PhonePe Warns Users Against QR-Code Scams During Diwali, Shares Safety Tips To Protect UPI Payments

With Diwali shopping driving a surge in online transactions, digital payments platform PhonePe has flagged the growing risk of QR-code scams. Fraudsters exploit hurried shoppers during the festive season by placing fake QR-code stickers over genuine merchant codes or tricking users into scanning codes under the pretext of claiming festive cashback, refunds, or rewards.

How the QR Code Fraud Works

Scammers typically use two main tactics to divert payments into fraudulent accounts:

• Malicious Messaging: Fraudsters send a QR code image via WhatsApp or other messaging apps, asking the victim to scan it and enter their UPI PIN to "receive" free cash rewards or Diwali Bonus Offers or Gift Hampers. Some use apps that generate codes with pre-populated amounts. The moment the UPI PIN is entered, funds are debited from the victim's account.
• Tampered Merchant Codes: Customers unknowingly transfer money to a fraudster after scanning a tampered QR code placed over a legitimate shop's sticker.

The Golden Rule: You never need to enter your UPI PIN or "Pay" to receive money. A genuine sender only requires your phone number. If you receive a deceptive payment request, do not respond; report the user via the PhonePe app.

How To Protect Yourself From Scams

• Verify before paying: Always double-check the recipient's name and payment amount before entering your UPI PIN, especially when scanning codes at shops.
• Block spam: Enable a reliable pop-up blocker in your browser to intercept malicious messages.
• Avoid suspicious links: Never click on images or links inside unexpected pop-ups unless the source is definitively verified.
• Stick to trusted merchants: Shop exclusively with established sellers to protect your payment and identity details.
• Beware of false urgency: Treat high-pressure threats or ticking-clock offers as immediate red flags; pause to independently verify the claims.

How PhonePe's Security Measures Work

The PhonePe Protect framework is designed to flag potentially risky transactions and alert users during the payment process. It provides contextual warnings, allows users to confirm whether they authorised a payment and uses feedback to help strengthen fraud detection.

The platform also relies on security measures including KYC checks, biometric verification, document authentication and two-factor authentication. Behavioural biometrics, which analyse device characteristics and patterns of user activity, can help identify suspicious behaviour.

What Should PhonePe Users Do If They Are Scammed?

Raise a complaint on PhonePe: Users who suspect a fraudulent transaction should immediately report it through the Help section of the PhonePe app and contact customer support or the platform's grievance redressal channel.

Report financial cyber fraud immediately: Victims should report the incident through the National Cyber Crime Reporting Portal at cybercrime.gov.in or call the national cybercrime helpline at 1930 to help initiate timely action.

Flag suspicious calls and messages: Suspected fraudulent communications can be reported through the Chakshu facility on the Sanchar Saathi portal.

Never share confidential banking credentials: Consumers should not disclose their UPI PIN, passwords or one-time passwords to anyone claiming to offer refunds, cashback or festive rewards. Receiving money through UPI does not require entering a UPI PIN.