A QR Code That Took Money Instead of Giving It
A customer walks into the branch in a state of panic. On WhatsApp he received a message from a man claiming to be a buyer for his handicraft items, who said ₹5,000 would be sent to him and shared a QR code. The customer scanned it, entered his UPI PIN when prompted, and ₹5,000 was debited from his account instead of being credited. Within minutes he received a call from a person who offered to 'reverse the transaction' and asked him to install a screen-sharing app and read out an OTP. He has not installed the app, but he has read nothing and done nothing since the debit, which happened about 20 minutes ago. He wants to know how the money left his account, whether the bank will refund it, and what to do about the caller. Meanwhile a colleague advises him to wait a day in case the transaction 'auto-reverses'.
1. Explain technically what the QR code did, and why entering the PIN sent money out rather than bringing it in.
Read the worked answer
A UPI QR code carries only a payee address. Scanning it does not pull money in; it builds a payment request. The code he scanned was a collect/direct debit request - effectively 'pay this VPA ₹5,000' - and once he entered his UPI PIN he authenticated that debit himself. His PIN is the authorisation; there is no separate 'receive' PIN in UPI, and no genuine sender ever needs the recipient's PIN.
The refund myth matters too: UPI payments do not auto-reverse because the receiver is fraudulent. A failed transaction may reverse, but a completed payment to a fraudster's VPA stays completed until the bank or the beneficiary bank acts.
So the technical picture is a classic 'request money disguised as send money' scam: the fraudster used the customer's own authentication to move his money, which is why early reporting is the decisive variable.
2. Set out the immediate actions, in priority order, and explain the liability position under the RBI customer-protection framework.
Read the worked answer
Priority order, all within the hour:
- Call the bank's hotline and block UPI/ mobile banking on the account, and request a transaction dispute with the UPI reference number - note the time of the call.
- Report on the national cybercrime helpline 1930 and file a complaint on cybercrime.gov.in, quoting the UTR, VPA and the caller's number. The 1930 route triggers the transaction-monitoring/reversal chain, which is why it comes before paperwork.
- Retain the WhatsApp chat, the QR image, the caller's number and the SMS alerts; do not delete anything.
On liability: where the loss arises from a third-party breach (fraud, not the customer's own failure) and the customer reports within three working days, RBI's framework gives zero liability. Reporting is well within that window here, and he did not share an OTP or install the remote app - both facts should go into the dispute record. A delay beyond three working days shifts him into limited liability as per the bank's board-approved policy, and if he had shared the OTP, the loss would have been his until he reported.
3. What should the branch tell him about the screen-sharing call and the 'wait a day' advice, and what should the staff do internally?
Read the worked answer
On the call: it is a second-stage attack, not a helpdesk. A screen-sharing or remote-access app gives the fraudster live sight of the phone, so he would see the OTP SMS as it arrives and could operate the banking app himself. The bank never asks for a PIN, OTP or password, and never asks a customer to install a remote-access app. The rule to give him in one line: no OTP, no screen share, no PIN over a call, whatever the caller claims to be. He should block the number and uninstall any app already installed.
On 'wait a day': it is wrong and dangerous. There is no auto-reversal for a completed, PIN-authenticated payment, and delay erodes the liability protection, because the three-working-day window runs from the transaction, not from when he makes up his mind.
Internally: log the dispute with timestamps, raise a chargeback/UPI dispute to the beneficiary bank, mark the VPA for fraud reporting, place a caution note on the account, and record that the customer was advised against the remote-access app.