QR Code Scam: Money Debited From Account, What Next?

You were trying to sell an old fridge on OLX. A polite buyer messaged within minutes, agreed the price without negotiating, and said he would send the money "right now" so you could hold the fridge for him. He asked for your phone number, switched to WhatsApp, and sent a small QR code image with the words "Scan to receive Rs 8,500." You opened your UPI app, scanned the code, entered your PIN — and the screen showed Rs 8,500 had been debited from your account, not credited. The buyer claimed it was a "system error" and sent another QR for "Rs 8,500 reverse transfer." You scanned again, lost another 8,500. Now he is offline, and your bank is sending you debit alerts you cannot explain.

If this sounds familiar — or you are reading this for an elderly parent, a flatmate, a small-shop owner — keep reading. The next few hours decide most of what is recoverable. The good news is that QR-code scams have one of the best legal and banking refund frameworks in the country, if you act fast.

How a QR Code Scam Actually Feels

The two common patterns are "buyer scams" and "refund scams." In a buyer scam, someone responds to your second-hand listing on OLX, Facebook Marketplace or Quikr and pushes the conversation to WhatsApp. They send a QR claiming it is for "receiving" the payment. In a refund scam, someone calls pretending to be from a delivery app, a telecom company or your bank, says a refund is pending, and walks you through scanning a QR.

Other variations are out there too — fake parking-meter QRs pasted over real ones, fake donation QRs at religious places, fake "scan to claim" QRs for gas-cylinder subsidies. The mechanics are always the same. A real-looking person, a sense of urgency, and a QR that you assume credits you when in fact it debits you.

This is not your fault for being polite or trusting. Indian Penal Code Section 415's own illustrations describe people who "fraudulently induce" others to part with property — including a man "by falsely pretending to be in the Civil Service" or "by exhibiting a false sample of an article." Replace the Civil Service with a "buyer," replace the false sample with a labelled QR, and you have the same offence in 2026 colours.

Why Scanning Always Debits — Never Credits

This part is worth understanding properly, because once you do, you stop falling for it.

A UPI QR code is just a small block of encoded text. When your phone reads it, your UPI app fills in two things — the receiver's UPI handle, and (sometimes) the amount. You then press "Pay" and enter your PIN. The PIN is your authorisation to send money. There is no such thing as a "scan to receive" QR. To receive money, the other person has to scan your QR, or you have to share your UPI ID and they enter it on their app.

So whenever someone says "scan this to receive," the request itself is the lie. The QR is a debit instruction. When you enter your PIN, you authorise that debit. The architecture only knows debits — the deception lives in the conversation.

This is why Section 66D of the Information Technology Act is the perfect fit. The IT Act commentary explains that 66D punishes anyone who, "by means for any communication device or computer resource," cheats by personation. The scammer's pretence of being a buyer or a refund agent — done over WhatsApp or a phone call — is the personation. Your loss flows from that pretence. That is the offence.

Which Laws Apply When QR Money Is Stolen?

Your FIR will usually combine three or four sections.

Section 66D, IT Act 2000 — cheating by personation by using a computer resource or communication device. Up to three years' imprisonment and a fine up to one lakh rupees. The IT Act commentary clarifies that "cheating by personation, by means of any communication device or computer resource, is an offence" — exactly your situation.

Section 43 read with Section 66, IT Act — when a person, "without permission of the owner or any other person who is incharge of a computer, computer system or computer network," accesses, manipulates or damages a computer resource. Where the scammer used your authorisation under deceptive framing to pull money, the dishonest or fraudulent use of your computer resource is squarely covered. The commentary notes that Section 66 makes "computer-related offences" criminal where Section 43 conduct is done "dishonestly or fraudulently."

Section 420, IPC (Section 318 BNS, 2023) — cheating and dishonestly inducing delivery of property. Punishment up to seven years. Captures the actual money loss.

Section 66C, IT Act — used when the scammer impersonated a real person, a brand or an officer, fraudulently using their identification feature.

The base concept is in Section 415 IPC. The case of Hridya Rajan Pd. Verma v State of Bihar (AIR 2000) clarified that the dishonest intent must exist from the very inception of the transaction. In a QR-code scam, the dishonest intent is built into the first message — there was never a real buyer, never a real refund. A clean cheating-and-fraud file hangs on showing exactly this.

The First 30 Minutes — 1930, Bank, Cyber Portal

Speed is everything. Run through the following in order:

1. Call 1930. The national cyber-fraud helpline. Have the transaction ID, beneficiary UPI handle, amount and time ready. The 1930 desk forwards an alert to the receiving bank, which can place a temporary lien on the disputed amount if it is still sitting in the beneficiary account.
2. File at cybercrime.gov.in. Upload screenshots of the chat, the QR image, the UPI debit screen, and your bank statement extract. Save the complaint reference number.
3. Call your own bank's fraud helpline. Tell them about the disputed UPI debit, ask for it to be flagged as fraud, and request a written acknowledgement by email. Note the time and the name of the officer.
4. Raise a dispute inside your UPI app. Most apps (PhonePe, Paytm, Google Pay, BHIM) have a "Raise a Dispute" or "Help" button against each transaction. Use it. The NPCI dispute is independent of the bank dispute and can sometimes recover money before the bank moves.

Do not wait until morning. Do not assume your bank app's chat-bot is enough. Talk to a human, and write down their employee code or reference number.

The RBI Customer-Liability Framework — Why 3 Days Matter

The Reserve Bank of India has issued a customer-protection framework on unauthorised electronic banking transactions that every Indian bank is bound by. The framework sets out who pays for a fraudulent debit, depending on the customer's behaviour and the speed of reporting. The exact wording lives in RBI's circulars; what matters at the principle level is the structure:

• Where the customer is not at fault — for example, when the loss happens because of a third party's fraud and the customer reports promptly — the customer is expected to bear zero liability. Reporting within three working days is the strongest tier and aligns with this zero-liability protection.
• Where reporting is delayed by a few more working days — typically four to seven working days under the framework — the customer can be held liable for a limited amount, capped according to the type of account.
• Where reporting is delayed beyond that, or the loss is due to the customer's gross negligence (such as sharing OTPs, PINs or credentials), the customer can bear full liability for amounts debited until they finally report.

This is why the first 72 hours are not just symbolic. They directly decide who pays. We are stating the framework at the level of principle here — your lawyer or your bank's grievance team will quote the exact circular paragraph for your case. Do not memorise circular numbers; just remember: report within three working days, in writing, with reference numbers.

Also, do not share OTPs or PINs with anyone, including someone claiming to be from the bank or the helpline. A genuine bank officer never asks for them. Sharing any OTP or PIN is the single fastest way to lose your zero-liability protection.

The Bank-Side Dispute and the UPI App's Role

The dispute moves on three parallel tracks.

The UPI app (PhonePe, Paytm, Google Pay) raises a dispute through the National Payments Corporation of India dispute-resolution system. This can sometimes reverse the transaction if the receiving bank still holds the money or if the dispute matches a clear fraud pattern. Save the dispute reference number.

Your own bank opens an internal investigation, places markers on the disputed transaction, and corresponds with the receiving bank. Within the timelines of the RBI customer-liability framework, the bank credits the disputed amount (provisionally or finally) if it concludes the transaction was unauthorised or fraud-induced and the customer reported promptly.

The receiving bank may freeze the beneficiary account on a 1930 alert or a police request, recover the unspent balance, and cooperate on KYC details. This is what eventually leads either to a refund into your account or to the police identifying who held the money.

If your bank refuses to refund and you believe the RBI framework supports your claim, you can escalate to the bank's nodal officer, then to the Reserve Bank Integrated Ombudsman (cms.rbi.org.in). Banking ombudsman complaints are free and decisions are binding on the bank up to a monetary cap. Most QR-code scam refunds, in our experience, settle at one of the earlier stages without needing the ombudsman.

The FIR — Why You File One Even if the Bank Refunds

People often ask: my bank is processing a refund, do I still need to file an FIR? Yes, for three reasons.

First, the bank's refund is a civil-side recovery; the FIR is the criminal-side punishment. The fraudster does not stop just because you got your money back. An FIR feeds into a network the police are already tracking.

Second, banks sometimes withdraw a provisional refund if their internal review concludes the loss was due to your negligence. An FIR establishes, on official record, that you were a victim and not a participant — that record protects you if the bank's stance changes.

Third, the receiving bank may recover the money from the beneficiary account weeks later. An FIR is the path through which the recovered amount gets routed back to you, often with the help of a court order.

Filing the FIR works the same way as for any cyber offence. Walk into any police station — the zero-FIR principle and Section 173 BNSS allow registration anywhere. If the police refuse, write to the SSP under Section 173(4) BNSS / 154(3) CrPC, then move to the Judicial Magistrate under Section 175(3) BNSS / 156(3) CrPC. The Supreme Court in Sakiri Vasu v State of UP (2008) set out this layered remedy.

Evidence to Save — and Why

Even though QR-code scams are short and sharp, the evidence still matters.

• The chat or call log with the "buyer" or "refund agent." If WhatsApp, do "Export Chat — include media."
• The QR code image the scammer sent, and any audio note saying "scan to receive."
• A screen recording or screenshot of your UPI app showing the debit, the beneficiary handle, and the transaction ID.
• The bank statement extract showing the disputed debit, with reference number.
• The complaint reference numbers from 1930, cybercrime.gov.in, the bank, and the UPI app's dispute.
• If the contact called you, the caller's number and the call duration from your phone log.

This electronic material, when used in court, has to clear Section 65B of the Indian Evidence Act. The Evidence Act commentary, citing Anvar PV v PK Basheer (AIR 2015 SC 180), makes clear that secondary electronic evidence — your screenshots, the recording, the export — must be accompanied by a Section 65B certificate. The certificate is drafted by your lawyer; your job is to keep the originals untouched. Do not factory-reset the phone or delete the chats until trial.

What Should I Actually Do Now?

1. Stop scanning anything else. Block the contact. Switch off auto-debit features in the UPI app.
2. Call 1930 with the transaction ID and beneficiary UPI handle. File a complaint at cybercrime.gov.in.
3. Call your bank's fraud helpline. Ask for an email acknowledgement of the dispute and a complaint reference number.
4. Raise a dispute inside the UPI app against the disputed transaction. Save the dispute reference.
5. Send a written intimation to your bank by email noting the transactions, the time of report, and asking for protection under the RBI customer-liability framework on unauthorised electronic banking transactions.
6. Save evidence — chat or call log, the QR image, screenshots of the UPI debit, bank statement extract.
7. File an FIR at any police station. Use the zero-FIR principle if needed. If the police refuse, escalate through the SSP and the magistrate route.
8. If the bank delays or refuses refund, escalate to the bank's nodal officer, then to the RBI Integrated Ombudsman at cms.rbi.org.in.
9. Tell people who matter. If the loss is significant, tell your spouse and consult a lawyer. Hiding it makes the next few weeks harder.
10. For Delhi-based victims, the cyber-fraud team at Pinaka Legal handles QR-code and UPI-fraud matters and can structure your bank correspondence and FIR follow-up so the RBI framework arguments land where they should.

A Calmer Thought to End With

QR-code scams hit because they exploit something good about you — the willingness to help a stranger complete a transaction. That willingness is not a flaw. The fraud is a flaw. And the system, slowly, is beginning to push back. The RBI customer-liability framework, the 1930 helpline, the cybercrime portal, and the BNSS investigative powers are real tools. They work better the faster you use them.

For most QR-code victims who report within the same day, partial or full recovery is realistic. For those who delay by a week or share OTPs along the way, recovery becomes a much steeper climb. So make the calls now. Write the emails now. File the FIR now. The criminal case will run at its own pace — slow and unsatisfying, like all criminal cases — but the bank-side refund moves on the RBI's clock, and that clock starts the moment you report. Move with it.

Frequently Asked Questions

I scanned a QR code and money got debited — what should I do first?

Within minutes, call the national cyber-fraud helpline 1930 with the transaction ID and the beneficiary UPI handle, and file a written complaint at cybercrime.gov.in. Then call your bank's fraud helpline and ask them to flag the transaction, freeze further debits, and send you a written acknowledgement of the dispute. Speed decides almost everything here. The RBI customer-liability framework gives you the strongest protection if you report within three working days, so do not wait until morning.

How does scanning a QR code take money instead of receiving it?

A UPI QR code is just an instruction your phone reads. There is no 'receive' QR — every QR code triggers a payment from the scanner's account to the printed UPI handle. The scammer pretends to be a buyer or a refund agent and sends you a QR with a pre-filled amount, sometimes labelled as 'scan to receive'. When you scan and approve it with your UPI PIN, you are paying them, not the other way around. The architecture only knows debits — the deception is in the framing.

Which sections of law apply to a qr code scam?

The FIR usually invokes Section 66D of the Information Technology Act for cheating by personation using a computer resource (the fraudster's pretence of being a buyer or refund agent), Section 66 read with Section 43 IT Act for the unauthorised use of computer resources, and Section 420 of the Indian Penal Code for cheating. The base concept is in Section 415 IPC — dishonest inducement that causes you to part with money. Section 66C IT Act may be added if the scammer impersonated a real person or a known brand.

Will the bank refund my money for a qr code scam?

It depends on how quickly you report. The Reserve Bank of India's customer-protection circular on unauthorised electronic banking transactions sets a layered framework. If you report promptly — typically within three working days — and the loss is not due to your own gross negligence, the bank is expected to provide zero or limited liability under that circular. Delay beyond a week, or sharing of OTPs and PINs, can shift liability back to you. The earlier and more clearly you report, the stronger your refund claim.

What is the difference between a bank dispute and a police FIR for the same transaction?

They run in parallel and do different work. The bank dispute, raised through the bank's fraud team and the UPI app, is a civil claim for refund under the RBI framework — money back. The FIR is a criminal complaint that punishes the offender and lets the police trace the network. You need both. Filing one does not replace the other. The FIR also strengthens your bank dispute, because banks take a flagged-fraud case more seriously than a he-said-she-said chargeback.

How important is reporting within 3 days for the RBI zero-liability rule?

Very important. The RBI customer-liability framework on unauthorised electronic banking transactions builds tiers around how fast a customer reports a fraudulent debit. Reporting within three working days is the strongest tier, designed to result in zero customer liability where the customer is not at fault. Reporting between four and seven working days carries limited liability. Beyond that, the customer can be held liable depending on how the transaction occurred. So speed of reporting is not just paperwork — it directly decides who pays.

What evidence should I save for a qr code scam?

Save the chat or call where the scammer contacted you, a clear photo of the QR code itself, a screen recording of the UPI app showing the debit, the transaction ID, the beneficiary UPI handle, the bank statement extract, and any 'cashback portal' or fake refund email. If the scam was over a phone call, note the number and the time, and save your call log. All of this is electronic evidence that needs a Section 65B certificate at trial — your lawyer drafts it; you preserve the originals.

Can I file an FIR if the scammer is in another state?

Yes. The zero-FIR principle, recognised by the Supreme Court and built into the Bharatiya Nagarik Suraksha Sanhita, lets any police station register an FIR even when the offence happened partly elsewhere. The local station then transfers it to the station with proper jurisdiction. Cyber offences also use the location of the affected computer resource and the affected person, so a Delhi police station can register your QR-code-fraud FIR even if the receiving account is in another state.

The police are refusing my QR code FIR — what next?

Send a written complaint by registered post to the Senior Superintendent of Police of the district under Section 173(4) of the BNSS (the equivalent of Section 154(3) CrPC). If the police still do not register, file a complaint to the Judicial Magistrate under Section 175(3) BNSS / Section 156(3) CrPC asking the court to direct registration and investigation. The Supreme Court in Sakiri Vasu v State of UP confirmed this layered remedy. A short-form lawyer engagement at this stage often unlocks the FIR.

How do these QR scams typically reach me?

The two common routes are 'buyer scams' and 'refund scams'. In a buyer scam, someone responds to your OLX or Facebook Marketplace listing, says they want to send you the money, and pushes a QR via WhatsApp 'to receive' the payment. In a refund scam, someone calls pretending to be from a delivery app or telecom company offering a refund and asks you to scan a QR. Both are the same legal offence — cheating by personation using a computer resource — under Section 66D IT Act.

Should I engage a lawyer for a qr code scam?

For small amounts and quick recoveries, often you can manage with the 1930 helpline, the bank fraud team and a basic FIR. For larger losses or where the bank delays the refund, a lawyer becomes useful for writing to the bank under the RBI framework, following up the FIR, drafting the Section 65B certificate, and approaching the magistrate or banking ombudsman. Pinaka Legal in Delhi handles QR-code and UPI fraud matters and can give a frank read on whether your case needs full legal action.

For more articles on Indian law, visit the Pinaka Legal Blog. For queries, call +91 8595704798 or email info@pinakalegal.com.