You sell something online for Rs. 3,000. The buyer says they have sent the payment request and asks you to scan a QR code and enter your UPI PIN to receive the money.
Suspicious QR refund example
Buyer: I have sent the payment request.Buyer: Scan this QR code and enter your UPI PIN to receive the money.Scan, Read, Verify, Then Act
That should immediately make you suspicious.
What Can a QR Code Do?
A QR code can contain many kinds of data. The QR image itself does not tell you whether the destination is trustworthy.
- A payment request
- A website link
- Contact information
- App download links
- Other hidden data
Real-Life Example
UPI payment trap
Scammer: Scan this to receive Rs. 5,000.UPI app shows: Pay Rs. 5,000If you enter your PIN without reading carefully, you may send money instead of receiving it.
Another Example
You scan a QR code placed on a restaurant table. Instead of opening the restaurant menu, it opens restaurant-menu-payment.xyz and asks you to log in or enter card details.
The QR code may have been replaced with a fake sticker.
Safe Habit
After scanning a QR code, stop before taking the next action. Check what actually opened and what it is asking you to do.
- What app opened?
- What website opened?
- What amount is shown?
- Are you paying or receiving?
- Is the domain correct?
Important Rule
Entering your UPI PIN generally means you are authorizing a transaction. Do not enter it simply because someone says it is required to receive money.
Remember
Scan, read, verify, then act. A QR code is only the starting point, not proof that the action is safe.
Series
Internet Security Basics: 10-Part Series for Everyday UsersA 10-part series for everyday users to identify scams, protect accounts, and use the internet with more confidence.
Is This Email Really From Your Bank or Company?
Check sender names, email addresses, and urgent payment messages before trusting them.
Can You Spot the Real Website?
Learn how fake domains, confusing links, and lookalike names trick everyday users.
HTTPS Does NOT Mean the Website Is Genuine
Understand what the lock symbol protects, and why you still need to verify the domain.
Does a Professional Domain Extension Mean the Website Is Genuine?
Learn why .com, .org, .in, .net, and .ai do not automatically prove trust.
The Link Says SBI, But Where Does It Actually Go?
Learn why visible link text and button labels can hide a completely different destination.
Sir, Please Tell Me the OTP for Verification
Learn why OTPs, passwords, UPI PINs, recovery codes, and remote access must stay private.
Scan This QR Code to Receive Your Refund
Learn how QR codes can hide payment requests, fake links, and UPI PIN traps.
Someone Sent You BankKYC.apk on WhatsApp. Should You Install It?
Learn why APKs, cracked software, and fake apps can hide malware or dangerous permissions.
Which Airport Wi-Fi Is the Real One?
Learn how fake public Wi-Fi names and captive portals can trick users into unsafe logins.
Before You Click, Pay or Login, Take 30 Seconds
Use a quick checklist before reacting to urgent messages, links, payments, or login prompts.
Nikhlesh Yadav is a Technical Lead and Solution Architect with 12+ years of experience across cloud-native systems, distributed platforms, AI integrations, Web3, and cyber security.
Read full profile