Common QR code scams
1. Fake stickers over real codes
Scammers paste their own QR stickers over genuine ones on parking meters, shop counters, EV chargers and restaurant tables. Payments then go to the scammer instead of the business.
2. “Scan to receive money” (UPI scams)
Common in India: a “buyer” on a marketplace sends a QR code and says you must scan it to receive payment. You never need to scan a QR code or enter your UPI PIN to receive money. Scanning and entering your PIN only ever sends money.
3. Phishing emails and messages
Emails pretending to be from your bank, employer or a delivery company include a QR code to “verify your account” or “reschedule a delivery”. The code leads to a fake login page that steals your password. Criminals use QR codes because email filters check links more easily than images.
4. Fake delivery and parking notices
Printed notes on cars or doors claim you've missed a delivery or owe a parking fine, with a QR code to pay a small fee — and steal card details.
5. Malicious app downloads
A code that installs an app from outside the official store can put malware on your phone.
Warning signs
- A sticker that looks placed over another code, or is peeling or misaligned.
- Urgency: “Your account will be blocked”, “Pay within 1 hour”.
- A request to log in, pay, or enter a PIN or OTP right after scanning.
- A web address that's misspelled, very long, or not the organisation's real domain.
- Being asked to scan to receive money.
How to protect yourself
- Check the link preview your camera shows before opening it. If you can't see it clearly, use our QR reader, which shows the domain without opening it.
- For payments, check the payee name in your UPI app before entering your PIN.
- Don't log in through a QR code. Go to the app or type the website address yourself.
- Only install apps from Google Play or the App Store.
- Keep your phone updated and use your browser's safe-browsing protection.
Protecting your business
- Check printed codes daily, especially payment codes at counters.
- Print codes directly onto materials, or laminate them, so stickers are harder to add.
- Put your business name next to payment codes and tell customers to check the payee name.
- Use your own domain for links so customers can recognise them.
If you've been scammed
Contact your bank immediately to block cards or freeze transactions. In India, call the national cybercrime helpline 1930 or report at cybercrime.gov.in as soon as possible — fast reporting improves the chance of stopping the money. Change any password you entered and turn on two-factor authentication.