Receiving Money Should Never Cost You a PIN: The "Request Money" QR Code Fraud

There is one rule of digital payments that a surprising number of people never learn: you enter a PIN to send money, never to receive it. A fraud that has been hurting shopkeepers, small traders and online sellers across India relies on exactly this gap in everyday knowledge. It falls under social engineering fraud, where the criminal wins by steering the victim's behaviour, not by breaking into any system.

What happens

The fraudster calls a vendor, shopkeeper or small businessman, posing as a customer who wants to pay. The caller asks for the mobile number registered with Google Pay or PhonePe, which seems an entirely ordinary request.

Moments later, the victim gets a link or a QR code on their phone. The caller says: "I have sent the payment. Just open the link or scan the code to receive it."

But it is not a payment. It is a request for money, made to look like one. The link or QR code has been set up so that scanning it leads to a debit from the victim's account instead of a credit. The screen shows a rupee amount, the victim follows the steps, enters the PIN, and the money goes to the fraudster.

The victim thinks they are collecting a payment. In fact, they are authorising one.

The moment that gives it away, and why it is ignored

Most victims receive an SMS from their bank saying an amount has been debited. That message is the one clear signal that something has gone wrong. But when you are in the middle of a transaction you expect to be positive, it is easy to ignore, or to assume the message is a glitch that will sort itself out.

By the time the penny drops, the fraudster has usually tried again. A second request, a third. The caller says the earlier attempt "did not go through" and asks you to try once more.

Why it works

• Normal behaviour. Shopkeepers take digital payments all day. Sharing a number and scanning a code is routine, so it does not trigger suspicion.

• Business instinct. A customer who wants to pay is a customer you want to keep happy. Questioning them feels counterproductive.

• Visual trust. A QR code with an amount looks official. Few people can tell what a code will do before they scan it.

• Hurry. Callers sound busy, impatient or about to leave. They push for the transaction to be done immediately.

The single rule that defeats it

To receive money in UPI, you do not need to enter your MPIN or UPI PIN anywhere. Nothing. If a screen asks for your PIN while you believe you are being paid, stop right there. That screen is for sending money.

Two habits go with that rule:

1. Read before you tap. Check whether the screen says you are paying or receiving, and look at the name of the other party and the amount.

2. Look at your balance and SMS, not the caller's word. Money you have received appears in your account and in your bank's message. A caller telling you the payment is done proves nothing.

Practical steps for shops and small businesses

• Give customers your own QR code to scan, instead of scanning something they send you.

• Do not click links or scan codes from unknown numbers, even from a "customer".

• Wait for the credit alert in your own bank message or app before handing over goods.

• Be wary of anyone who wants your registered mobile number for a payment but will not simply scan your QR code.

• Train staff and family members who handle the counter or the phone, since they are often the ones targeted.

The legal angle

This kind of fraud is generally dealt with under the Information Technology Act, 2000, notably Section 66C (dishonest use of someone's identifying information) and Section 66D (cheating by personation using a computer resource), alongside the cheating provisions of the Bharatiya Nyaya Sanhita. The sections finally applied depend on the facts in the FIR and the view taken by the investigating agency.

If you have already lost money

1. Call your bank at once and ask them to block UPI and flag the disputed transactions.

2. Call the National Cyber Crime Helpline, 1930, without delay.

3. Register a complaint at cybercrime.gov.in.

4. Keep screenshots of the link or QR code, the call log, the SMS alerts and transaction IDs.

5. Report quickly. Under RBI's framework for unauthorised electronic transactions, reporting within three working days generally limits what the customer has to bear in cases where the fault is not theirs. Waiting can weaken your position.

Note that in this fraud the victim enters the PIN themselves, which means banks may argue the transaction was authorised. That is another reason to report quickly and to keep every record.

A closing thought

What makes this fraud so unfortunate is that it targets honest people doing honest work. The shopkeeper who wants to please a customer, or the seller who wants to close a deal, is the person most at risk. The defence is not complicated. Money comes in without a PIN. If someone asks you for one to "receive" a payment, politely end the call.