If you searched online for a company's helpline number, called it, and were then asked to scan a QR code or open a payment link to "receive" your refund — stop. A real refund never needs you to scan anything, enter your UPI PIN, or open a payment link. If you receive money, no PIN is ever required. Do not scan, do not enter your PIN, and hang up now. This fake customer care number scam is one of India's most common digital-payment frauds, and it works by planting fake helpline numbers where you're most likely to trust them: search results, Google Maps listings, and social media replies.
How the fake customer care number scam works
You have a genuine problem — a delayed delivery, a failed transaction, a wallet balance stuck somewhere, a wrong debit. You search "Paytm customer care number" or "Amazon refund helpline" or look up a bank's support number on Google or Maps. What you don't know is that scammers routinely list fake numbers as if they belong to the real company — on business listing pages, in comment sections under company posts, in fake Twitter/X or Facebook "support" handles, and even by paying for ads that outrank the genuine number.
You call the number. Someone answers promptly, sounding professional, sometimes with hold music and a scripted greeting. They ask for your order ID, registered mobile number, or the transaction details — information that sounds routine because a real support call would ask for it too.
Then comes the actual trap. The caller says something like: "Sir/Madam, your refund has been approved. To receive it instantly, please open Google Pay or PhonePe and scan this QR code I'm sending you," or "Just click this link and enter your UPI PIN to confirm the refund." Some variants ask you to install a screen-sharing app like AnyDesk or TeamViewer "so I can process this from my end," which hands the scammer live control of your phone.
Here is the part every reader must understand cold: scanning a QR code or entering your UPI PIN is how you SEND money, not how you receive it. A refund, a cashback, or money someone owes you lands in your account automatically once the sender initiates it from their side — you don't need to do anything except share your UPI ID, and even that isn't strictly needed for a refund to a card or original payment method. The moment someone asks you to scan, click, or enter a PIN "to receive" money, the amount that gets debited is usually the exact "refund" figure they promised, or higher — set as a request they've disguised as a receipt.
The red flags
- The number came from a Google search result, a Maps listing, or a social media comment/DM — not from the company's official app or the back of your card/bill.
- The "agent" asks you to scan a QR code, open a payment link, or enter your UPI PIN to receive money.
- They ask you to install a screen-sharing app (AnyDesk, TeamViewer, QuickSupport) to "fix the issue from their end."
- They create urgency: "This refund window closes in 10 minutes" or "Do it now or you'll lose the amount."
- They already know some of your details (order ID, partial card number) because they may run several of these fake listings and cross-reference public complaint threads — this makes them sound credible, not honest.
- The call is unusually calm and scripted for what should be a routine refund query.
If it is happening right now
- Stop. Do not scan any QR code and do not enter your UPI PIN. If you're mid-call and being asked to scan, hang up.
- Do not install any screen-sharing app if asked. If you already have, uninstall it immediately and turn on airplane mode briefly to cut the connection.
- Close the payment app if a QR scanner or payment screen is open. Do not proceed even "just to see the amount."
- Verify the number independently. Open the company's official app or website yourself (type the URL, don't click a link they sent) and find the support number listed there — never trust a number from a search ad, a Maps listing, or a social reply.
- If you already tapped "Pay" or shared your PIN, move straight to the recovery steps below — every minute matters.
Flags scam calls, texts and links on your phone — built for Indian scams, works offline
Free for personal use. Works offline, on your phone — nothing leaves your device.
Get Bachao Guardian — FreeChecking the QR before you pay — one extra layer
Because this scam ends with you being asked to scan a QR code or open a payment link, it's worth knowing what a QR actually contains before you act on it. A UPI QR code encodes a payee ID (VPA), sometimes a name, and sometimes a pre-filled amount — all of which can be faked or spoofed to look official.
The Bachao UPI Scanner is a free Android app that decodes a UPI QR before any payment happens. It shows you the payee's UPI ID, the payee name, and the amount on screen, and gives a plain-English risk score before you ever open your payment app. It checks the handle against known bank and PSP patterns and flags look-alike or typo-squatted IDs, and flags fraud-bait signals like a pre-filled unusually high amount. It never auto-pays — it decodes, shows you the verdict, and then hands off to your own UPI app so you make the final call.
It is one useful layer, not a guarantee: it does not verify the payee's real identity or bank records, so a scammer's QR can still show a plausible-looking name. The single fact that would have stopped this entire scam is simpler and free — a refund never needs a scan or a PIN. Use both: know the rule, and use a check as a second layer when something feels off.
If you have already paid or shared details
Speed decides whether you get your money back. Every hour reduces the chance of freezing the funds before the scammer moves them out.
| Step | Action | Why it matters |
|---|---|---|
| 1 | Call 1930 (National Cyber Crime Helpline) immediately | Fastest official route to request a freeze on the receiving account |
| 2 | File a complaint at cybercrime.gov.in | Creates a formal record and triggers bank-to-bank coordination |
| 3 | Call your bank's official number (from your card, passbook, or verified app) | Ask them to flag the transaction, dispute it, and watch your account |
| 4 | If you installed a screen-sharing app, uninstall it and change your UPI PIN and net-banking password from a different, trusted device | Removes any lingering remote access |
| 5 | Preserve evidence — screenshots of the call log, the fake number, the QR code, the chat, and your transaction ID / UTR | Needed for both the cybercrime complaint and the bank dispute |
Reporting quickly and reporting at all — even if you feel embarrassed — is what gives you a real chance of recovery. Banks and the National Cyber Crime Helpline exist specifically because this happens to careful, intelligent people every single day. There is no shame in being targeted by a script designed by people who do this full time.
How to protect family, especially elderly parents
Elderly parents are frequently targeted because they're more likely to search for a helpline number themselves when something goes wrong with a pension payment, an electricity bill, or an online order, and less likely to know that a refund never needs a QR scan.
- Save the real support numbers for their bank, electricity provider, and any apps they use, directly in their phone contacts.
- Tell them plainly, more than once: "If anyone asks you to scan a code or share your PIN to receive money, hang up — that is always a scam."
- Check in on any refund or complaint they mention before they act on instructions from a number they searched for.
- Consider setting a lower UPI transaction limit on their account if their bank allows it, as an extra safety margin.
or open a link} D -->|Scans and enters PIN| E[Money debited
not credited] D -->|Uses official app helpline instead| F[Verifies support number
independently] F --> G[No scan or PIN needed
to receive money] E --> H[Call 1930 and file at
cybercrime.gov.in fast] style A fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0 style B fill:#5f1e1e,stroke:#EF4444,color:#e2e8f0 style C fill:#5f1e1e,stroke:#EF4444,color:#e2e8f0 style D fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0 style E fill:#5f1e1e,stroke:#EF4444,color:#e2e8f0 style F fill:#1e3d2f,stroke:#10B981,color:#e2e8f0 style G fill:#1e3d2f,stroke:#10B981,color:#e2e8f0 style H fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0
The exact share of fake numbers on each channel isn't published by any named source, so the split below is illustrative only — it shows the range of places to be equally suspicious of, not a measured breakdown.
Bachao.AI, built by Dhisattva AI Pvt Ltd, publishes guides like this one to help ordinary people recognise scams before they cost real money. File complaints directly at cybercrime.gov.in. For general guidance on safe digital payments, refer to the Reserve Bank of India and NPCI, which governs UPI.