Cyber Crime • UPI • Refund Scam • Collect Request • QR Fraud

UPI Receive-Money / Refund Trick: I Scanned a QR or Approved a Request to Receive Money and My Account Was Debited — What Happened?

You were told that money was coming to you. Instead, after scanning a QR or approving a UPI request and entering your PIN, money left your account. The key is to separate the scammer's story from the actual payment instruction: receiving an ordinary UPI credit does not require you to authorise a fresh debit, and after October 2025 ordinary person-to-person collect requests are no longer supposed to be processed through UPI.

Current legal and technical review: 20 August 2026

Direct Answer

If you were told to scan a QR code or approve a UPI request so that you could receive money, but your account was debited after you entered your UPI PIN, you most likely authorised an outgoing payment rather than an incoming credit.

For an ordinary UPI receipt:

THE RECIPIENT DOES NOT NEED TO ENTER A UPI PIN TO RECEIVE THE MONEY.

A QR that another person gives you is generally something you scan to pay that beneficiary. A collect request historically meant that the requester was asking you to pay them; approving it caused a debit from your account.

However, do not stop the analysis at:

“You entered the PIN yourself.”

PIN entry can establish payment authentication. It does not automatically prove that you knowingly intended to pay the person if the payment was induced by a false refund or receive-money representation.

Quick Navigation

1. The direction-of-money test
2. Push payment explained
3. Collect / pull payment explained
4. What changed after October 2025?
5. Why scanning a QR does not receive money
6. What a genuine refund looks like
7. Failed-payment reversal vs refund scam
8. Does entering the UPI PIN make the payment voluntary?
9. What transaction metadata should be preserved?
10. Preserve the fraud story itself
11. Collect request vs mandate / AutoPay
12. How to frame the bank dispute
13. 1930, NCRP and fund tracing
14. Criminal-law analysis
15. Electronic evidence
16. RBI Ombudsman 2026
17. Master forensic audit
18. Frequently asked questions

1. Start With the Direction of Money

Ignore the words:

refund, cashback, receive, reversal, verification, credit.

Ask only:

WHO WAS SUPPOSED TO PAY WHOM?

What the victim believed

SCAMMER / MERCHANT → ₹20,000 → VICTIM

What the UPI record may show

VICTIM → ₹20,000 → SCAMMER / BENEFICIARY

That inversion is the fraud mechanism.

2. Push Payment: The Payer Sends Money

A push transaction is payer-initiated.

Typical flow:

The receive-money QR scam usually abuses this flow.

The fraudster says:

“Scan to receive.”

But the QR prepares:

PAY TO THIS BENEFICIARY.

3. Collect / Pull Payment: The Requester Asks the Payer to Pay

Historically, UPI supported P2P collect requests.

The requester initiated:

PLEASE PAY ME ₹X.

The payer then:

• received the request;
• reviewed it;
• approved or rejected it;
• entered the UPI PIN if approving.

Approval therefore meant:

DEBIT MY ACCOUNT AND PAY THE REQUESTER.

Why fraudsters liked the wording

An incoming notification can psychologically feel like incoming money.

The fraudster exploits the ambiguity:

“I have sent the refund request.”

The technical meaning may be the exact opposite:

THEY HAVE ASKED YOU TO PAY THEM.

4. What Changed After 1 October 2025?

NPCI discontinued ordinary person-to-person UPI collect requests from 1 October 2025.

For current 2026 analysis:

What still exists?

• ordinary send-money UPI payments;
• QR payments;
• merchant payments;
• merchant collect integration where supported;
• mandates / AutoPay under their own framework.

Why this matters in a 2026 fraud investigation

If a victim says:

“A stranger sent me a personal UPI collect request in July 2026,”

do not simply accept the label.

Obtain the transaction metadata and determine whether the underlying flow was actually:

• merchant collect;
• push payment;
• mandate;
• merchant checkout;
• another UPI request type.

5. Why Scanning Someone Else's QR Does Not Receive Money

The cleanest way to understand QR direction is:

To receive money

You can share:

YOUR QR

with the person who is paying you.

To pay money

You scan:

THEIR QR.

NPCI's current fraud-awareness message reflects exactly this distinction.

The UPI PIN is the warning point

When the app asks for your UPI PIN, ask:

WHAT AM I AUTHORISING?

Do not rely on what the caller says.

Read the app.

6. What Does a Genuine UPI Refund Look Like?

NPCI's merchant guidance contemplates a merchant seeking refund of the originally charged amount through the defined banking/acquiring process.

A genuine refund should therefore ordinarily be linked to:

• original merchant;
• original order;
• original transaction;
• refund amount;
• refund reference;
• merchant/acquirer process.

What the customer should normally see

MONEY COMES BACK.

The customer does not make a new payment to receive the old payment back.

Suspicious refund instruction

“Refund of ₹10,000 is ready.”

“Scan QR.”

“Enter ₹10,000.”

“Enter UPI PIN.”

“You will receive ₹20,000.”

That is not an ordinary refund flow.

7. Failed-Payment Reversal Is Different From a Refund Scam

NPCI states that where a UPI transaction fails after debit, the system provides for reversal and the customer can approach the bank if the amount is not returned.

A reversal is tied to:

THE ORIGINAL FAILED TRANSACTION.

It should not require:

A NEW PAYMENT TO A STRANGER.

8. “But You Entered the UPI PIN”: Does That Make the Transaction Voluntary?

It proves an important fact:

THE PAYMENT WAS AUTHENTICATED THROUGH THE UPI CREDENTIAL FLOW.

It does not automatically prove:

THERE WAS NO FRAUDULENT INDUCEMENT.

Example

Fraudster says:

“Enter your PIN to receive ₹20,000.”

Victim believes:

PIN = RECEIPT CONFIRMATION.

System actually executes:

PIN = AUTHORISE ₹20,000 PAYMENT.

The transaction may be technically authenticated.

The victim's decision may simultaneously have been caused by deception.

The correct legal formula

Do not overstate the bank-liability consequence

RBI's unauthorised-electronic-transaction framework has its own technical scope.

A PIN-authenticated transaction may not fit neatly into the same category as an account takeover where the customer did nothing.

That does not make the scam imaginary.

It means:

AUTHENTICATION, FRAUD AND CUSTOMER-LIABILITY CLASSIFICATION MUST BE ANALYSED SEPARATELY.

9. Preserve the UPI Request and Transaction Metadata

The most important evidence may disappear from the app interface over time.

For a collect/request transaction preserve

For a QR transaction

• preserve the original QR image;
• preserve the message through which it was received;
• record the sender;
• record the VPA encoded/resolved;
• record beneficiary name;
• record amount if pre-populated;
• preserve transaction history.

10. Preserve the Story the Fraudster Told You

The UPI record may show:

A → B → ₹25,000.

It may not show:

B said:

“This is your refund. Enter PIN to receive it.”

That is why communication evidence matters.

Preserve

• WhatsApp;
• Telegram;
• SMS;
• marketplace chats;
• emails;
• caller numbers;
• call recordings where available;
• fake customer-care pages;
• screen-sharing messages;
• refund screenshots;
• QR images.

Do not edit the evidence

Preserve original files and full conversations wherever possible.

A cropped screenshot may omit:

• sender identity;
• time;
• preceding representations;
• following admissions;
• file metadata.

11. Do Not Confuse Collect Requests With UPI Mandates / AutoPay

A mandate is a different payment mechanism.

Approving a mandate may create authority for:

• a defined recurring debit;
• a future debit;
• a capped debit arrangement;
• a merchant/subscription payment.

A scammer may tell a victim:

“Approve this mandate to receive the refund.”

That should be treated with the same directional question:

WHAT FUTURE DEBIT AUTHORITY AM I CREATING?

Preserve mandate details

• mandate ID;
• merchant/payee;
• maximum amount;
• frequency;
• start/end date;
• status;
• revocation history.

12. How to Frame the Bank / UPI-App Complaint

Avoid an inaccurate one-line complaint

“I did not authorise this.”

If the records show you entered the PIN, the bank may immediately reject the factual premise.

Describe what actually happened

For example:

Attach

• transaction screenshot;
• in-app history;
• bank debit entry;
• RRN;
• beneficiary VPA;
• fraud communication;
• 1930/NCRP acknowledgement;
• police complaint if already filed.

The objective is not merely:

“PLEASE REFUND.”

It is also:

“PRESERVE THE PAYMENT TRAIL AND ACT BEFORE THE BENEFICIARY MOVES THE FUNDS.”

13. Report Immediately: Bank / PSP + 1930 + NCRP

If the debit was fraud-induced:

1. stop all further interaction/payment;
2. contact the payer bank;
3. report through the UPI app/PSP;
4. call 1930;
5. lodge the cyber complaint on NCRP;
6. preserve the acknowledgement;
7. provide beneficiary VPA, amount, RRN and exact time;
8. follow with police/cyber-police procedure where required.

Speed matters because the receiving account can transfer the funds to:

BENEFICIARY ACCOUNT 1 → MULE 2 → MULE 3 → CASH / WALLET / OTHER EXIT.

The national CFCFRMS architecture exists specifically to facilitate rapid financial-fraud reporting and banking coordination.

14. Criminal-Law Analysis

BNS Section 318 — Cheating

Where the offender deceives the victim and thereby dishonestly induces delivery of money, Section 318 may become directly relevant depending upon the evidence.

BNS Section 319 — Cheating by Personation

This may apply where the scammer pretends to be:

• bank employee;
• merchant;
• customer-care executive;
• company representative;
• another individual.

IT Act Section 66D

Potentially relevant where cheating by personation occurs through a communication device or computer resource.

IT Act Section 66C

Use only where the statutory identity-theft requirements are actually satisfied.

Do not treat every UPI fraud as automatically involving identity theft.

15. Electronic Evidence: Preserve the Complete Chain

For current proceedings, electronic/digital evidence should be handled consistently with Sections 61-63 of the Bharatiya Sakshya Adhiniyam, 2023.

Evidence chain

SCAM MESSAGE → QR / REQUEST → APP SCREEN → PIN AUTHORISATION → TRANSACTION RECORD → BANK DEBIT → BENEFICIARY VPA → RECEIVING BANK → ONWARD MOVEMENT.

Device evidence can answer

• which app was used;
• when the QR was received;
• whether screen sharing was active;
• what remote-access application was installed;
• what communications occurred before payment.

Bank/PSP records can answer

• transaction type;
• P2P/P2M classification;
• payer PSP;
• payee PSP;
• VPA;
• RRN;
• status;
• beneficiary institution;
• timestamps.

16. RBI Ombudsman 2026: When Is It Relevant?

The Reserve Bank – Integrated Ombudsman Scheme, 2026 applies from 1 July 2026 and provides a grievance mechanism for qualifying complaints involving deficiency in service by covered Regulated Entities.

The ordinary sequence is:

CUSTOMER → COMPLAINT TO BANK / COVERED ENTITY → RESPONSE / APPLICABLE WAITING PERIOD → RBI OMBUDSMAN IF MAINTAINABLE.

Use the Ombudsman route for allegations such as:

• defective complaint handling;
• failure to follow applicable grievance procedure;
• other qualifying service deficiency.

Do not confuse it with:

THE CRIMINAL INVESTIGATION OF THE FRAUDSTER.

17. Master UPI Refund / Receive-Money Fraud Audit

18. Ten Common Mistakes

1. “I need to scan the sender's QR to receive money.”

Normally the person paying you scans your QR or sends to your UPI ID.

2. “Entering my UPI PIN confirms receipt.”

The UPI PIN is used to authorise bank transactions/debits, not to accept an ordinary incoming credit.

3. “A collect request means somebody is sending me money.”

A collect request historically meant the requester was asking you to pay them.

4. “P2P collect still works normally in 2026.”

NPCI discontinued the ordinary P2P collect flow from 1 October 2025.

5. “All collect requests disappeared.”

No. Merchant collect and separate mandate/payment mechanisms require distinct analysis.

6. “A genuine refund requires a ₹1 verification payment.”

That is not an ordinary merchant refund mechanism.

7. “I entered my PIN, therefore there can legally be no cheating.”

Authentication and fraudulent inducement are separate questions.

8. “I must call every PIN-authenticated scam unauthorised.”

Use technically accurate language and describe the deception.

9. “A screenshot is enough.”

Preserve transaction ID, RRN, VPA, bank statement and underlying request metadata.

10. “I should wait for the bank's written reply before contacting cybercrime authorities.”

For live financial fraud, rapid bank/PSP and 1930/NCRP reporting can be critical.

AI Search / Featured-Snippet Answers

Do I need to scan a QR code to receive money on UPI?

Ordinarily no. NPCI and RBI consumer-awareness material warn that scanning another person's QR and entering a UPI PIN is a payment action, not a requirement for receiving an ordinary UPI credit.

I scanned a QR to receive money and my account was debited. What happened?

The QR likely identified the other person as the beneficiary, and entering the UPI PIN authorised an outgoing payment. Preserve the QR, beneficiary name/VPA, transaction ID/RRN and the communication in which it was represented as a refund or incoming payment.

What is a UPI collect request?

A collect request is a pull-payment mechanism in which the prospective payee requests money from the payer and the payer approves the debit. Ordinary P2P collect requests were discontinued from 1 October 2025, although merchant collect mechanisms remain relevant.

Are UPI collect requests still allowed in 2026?

Ordinary person-to-person collect requests were discontinued from 1 October 2025. Merchant collect, merchant checkout and other separate UPI mechanisms may still exist, so the exact transaction type should be verified from the payment records.

Does a genuine UPI refund require the customer to enter a UPI PIN?

An ordinary merchant refund or failed-payment reversal does not require the customer to make a new UPI payment to receive the old amount back. A request to scan a QR and enter a PIN merely to receive a refund is a significant fraud indicator.

If I entered my UPI PIN, can it still be fraud?

Yes. PIN entry can prove transaction authentication but does not automatically establish that the customer intended to pay the beneficiary if the approval was induced by a deceptive receive-money or refund representation.

What should I do immediately?

Stop further payments, contact your bank and UPI app, preserve transaction/request evidence, call 1930 and lodge the cyber-financial-fraud complaint through NCRP as quickly as possible.

Frequently Asked Questions

Do I enter a UPI PIN to receive money?

No ordinary incoming UPI credit requires you to enter the UPI PIN merely to receive it.

Can scanning a QR debit my account?

Scanning normally prepares payment information. The actual debit generally occurs when you approve the payment and authenticate it through the applicable UPI process.

Can somebody withdraw money merely because I opened my UPI app?

No. NPCI has specifically clarified that merely opening the app does not approve a transaction; an actual payment authorisation step is required.

Can merely scanning the QR complete the payment?

Ordinarily the payment still requires the relevant confirmation/authentication. The critical point is that scanning a beneficiary QR is associated with paying, not receiving an ordinary credit.

What did NPCI change in October 2025?

Ordinary person-to-person UPI collect requests were discontinued from 1 October 2025.

Are merchant collect requests also banned?

No blanket proposition of that kind should be made. NPCI's current merchant material continues to recognise Collect as a merchant integration mode.

Can a merchant genuinely refund money through UPI?

Yes. The merchant can initiate the applicable refund through its bank/acquirer process. That is different from asking the customer to make a new payment to receive the refund.

What if the merchant sends me money as a fresh UPI payment?

You can receive an ordinary incoming transfer without entering your UPI PIN merely to receive the credit.

What if the scammer first asks for ₹1?

A small verification debit can be used to normalise the payment flow. It is not proof that the later refund story is genuine.

If I entered the PIN, will the police say I paid voluntarily?

The PIN entry is relevant evidence of authentication, but investigators should also examine the representation that induced the payment, the beneficiary identity, chats/calls and what the victim believed the transaction would do.

Should I call the transaction “unauthorised”?

Use the terminology carefully. If you personally entered the PIN, describe the transaction accurately as fraudulently induced if that is what occurred and let the bank/legal process determine the applicable customer-liability classification.

What is the most important evidence?

The beneficiary VPA, transaction ID/RRN, amount, time, app transaction record and the communication showing that the payment was falsely represented as a refund or incoming credit.

Should I preserve the original QR image?

Yes. Keep the original message/file if possible rather than only a cropped screenshot.

Can an incoming “refund request” actually debit me?

If it is a payment request that you approve, it can result in an outgoing debit. The label used by the scammer does not determine the actual UPI transaction direction.

What if I approved a UPI mandate instead?

A mandate is a different mechanism that may create authority for future or recurring debits. Preserve the mandate ID, merchant, amount/frequency and revoke or report it through the appropriate app/bank process where fraud is suspected.

Can I stop a completed UPI payment?

NPCI states that once a UPI payment is initiated it cannot simply be stopped. Fraud cases therefore require rapid reporting, tracing and the applicable recovery/dispute process.

Where should I complain?

Notify the bank and relevant UPI app/PSP immediately, use 1930/NCRP for cyber financial fraud and pursue police/cyber-police action as applicable.

Can NPCI refund my money directly?

NPCI facilitates transaction-status/complaint routing, while its complaint material specifically directs fraud-related complaints to the customer's respective bank for redressal.

Can RBI Ombudsman help?

Potentially where there is a qualifying deficiency in service by a covered Regulated Entity after the required first complaint to that entity. It does not replace the criminal fraud complaint.

Which criminal provision is most relevant?

BNS Section 318 on cheating can be central where deception dishonestly induces delivery of money; personation and IT Act provisions may also arise depending upon the actual modus operandi.

What is the strongest one-line safety rule?

If money is supposed to come to you, do not authorise a debit merely because the caller labels it a “refund” or “receive-money verification”.

Official Legal and Technical Sources

• National Payments Corporation of India — UPI Frequently Asked Questions
• National Payments Corporation of India — Fraud Awareness
• National Payments Corporation of India — BHIM / UPI product material
• Reserve Bank of India — BE(A)WARE consumer fraud-awareness material
• Reserve Bank of India — Integrated Ombudsman Scheme, 2026
• Indian Cyber Crime Coordination Centre / Ministry of Home Affairs — NCRP and CFCFRMS
• India Code — Bharatiya Nyaya Sanhita, 2023
• India Code — Bharatiya Nagarik Suraksha Sanhita, 2023
• India Code — Bharatiya Sakshya Adhiniyam, 2023

Related Detailed Research

• From Cyber Police FIR to Enforcement Directorate: How a Cyber-Fraud Case Can Develop Into a PMLA Investigation

This article should also be internally linked with the dedicated Merchant QR Replacement article because the two scams involve different QR failures:

Merchant QR Replacement: genuine shop QR is physically substituted.

This Article: victim is deliberately induced to scan/pay while believing the action will receive a refund.

Professional Consultation for UPI Refund, QR and Cyber-Financial Fraud Matters

Advocate Ankit Kumar Singh

Supreme Court of India | Patna High Court | Allahabad High Court at Prayagraj | Jharkhand High Court at Ranchi | Calcutta High Court | Delhi High Court and Delhi Courts/Tribunals | Matters concerning Bhopal, Madhya Pradesh | Multiple District Courts

Depending upon the facts, jurisdiction and accepted professional engagement, professional work may include:

• UPI refund and QR fraud;
• collect-request fraud;
• fraudulently induced UPI payments;
• bank / PSP representations;
• 1930 and NCRP follow-up;
• beneficiary-account tracing;
• mule-account issues;
• UPI transaction reconstruction;
• RRN/VPA analysis;
• electronic-evidence preservation;
• fake customer-care fraud;
• screen-sharing and remote-access fraud;
• BNS / IT Act offence analysis;
• RBI-regulated-entity grievances;
• parallel financial-crime proceedings where legally applicable.

Phone: 8294431232
Email: ankitsingh.legum@gmail.com
Website: advocateankitkumarsingh.in

Subject to accepted professional engagement, territorial jurisdiction, applicable procedure and local-counsel coordination where required.

Add AdvocateAnkitKumarSingh.in as a Google Preferred Source

For detailed legal research concerning cyber fraud, UPI disputes, digital evidence, banking complaints and financial crime, readers may add advocateankitkumarsingh.in as a Preferred Source on Google.

Legal Disclaimer: This article is general legal and cyber-fraud research and is not case-specific legal advice. UPI terminology, app interfaces and payment products can differ, and a transaction described by a victim as a “collect request” may technically have been a merchant collect, push payment, mandate or another UPI flow. PIN authentication should not automatically be equated either with absence of fraud or with an “unauthorised transaction” for every RBI customer-liability purpose. The exact bank-dispute classification depends upon the technical transaction record and applicable RBI/NPCI framework. Criminal provisions are fact-dependent. Immediate reporting improves the possibility of tracing and restraining funds but no recovery, refund, freezing or prosecution outcome is guaranteed.