Every shop counter in India now has a QR code taped to it.
We scan them without a second thought.
That is exactly why people worry about them.
The worry deserves a proper answer.
The truth is reassuring, and the real risk sits somewhere else.
What does a QR code actually contain?
Text, and nothing more.
A payment QR holds a UPI ID, a name, and sometimes an amount.
Your camera reads that text.
Your phone then opens a payment screen already filled in.
That is the whole trick.
A QR code is a fast way of typing, not a way of doing something to your phone.
It cannot pull money, install an app, or reach into your account.
Scan one and close it, and you have lost nothing.
Then why do so many scams start with one?
Because a QR code hides what it says.
You cannot read it, so you cannot tell whose UPI ID is inside.
Two tricks follow from that.
The first is the swapped sticker.
Someone pastes their own QR over the shop's, and the day's payments quietly go elsewhere.
The second is the QR sent to you with a story.
Scan this to collect your refund, your cashback, your prize.
There is no such thing as a QR that gives you money.
A payment QR opens a payment screen.
You still have to type your PIN.
So no QR code can take a rupee from you on its own.
How do I check before I pay at a shop?
Two checks, and both take a second.
Read the name on the confirmation screen.
It should match the shop you are standing in.
That name comes from the bank, not from the sticker.
A swapped QR usually shows a person's name where a shop's name belongs.
Then wait for the shopkeeper's confirmation.
That means the speaker announcing the amount, or their own phone buzzing.
If they did not hear it, the money did not reach them.
What about QR codes sent to me on WhatsApp?
Treat them like a stranger's bank form.
Nobody needs a QR code to send you money.
They only need your number or your UPI ID.
So a QR arriving in a chat is a request to pay, whatever it claims.
Do not scan one to verify, activate or receive anything.
If a friend sends one out of the blue, call them.
That account may not be theirs any more.
Things to Remember
- A QR code is only text, and scanning one cannot debit you.
- No QR code exists that pays money into your account.
- Check that the name on screen matches the shop before you pay.
- Wait for the shop's own confirmation sound or notification.
- Never scan a QR sent to you to receive a refund or prize.