How fraudsters clone QR codes at shops and restaurants — How to Identify & Stay Safe

INDIA — By BharatSecure Threat Intelligence Team · Updated May 26, 2026

Severity: MEDIUM | View Full Scam Details

Beware in 2026: How Fraudsters Clone QR Codes at Shops and Restaurants in India

As UPI payments dominate India’s digital economy, a sneaky scam is putting shoppers and diners at risk—fraudsters are cloning QR codes at popular stores to steal your money without you realizing.

What Is the How Fraudsters Clone QR Codes at Shops and Restaurants Scam?

With over 8 billion UPI transactions recorded monthly by 2025, India is moving rapidly toward a cashless society. QR codes displayed at shops, street vendors, and restaurants have become the easiest way to pay instantly. However, criminals have caught onto this trend and started exploiting it by cloning QR codes.

In this scam, fraudsters create fake QR codes that look almost identical to a legitimate merchant’s digital payment code but actually divert payments to the scammer’s bank account. The scam mainly targets busy marketplaces and restaurants in metro cities like Mumbai, Delhi, Bengaluru, and Hyderabad, especially during crowded peak hours when shopkeepers are busy.

According to alerts from the Indian Computer Emergency Response Team (CERT-In) and reporting from the Indian Cyber Crime Coordination Centre (I4C), such QR code cloning frauds are on the rise in India’s urban and semi-urban areas. The Reserve Bank of India (RBI) has also repeatedly advised consumers to cross-verify QR codes before making digital payments.

How This Scam Works — Step by Step

Here’s how fraudsters trick customers and merchants with cloned QR codes:

1. Scouting the Location: Scammers first identify shops or restaurants with heavy footfall, especially those that openly display UPI QR codes at counters.

2. Creating the Fake QR: Using widely available QR code generator apps, they produce a duplicate QR code that looks identical but links to their own bank account through UPI.

3. Replacing the Original: The scammer either swaps the original QR code with their fake one when the merchant is distracted or poses as a “helpful tech assistant” who offers to “upgrade” or “fix” the payment method.

4. Customer Makes Payment: An unsuspecting customer scans the fake QR code and enters the amount to pay for goods or food.

5. Money Goes to the Scammer: The payment completes instantly, but the money is credited to the scammer’s account, not the merchant’s.

6. Merchant and Customer Realize Too Late: Only after making the payment does the customer realize the merchant never received money, and the scammer is long gone.

This scam exploits the trust many users place in UPI’s instant payment system without verifying the QR code’s authenticity.

Real Warning Signs to Watch For

• QR code sticker is peeling off or looks tampered with
• Merchant looks unusually nervous or hesitant about digital payments
• Someone insisting on replacing or “helping” with the QR code suddenly
• QR code printed on plain paper instead of a branded or official placard
• Amount on your UPI app does not match the price or bill
• Merchant cannot show their registered UPI ID or payment confirmation
• You receive no SMS or notification of payment credit to the merchant

What Happens to Victims

Victims of QR code cloning often suffer financial loss that is hard to recover. Unlike bank transfers or credit card fraud, UPI payments are nearly instantaneous and irreversible once completed. The RBI’s UPI system does not support automatic reversals for fraud—customers must raise complaints with their bank and file cybercrime reports.

Financially, this could mean losing hundreds or thousands of rupees for everyday purchases. Emotionally, victims feel betrayed and anxious about using digital payments again.

Besides monetary loss, if the fraudster has access to Aadhaar-linked details or uses a SIM swap to intercept OTPs, the impact could be worse, including identity theft or unauthorized transactions.

What RBI and CERT-In Say

The Reserve Bank of India has issued multiple advisories urging both merchants and customers to verify the authenticity of QR codes before processing any payment. RBI highlights that customers should confirm the UPI ID or merchant name on their app before final approval.

CERT-In recommends vigilance and immediate reporting of digital payment scams. For any cyber fraud, the national helpline 1930 and RBI helpline 1800-22-1155 are available 24x7 to assist victims. The Indian Cyber Crime Coordination Centre (I4C) actively tracks such scams and collaborates with banks to raise awareness.

How to Protect Yourself

1. Always ask the merchant to display an official, branded QR code.
2. Verify the UPI ID and merchant name on your payment app before confirming the transaction.
3. Avoid scanning QR codes presented on plain paper or stickers without merchant branding.
4. Never allow anyone other than the merchant to handle their QR code or payment setup.
5. Check for immediate payment confirmation messages/notifications from your bank.
6. Be skeptical if a “helper” offers to assist with your payment or QR code unexpectedly.
7. Prefer using trusted digital wallets or apps with built-in merchant verification features.

What to Do If You've Been Targeted

1. Immediately contact your bank’s customer care and inform them about the fraudulent transaction.
2. Call the RBI Customer Helpline at 1800-22-1155 and report the incident.
3. File an online complaint with the cybercrime portal at cybercrime.gov.in.
4. Dial the national cybercrime helpline 1930 for guidance and support.
5. Keep all transaction records, screenshots, and any SMS alerts handy for investigation.
6. If you suspect your Aadhaar or SIM details have been compromised, notify UIDAI and your telecom operator immediately.

Frequently Asked Questions

Q: Can I get my money back if I pay a fake QR code?
A: Unfortunately, UPI payments are mostly irreversible. You need to file a complaint with your bank, report to cybercrime authorities, and hope the scammer is traced. The RBI does not guarantee refunds for such fraud.

Q: How can I verify if the QR code is legitimate before paying?
A: When you scan the QR code, your UPI app should display the merchant’s name or registered UPI ID. Always double-check this information before completing payment.

Q: Are there any apps that help detect fake QR codes?
A: Currently, no consumer app officially detects cloned QR codes. Your best protection is vigilance, verifying merchant details manually, and reporting suspicious codes to authorities.

If you receive suspicious QR codes or digital payment messages, always pause and verify before paying. To stay updated on digital scams and learn how to protect yourself from the latest frauds, visit BharatSecure.app — India’s trusted platform for digital fraud awareness. Stay safe and pay smart!