A fake shopping website scam works like this: an ad on Instagram or Facebook shows branded shoes, electronics, or clothes at 70-90% off. You click through to a website or chat-based "store," add items to a cart, and instead of a normal payment gateway, you are asked to pay directly by scanning a UPI QR code or sending money to a personal UPI ID. You pay. Nothing ships. If you complain, a fake "refund process" appears that asks for a second payment to "release" your money. The single most important rule: **a real online store never asks you to pay a stranger's personal UPI ID or scan a random QR code instead of using a proper checkout.** If that is what is being asked right now, stop and do not pay.
If you already paid and nothing has arrived, or you are being asked to pay again to get a "refund," skip to the recovery section below and call 1930 immediately.
How the scam actually works
These storefronts are built to be disposable — cheap to set up, easy to abandon, and gone within days. The pattern repeats with remarkable consistency across products and seasons.
- You see an ad while scrolling Instagram, Facebook, or a WhatsApp-forwarded link — branded
- You click through to a website or an Instagram/WhatsApp "store." Many are not full websites
- You add items and go to pay. Instead of a standard checkout with card, net-banking, or a
- You scan the QR or pay the UPI ID, sometimes for the full order, sometimes for a small
- Nothing ships. Tracking numbers, if given at all, are fake or never update. Messages to the
- You ask for a refund. This is where a second scam often layers on top of the first: you're
- You pay that too, because it feels small next to what you already lost, and the seller sounds
A related version runs entirely inside WhatsApp or Instagram DMs — no website at all, just a "seller" sending product photos and a personal UPI QR code to scan. The mechanism is identical: payment happens outside any protected checkout, directly to an individual, before anything ships.
brand's catalogue. The giveaway is how you are asked to pay. A real checkout runs through a payment gateway that logs the transaction against the order. A UPI QR code or personal UPI ID collected outside that flow leaves no such link — once you pay, no order system holds either side accountable.
The red flags
| What you see | What it usually means |
|---|---|
| Discount of 70% or more on a branded, well-known product | Classic bait price — designed to override normal caution |
| Checkout asks you to scan a UPI QR or pay a UPI ID instead of a gateway (cards, net-banking, wallets) | No payment protection, no order record tied to the transaction |
| Store exists only as an Instagram page, a WhatsApp chat, or a very new website | No verifiable business behind it |
| "COD advance" demanded via UPI before shipping | Common tactic to get UPI money moving before any product exists |
| After you complain, you're asked to pay again to "release" your refund | Second stage of the same scam, not a real refund process |
| Seller pushes urgency — "sale ends in 1 hour," "only 2 left" | Designed to stop you checking the site or seller properly |
| Spelling errors, missing "About/Contact" page, or no return policy | Signs of a page built quickly and not meant to last |
If it is happening right now
- Do not scan the QR code or pay the UPI ID. If checkout asks for this instead of a normal
- Look for a real payment gateway. A legitimate checkout shows recognised payment options
- Check the site independently. Search the brand name plus "scam" or "reviews" before paying. An
- Never pay a second time to "unlock" a refund. No legitimate refund process requires the person
- Verify the seller separately from the ad. A phone number or "support" contact given only
- If you haven't paid yet, walk away. No discount is worth money handed to a storefront that
Flags scam calls, texts and links on your phone — built for Indian scams, works offline
Free for personal use. Works offline, on your phone — nothing leaves your device.
Get Bachao Guardian — FreeChecking a QR code before you pay
Because this scam so often ends with the victim scanning a UPI QR code or tapping a UPI payment link, checking that code before paying is a genuinely useful habit here. The free Bachao UPI Scanner app lets you scan a UPI QR first and see, before any money moves, the payee's UPI ID (VPA), their name, and the amount — along with a plain-English risk score. It flags look-alike or typo-squatted handles, fraud-bait keywords, and suspicious pre-filled amounts, and it never auto-pays: it hands the details to your own UPI app so you make the final decision. You can also report a UPI ID as a scam, feeding a shared warning signal for other users. Its honest limit matters too: it does not verify a seller's real identity or check their bank records — it only tells you what the QR code itself contains and whether that content looks risky. Use it as one extra layer of caution, not proof a seller is genuine. The bigger red flag stands on its own regardless of any tool: a real store simply does not need you to scan a personal QR code to check out at all.
systems never charge the person being refunded to receive their own money back.
If you have already paid or shared details
Speed decides whether this money can be recovered. Do these in order, right now.
- Call 1930 immediately — the National Cyber Crime Helpline, run under the Ministry of Home
- File a complaint at cybercrime.gov.in — the National Cyber Crime
- Call your bank's official fraud helpline (the number on your card or the bank's own website,
- Preserve every piece of evidence: screenshots of the ad, the website or chat, the payment
- Report the ad or page on Instagram or Facebook so it can be taken down and fewer people fall
- Do not pay again, no matter what "processing fee" you are asked for to get a refund — that
anyone. It is the single most useful reference for your bank and the cybercrime portal to trace where the money went.
How to protect family, especially elderly parents
Festive-season "flash sale" ads are heavily targeted at anyone likely to shop online for gifts, and elderly family members are often less familiar with how a real checkout is supposed to look.
- Show them, once, what a genuine checkout looks like on a site they already trust, so they can spot
- Tell them plainly: **"A real shop never asks you to scan a QR code or pay a person's UPI ID to
- Ask them to check with you before paying for anything bought through an Instagram or WhatsApp ad,
- Remind them that a real refund never requires paying a fee first.
- Encourage them to buy from well-known, established retailers for larger amounts, and be extra
Instagram or Facebook"] --> B["Lookalike
storefront"] B --> C["Checkout asks for
QR scan or direct UPI"] C --> D{"Real payment
gateway shown?"} D -->|"No gateway,
only QR or UPI ID"| E["Order paid,
never ships"] D -->|"Refuses to pay
a stranger's UPI"| F["Walks away,
money stays safe"] E --> G["Fake refund process
demands second payment"] G --> H["Second payment
also lost"] style A fill:#5f1e1e,stroke:#EF4444,color:#e2e8f0 style B fill:#5f1e1e,stroke:#EF4444,color:#e2e8f0 style C fill:#5f1e1e,stroke:#EF4444,color:#e2e8f0 style E fill:#5f1e1e,stroke:#EF4444,color:#e2e8f0 style G fill:#5f1e1e,stroke:#EF4444,color:#e2e8f0 style H fill:#5f1e1e,stroke:#EF4444,color:#e2e8f0 style D fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0 style F fill:#1e3d2f,stroke:#10B981,color:#e2e8f0
This research is published by Bachao.AI as part of an ongoing effort, from Dhisattva AI Pvt Ltd, to
explain common India-specific digital fraud patterns in plain language. For other UPI-related frauds
and more scam breakdowns, see the blog at /blog.
For official guidance, RBI's consumer awareness resources are at https://www.rbi.org.in, NPCI's own
UPI safety information is at https://www.npci.org.in, and CERT-In's advisories are at
https://www.cert-in.org.in.