Quishing: How a Fake QR Code Empties Your Bank Account

Scanning a QR code can only ever PAY money, never receive it — anyone telling you to scan to 'get' a refund is lying.

Quishing hides a malicious link inside a QR so your eyes and email filters can't vet it before you tap.

Fake QR stickers pasted over real ones at parking, petrol pumps and shop counters are a fast-growing attack.

Never enter your UPI PIN to receive money — a PIN is only ever needed to send.

Pause before scanning any QR from an SMS, email, poster or 'refund' agent; verify the merchant name on the next screen.