ensure that the transaction purpose matches what you were told. If any detail appears unusual, stop the transaction and verify the request through an official channel.

How QR code scams result in unauthorised payments

QR code scams commonly use social engineering, where fraudsters create urgency, trust or confusion to influence a payment decision. A scammer may pose as a buyer, seller, bank representative, customer support executive, or another trusted person and provide a reason to scan a QR code.

Common warning signs include:

• Receiving money requires a QR scan: A genuine receipt of money does not require you to scan an unknown QR code and enter your UPI PIN.
• Urgent payment instructions: The caller or message creates pressure to act immediately.
• Unexpected refunds or rewards: You are told you need to scan a QR code to claim money.
• Unverified customer support: Someone contacts you through an unknown number or social media account.
• Unexpected payment requests: You receive a collect request or payment request that you did not initiate.
• Unfamiliar recipient details: The payment screen displays a name or account that does not match the intended recipient.

Stop the transaction if the details do not match what you expected. Verify the request through the organisation's official channel instead of using contact details the suspected scammer provided.

What are the common types of QR code scams?

QR code scams can take different forms, but they generally rely on deception to make the victim authorise an unintended transaction or disclose information. Fraudsters may combine QR codes with fake calls, messages, websites, payment requests or impersonation tactics.

The method may change, but the underlying risk remains the same: the user is persuaded to trust an unverified QR code or payment request.

The safest way to avoid QR code scams is to treat every unexpected QR code as a payment request until you have independently verified its purpose and recipient. RBI guidance advises users not to scan QR codes from unknown sources and confirms that you do not need to enter a PIN or OTP to receive money.

Follow these precautions:

1. Scan only trusted QR codes: Use QR codes provided by verified merchants or recipients.
2. Check the recipient: Review the name displayed in your payment app before proceeding.
3. Verify the amount: Make sure the amount shown matches the payment you intend to make.
4. Never enter your UPI PIN to receive money: A UPI PIN is used to authorise payments from your account.
5. Do not share OTPs or PINs: Never share these credentials with anyone.
6. Avoid unknown links: Do not follow links opened through suspicious QR codes.
7. Verify unexpected requests: Contact the relevant organisation using its official website or app.
8. Check your account after a payment: Review your transaction history and bank account for unexpected debits.

By following these precautions, you can reduce the risk of QR code scams and make digital payments more secure. Always verify the recipient and transaction details before authorising a payment, and avoid sharing confidential credentials. If you notice an unfamiliar transaction, report it promptly through your bank or the appropriate cybercrime reporting channel.

What should you do if you scan a suspicious QR code?

If you scan a suspicious QR code but have not authorised a payment, stop the transaction and do not enter your UPI PIN or other confidential information. If money has already been debited, act promptly by contacting your bank or payment service provider and reporting the suspected financial fraud.

Take these steps:

1. Do not approve another transaction: Close the payment screen if the details are unfamiliar.
2. Check your transaction history: Confirm whether any amount has been debited.
3. Contact your bank or payment provider: Report the unauthorised transaction through its official channel.
4. Report financial cyber fraud: Call the National Cyber Crime helpline 1930 or use the National Cyber Crime Reporting Portal.
5. Keep transaction information ready: The reporting process may require details such as the transaction ID or UTR number, transaction date, fraud amount, and relevant evidence.
6. Preserve evidence: Keep screenshots, messages, QR codes, phone numbers, and other relevant information that may support the complaint.

Prompt reporting does not guarantee recovery of the amount, but it allows you to report the incident through the appropriate channels and supports further action.

How can you stay safe when making payments through Bajaj Finance platforms

Use only official Bajaj Finance platforms when making payments or accessing loan-related services, and verify the payment details before authorising any transaction. Avoid using QR codes, links or contact details supplied by unknown individuals claiming to represent a financial service provider.

For loan-related payments or servicing, use the official Bajaj Finance website, App or My Account portal. When accessing your account:

1. Open the Bajaj Finance App or My Account portal.
2. Sign in using your registered mobile number and OTP.
3. Navigate to the relevant loan account or service.
4. Review the payment details before proceeding.
5. Use the available official payment option and check the transaction status after payment.

Never share your OTP, UPI PIN, password, or other confidential credentials with anyone. If someone claiming to represent Bajaj Finance asks you to scan an unfamiliar QR code or disclose sensitive payment information, stop the interaction and verify the request through official channels. Bajaj Finance advises customers not to share confidential credentials and to use official channels for financial services.

Victims of QR code scams in India have several legal avenues for recourse. The Information Technology Act, 2000, addresses cybercrimes, including identity theft and phishing, providing a legal framework for prosecution. Additionally, the Indian Penal Code encompasses provisions related to fraud and cheating. Victims should promptly report the incident to the local police and file a First Information Report (FIR). They can also lodge complaints through the National Cyber Crime Reporting Portal (https://cybercrime.gov.in). Financial institutions may assist in freezing transactions and recovering funds if notified promptly. Legal consultation is advisable to navigate the complexities of cybercrime laws and pursue appropriate action against perpetrators.
 

Role of financial institutions in preventing QR code fraud

Financial institutions play a crucial role in combating QR code fraud. They implement advanced security measures, such as real-time transaction monitoring and anomaly detection systems, to identify and prevent fraudulent activities. Banks also conduct awareness campaigns to educate customers about potential scams and safe digital practices. Collaborations with cybersecurity firms enhance their ability to detect and respond to emerging threats. Furthermore, institutions are investing in technologies like biometric authentication and secure QR code generation to ensure transaction integrity. By fostering a culture of security and vigilance, financial institutions aim to protect customers and maintain trust in digital payment systems.
 

Impact of QR code scams on financial health

• Direct Financial Loss: Victims may lose significant amounts of money through unauthorised transactions.
• Credit Score Damage: Fraudulent activities can negatively impact an individual's creditworthiness.
• Identity Theft: Personal information obtained through scams can be used for identity theft, leading to further financial complications.
• Emotional Distress: The stress and anxiety resulting from financial loss can affect mental well-being.
• Loss of Trust in Digital Payments: Experiencing a scam may lead individuals to distrust digital payment methods.
• Legal Expenses: Pursuing legal action against fraudsters can incur additional costs.
• Time Consumption: Resolving issues related to scams can be time-consuming and disruptive.
• Potential Job Implications: Financial instability may affect employment opportunities or job performance.
• Impact on Family: Financial strain can have ripple effects on family members and dependents.
• Long-Term Financial Planning Disruption: Scams can derail savings plans, investments, and future financial goals.

Technological measures to detect malicious QR codes

Advancements in technology have led to the development of tools and systems designed to detect and prevent malicious QR codes. AI-powered QR code scanners can analyse codes in real-time, identifying anomalies or links to known phishing sites. Mobile security applications now offer features that warn users about suspicious QR codes before they are scanned.

Financial institutions are integrating machine learning algorithms into their security infrastructure to monitor transaction patterns and flag irregularities. Additionally, secure QR code generation practices, such as dynamic codes that expire after a single use, are being adopted to enhance security. These technological measures, combined with user awareness, form a robust defence against QR code scams.
 

Conclusion

The rise of QR code scams in India underscores the need for heightened vigilance and proactive measures to protect personal and financial information. By understanding the various forms these scams can take and implementing best practices for digital security, individuals can significantly reduce their risk of falling victim. Collaboration between consumers, financial institutions, and regulatory bodies is essential to create a secure digital payment ecosystem. Staying informed and cautious is the key to navigating the digital landscape safely.