QR Code and Payment Link Fraud: How It Works and How Banks Stop It

Almost every complaint that lands at a bank's fraud desk starts the same way: "I only scanned a QR code" or "I just clicked a link to get my refund." That single sentence is the whole story of QR code and payment link fraud — the most common cyber crime pattern hitting Indian bank customers today. The victim believes they are receiving money; in reality, scanning a QR code or approving a UPI collect request always authorises an outward debit, never an inward credit. Understanding that one mechanical fact, and the scripts fraudsters wrap around it, is core exam material under the Prevention of Cyber Crime paper and core protection knowledge for any banker handling grievances.

📲 The Core Deception: Why Scanning Never Pays You

UPI has one unbreakable rule: money moves out of an account only when the holder authenticates a debit with their UPI PIN. A QR code is nothing but an encoded payment address — scanning it can only ever open a "pay" screen, never a "receive" screen. This is the single fact that exposes QR code and payment link fraud the moment a customer understands it. If you are meant to be receiving a refund, cashback, or sale proceeds, no PIN entry should ever be required.

A UPI collect request works the same way. The fraudster, posing as a buyer or refund agent, sends a collect request disguised as money being sent to the victim, with wording like "approve to receive ₹X." A genuine credit never asks for PIN approval — an app asking "enter UPI PIN to proceed" is always initiating an outward payment, whatever language sits above the button. Malicious payment links add a second layer: some lead to a spoofed payment page that harvests card and OTP details, others prompt installation of a screen-sharing app disguised as a "refund utility," after which the fraudster operates the victim's own banking app directly. See the chapter on Computer Hackers for how such remote-access techniques are built.

🎭 The Classic Scripts Behind Every Scam

Almost all QR code and payment link fraud cases fit a small set of repeating scripts, and recognising the script is faster than analysing each transaction on its own merits.

The fake buyer script targets sellers on classifieds and resale marketplaces. A "buyer" claims to have sent an advance and sends a QR code or collect request "to confirm the payment," insisting the seller scan or approve it to release funds — instead paying the fraudster. The refund or cashback lure follows failed transactions or fake festive offers, asking the victim to enter a PIN to "release" a stuck refund. The rental and job-advance scam asks a prospective tenant or applicant to pay a token booking amount through a link, often followed by a second "refundable deposit" QR code. The fake charity or parking-fine sticker scam pastes a QR sticker over a genuine donation box or municipal notice, redirecting scanned payments to a personal UPI handle.

⚠️ Common Mistake: Customers assume that because they initiated the scan, the transaction must be safe. The initiating action is irrelevant — only the PIN-entry screen tells you whether money is leaving or entering the account.

Cross-reference these scripts against the broader taxonomy in Channels Of Cyber Crimes, which classifies how each channel — social, marketplace, telecom, physical — is exploited.

🏪 Tampered Merchant Codes and Spoofed Payment Pages

At physical shops, fraudsters increasingly paste a duplicate sticker over a genuine merchant's printed QR code, or hand over a portable second code claiming the display code is "not working." Customers who skip the merchant-name confirmation screen that UPI apps show before PIN entry are the ones who fall for it — that name-match step exists precisely to catch a tampered or overlaid code.

Online, a spoofed payment page recreates a bank's or gateway's exact look to capture card number, expiry, CVV and OTP on a form with no real connection to the merchant's processor. Some links instead push an APK disguised as a payment-completion step that installs a remote-access trojan, letting the fraudster transact directly from the victim's device. Related detection techniques sit in the Computer Fraud Protection chapter. Practical guidance is simple: read the payee name before entering a PIN, never install an app from an unknown "support" link, and treat any "scan to receive" instruction as a red flag.

🛡️ How Banks Detect and Contain the Damage

Because QR code and payment link fraud relies on the victim self-authenticating a debit, prevention depends heavily on controls that surround the transaction. Real-time transaction alerts give the customer a narrow window to spot and report a debit before funds move onward. Per-transaction and daily UPI limits cap the loss from a single approved collect request, and a beneficiary cooling period — a mandatory delay before large payments to a newly added payee become active — blocks the fast first-hour cash-out fraud rings depend on.

On the bank's side, mule-account and velocity analytics scan for the signature of fraud proceeds: a personal account suddenly receiving many small credits from unrelated senders, followed by rapid onward transfer. Flagging such accounts quickly is often the only realistic way to recover funds once such a transaction has cleared, since UPI settlement is near-instant and irreversible at the rail level. Banks also correlate device IDs and beneficiary VPA reuse across complaints, feeding results into workflows described in Incident Management.

These layered defences are exactly why exam questions on QR code and payment link fraud frequently pair a technical control with a customer-behaviour failure — both halves are tested together.

📞 The Customer's Route: Reporting and Liability

A customer who has fallen for this kind of fraud should call the 1930 national cyber crime helpline immediately and file a complaint on the National Cyber Crime Reporting Portal, since both feed directly into the fund-freeze workflow banks run with payment intermediaries — speed is the single biggest determinant of recovery.

On liability, the applicable framework is RBI's directions on limiting customer liability in unauthorised electronic banking transactions, which set out zero, limited, or full liability depending on whether the loss stems from a bank-side deficiency, a genuine third-party breach reported promptly, or delayed reporting. Because a QR-scan or link-based transaction is technically authenticated by the customer's own PIN, banks must assess each case against the circular's timelines rather than treating self-authenticated debits as automatically the customer's fault.

💡 Exam Tip: Remember the sequence — helpline first for the golden-hour freeze window, portal complaint for the formal record, then the bank's liability assessment under the RBI framework.

Bankers should also stay alert to Electronic Card Frauds, since spoofed payment pages often harvest card data alongside UPI credentials in the same campaign.

🧠 Practice MCQs: QR Code and Payment Link Fraud

Want chapter-wise mock tests with 100+ MCQs? Start practising free →

❓ Frequently Asked Questions

✅ Conclusion: Make the Pull-Not-Push Rule Second Nature

Every variant of QR code and payment link fraud — the fake buyer, the refund lure, the rental advance, the fake charity sticker, the tampered merchant code, or the spoofed payment link — collapses under one question: does this action authenticate a debit or a credit? Bankers who can explain that distinction clearly, alongside the alerts, limits, cooling periods, and mule-detection controls behind it, are equipped to prevent losses and guide customers through the 1930 helpline, portal complaint, and liability process when prevention fails. For related fraud typologies, revisit SIM swap fraud in banking, swift payment fraud controls, and preventing business email compromise fraud, and for the broader IT-security roadmap see post-quantum readiness in banks. Browse more chapters in Prevention of Cyber Crime, and test your readiness now: take a free mock test →