You never receive money by scanning a QR code or entering your UPI PIN. Once you know this, you are largely protected.
Here is the one fact that defeats this entire category of scam: you never receive money by scanning a QR code or entering your UPI PIN. Scanning a QR and entering your PIN always sends money out of your account. To receive money, you do nothing, you just share your UPI ID or number. Scammers make a living by confusing people about this, so once you are clear on it, you are largely protected.
You are selling something online, or expecting a refund. The "buyer" or "agent" says they will send you money, and shares a QR code for you to scan to "receive" it. The QR is pre-filled with the scammer's UPI ID and an amount. When you scan it and enter your PIN, you authorise a payment to them. You wanted to receive and instead you paid.
The same trick in a different wrapper. The scammer sends a "collect request" through your UPI app, often labelled to look like a refund or a credit. If you approve it and enter your PIN, you are paying them, not receiving from them. Approving any request and entering your PIN is always a debit from your account.
Receiving money never needs your PIN. Sending money always does. So the moment anyone asks you to scan a QR, approve a request, or enter your PIN to "get" money, stop. You are being set up to pay. To actually receive money, you only ever share your UPI ID, VPA or phone number, and that is all.
Fake "customer support" numbers found through search that walk you through "verifying" by scanning a code. Spoofed messages that look like they are from your bank or a payment app asking you to confirm a credit. Sellers or buyers on marketplaces who insist on an unusual payment dance. The thread through all of them is being asked to enter your PIN to receive. Never do it.
Act fast. Call 1930, raise a fraud dispute in your UPI app, call your bank on its official number, and file at cybercrime.gov.in. Our first-hour guide has the full order. The sooner you report, the better the chance of a freeze.
Do I need to scan a QR to receive money on UPI? No. Scanning a QR sends money. To receive, you only share your UPI ID or number.
Why does the request say "credit" or "refund"? Because the scammer labels it that way to trick you. Approving it with your PIN still debits your account. Decline any request you did not expect.