QR codes and screen sharing: check before you approve
Fraudsters turn familiar payment steps into convincing stories about refunds, deliveries or urgent bank verification. Learn what a QR code can initiate, why the confirmation screen matters and how remote access changes the risk even when you keep your PIN secret.
In this article
- Understand what scanning actually does
- Check the payee, amount and selected account together
- Separate receiving money from approving a debit
- Screen sharing can expose more than a single code
- Find support independently and read the OTP message
- Handle a sale or refund without following a stranger’s script
- Respond to a risky scan or remote session promptly
- Practise a small verification routine
- Sources & further reading
Understand what scanning actually does
A QR code can contain a payment address, a web link or other information. Scanning does not authenticate the person who sent it or guarantee that the destination belongs to the shop in front of you. With a payment code, your app may display a payee and ask you to enter or confirm an amount. That confirmation screen is the point to examine the proposed action before you authorise anything.
Codes can be replaced, covered with another sticker or sent in a convincing message. A printed bank logo on the display is not enough. Look for signs of tampering and ask the merchant to confirm the displayed payee if the name is unexpected. Do not proceed merely because the amount is small or someone behind you is impatient. A pause before payment is usually easier than trying to recover an authorised transfer to the wrong destination.
Check the payee, amount and selected account together
Read the recipient name, payment address where shown, amount and funding account in the trusted app. A shop’s registered payment name may differ from its signboard, which is a reason to clarify rather than automatically accuse anyone of fraud. Ask staff to explain the relationship. If the explanation is unclear, choose another verified payment method or wait. Do not let a caller talk you through the confirmation screen faster than you can read it.
Where an amount is prefilled, compare it with the bill. Where you enter the amount yourself, check the digits before entering a PIN. A small test payment, if you choose one, can help confirm receipt with a known counterparty but does not prove a stranger is trustworthy for a later large transfer. Check the bank or app record for the final status. A sound, screenshot or animation alone is not adequate proof for the recipient.
Separate receiving money from approving a debit
A common deception tells you to scan a code and enter your UPI PIN to receive a refund, prize or sale payment. For an ordinary incoming bank credit, you do not need to approve an outgoing payment to the sender. Read the actual action described by your app. If it is sending money, creating an authorisation or otherwise granting access, the caller’s story about receiving funds does not change that action.
Some legitimate payment products have registration, mandate or top-up steps with their own authentication. That does not justify treating every PIN request as a refund step. If you are unsure which flow you are in, exit and contact the provider through its genuine support route. The safest decision is based on the action you intended and the screen you can verify, not a universal promise that any particular app display can never be imitated.
Section references: [1]
Screen sharing can expose more than a single code
Screen-sharing software can let another person see the screen, including information you did not mean to disclose. Remote-control features can go further and allow interaction with the device. Fraudsters may present these tools as bank assistance, refund processing or technical troubleshooting. RBI’s fraud-awareness material warns about this pattern. Do not open banking services or enter financial credentials while an unsolicited caller can watch or control the session.
Even if you do not speak your PIN aloud, a remote session can reveal balances, notifications, account references or the sequence of actions you take. Someone may pressure you to approve permissions whose scope you do not understand. End the session and verify support independently. A genuine remote-support product can be misused; recognising the software brand does not authenticate the person requesting access. The question is who is connected and why they need that access.
Find support independently and read the OTP message
Fraudsters can place false contact details in advertisements, social posts or search results. Use the bank’s genuine app, an existing statement, the number printed on your card or a verified official website to locate support. If someone contacts you first, end the call and initiate a new contact yourself. A displayed caller name, profile photograph or knowledge of your recent purchase does not prove authority.
When an OTP arrives, read what it authorises. It may relate to a transaction, registration or password reset. Never forward it to a person who claims to cancel the event. Banks and legitimate payment support should not ask you to reveal your UPI PIN, banking password or card PIN. A rushed demand to install an attachment or make a verification transfer should be treated as a reason to stop, not as evidence that the process is official.
Handle a sale or refund without following a stranger’s script
Imagine you advertise a used bicycle for ₹3,000. A buyer says payment is ready but sends a code and asks you to enter ₹3,000 and your PIN. That would be a new action from your side, not proof of an incoming payment. Check your own account for an actual credit and confirm the transaction details. Do not release the item solely because the buyer shows a success screenshot or threatens to cancel immediately.
For an online-store refund, begin inside the genuine order or support record. Ask for the refund method, reference and expected processing information. You should not need to pay an unrelated personal address to unlock a routine refund. If the seller says an extra amount was sent by mistake, verify with your bank before returning money to a different address. Keeping the original transaction trail is more useful than trying to solve a confusing story through several fresh payments.
Section references: [1]
Respond to a risky scan or remote session promptly
If you scanned a code but did not approve an action or enter information, check what opened and close anything suspicious. If you installed software or granted remote access, disconnect the session and avoid using that device for financial activity until the access is understood and removed. From another trusted device, contact the bank about restricting affected services. Record the app name, permissions, time and actions you remember.
If money was taken, notify the bank immediately and report suspected financial cyber fraud through 1930 or the National Cybercrime Reporting Portal. Preserve payment references, messages and acknowledgements. Prompt reporting can assist containment but does not guarantee recovery. Do not let an online recovery agent turn the loss into another payment demand. Technical cleanup and financial reporting are separate tasks; completing one does not automatically complete the other.
Practise a small verification routine
Use a consistent pause: identify the action, read the payee, confirm the amount and check the funding account. For a household member who needs help, practise with a familiar merchant and explain the screen in their preferred language. Do not train them simply to press the green button whenever someone says refund. They should be comfortable ending a call and asking a trusted person to help verify the issue.
Merchants can inspect displayed QR codes regularly, limit who replaces them and verify receipts in their own transaction records. Tell staff what to do when a payer shows only a screenshot or a code looks altered. Customers should be able to clarify a payee mismatch without being hurried. These routines reduce avoidable mistakes, but no checklist establishes absolute safety. Keep reporting routes ready and make it easy for someone to disclose an error quickly without embarrassment.
Readers’ questions
Can scanning a QR code alone debit my bank account?
A normal UPI payment flow includes further action and authorisation; scanning is not the same as approving a transfer. However, a code can open a malicious link or lead into another risky process. Inspect what opens, avoid entering information into unfamiliar pages and read the trusted app’s proposed action. Do not treat the absence of an immediate debit as proof that a link is harmless.
Is every different payee name evidence of fraud?
No. A shop may use a registered business or proprietor name that differs from the signboard. Clarify it with the merchant before paying and use another verified method if the explanation is unclear. A mismatch is a useful warning to investigate, not conclusive proof by itself. For remote sellers, a convincing explanation still does not replace checking the seller, order and refund terms.
What if I already shared my screen but no money is missing?
End the session, review and remove unwanted access using trusted device guidance, and contact the bank if financial information or credentials may have been exposed. Secure connected accounts from a trusted device and monitor transactions. Do not assume there is no risk simply because the first check shows no debit. Preserve the conversation details, especially if you were instructed to install software or approve permissions.
Sources & further reading
- NPCI: Fraud Awareness ↗
- NPCI: UPI Frequently Asked Questions ↗
- RBI: BE(A)WARE—A Booklet on Modus Operandi of Financial Frauds ↗
- Google Pay Help: Beware of screen sharing apps ↗
- Ministry of Home Affairs / PIB: Indian Cyber Crime Coordination Centre (I4C), 4 February 2026 ↗
Sources were checked for this edition. Scheme rules, product conditions and local requirements can change; consult the responsible provider for a decision.