LPG QR Code and Cashback Scam — How to Identify & Stay Safe

INDIA — By BharatSecure Threat Intelligence Team · Updated May 28, 2026

Severity: HIGH | View Full Scam Details

Beware in 2026: LPG QR Code and Cashback Scam Targeting Indian Consumers

Consumers in India who buy LPG cylinders and love cashback offers are increasingly at risk of a new, high-severity scam involving fake QR codes and fraudulent UPI payments.

What Is the LPG QR Code and Cashback Scam?

The LPG QR Code and Cashback Scam is a phishing and payment fraud scheme that targets everyday Indian consumers buying Liquefied Petroleum Gas (LPG) cylinders. These consumers are often enticed by messages promising attractive cashback offers on their LPG purchases or payments made through popular digital platforms like UPI-enabled apps. The scam exploits the familiarity many Indian users have with scanning QR codes for payments or rewards.

Scammers distribute fake LPG-related QR codes through WhatsApp forwards, SMS, social media posts, or messaging groups. They falsely claim that scanning these QR codes will grant users cashback from reputed LPG distributors or payment platforms. This deceptive lure preys on people’s trust in digital payments and their desire to save money, especially given the regular expense LPG cylinder refills represent for many households.

According to complaints reported to cybercrime authorities like India’s Integrated Citizens Cyber Crime Prevention Portal (I4C) and advisories from CERT-In, this scam has spread widely across urban and semi-urban areas since late 2025. Given the high volume of LPG consumers in India, the potential victim pool is substantial, and the risk level is high with a reported severity score of 8/10.

How This Scam Works — Step by Step

1. Initial Contact via WhatsApp or SMS: The victim receives a message forwarding a QR code labeled as a “special LPG Cashback Offer” or “Limited-time Cashback on LPG Payment.” The message may claim it is from an official-looking source, like an LPG distributor or a known payment aggregator.

2. Curiosity and Trust: The message promises a significant cashback amount—sometimes a fixed ₹100-₹500 or a percentage of the payment—if the user scans the QR code and completes the process.

3. Scanning the Fake QR Code: When the victim scans the QR code with their UPI app or smartphone camera, it either directs them to a malicious payment page designed to look legitimate or triggers an unauthorized UPI payment prompt.

4. Unauthorized Payment Request: If it’s a fake payment page, it asks the user to enter UPI PIN or other sensitive payment information. In cases where the QR code initiates a payment, the user might unknowingly approve a UPI fund transfer from their account to the fraudster’s account.

5. No Cashback Given: Instead of receiving any cashback, the victim finds that either money has been debited from their bank account without authorization or their UPI credentials have been compromised.

6. Potential Follow-up Scams: Some fraudsters may also ask victims to “verify their identity” by requesting Aadhaar details or One-Time Passwords (OTPs), further risking identity theft or SIM swap attacks.

Real Warning Signs to Watch For

• The QR code is received unsolicited, through WhatsApp forwards or SMS from unknown numbers.

• The cashback offer seems overly generous or too good to be true.

• The message urges immediate action or creates artificial scarcity (“Only available for next 10 users”).

• Scanning the code redirects to a webpage that looks unofficial or mimics an LPG distributor’s branding poorly.

• Requests for sensitive data such as UPI PIN, Aadhaar details, or OTP during or immediately after scanning.

• No official verification or confirmation from LPG distributors or banks before the cashback is credited.

• Messages or links containing spelling errors, unusual URLs, or suspicious domain names.

What Happens to Victims

Victims can suffer immediate financial loss when unauthorized payments are initiated from their UPI-linked bank accounts. Recovery of these funds through UPI reversal requests can be difficult and slow, especially if OTPs or UPI PINs were compromised. In some cases, fraudsters misuse stolen Aadhaar or payment data to commit further identity theft or social engineering attacks.

The emotional distress of falling for such schemes often leads to loss of trust in digital payments and LPG providers, and victims may hesitate to use UPI or QR code payments again. Given that LPG supply is a monthly household necessity, this scam also adds stress by disrupting routine expenses and budgeting.

Moreover, the scam may make victims vulnerable to SIM swap frauds—where fraudsters gain control of a victim’s mobile number to intercept OTPs and conduct further fraudulent transactions.

What RBI and CERT-In Say

The Reserve Bank of India (RBI) regularly updates its guidelines on UPI transactions and cautions users to avoid sharing UPI PIN or OTP with anyone. RBI’s emphasis on “never sharing OTP or PIN” aligns directly with preventing scams like this LPG QR cashback fraud.

CERT-In, India’s national computer emergency response team, issues advisories urging users not to trust unsolicited QR codes or links, especially those offering cashback or prizes. CERT-In recommends verifying official channels before scanning and reporting suspicious digital payments.

The Indian government’s Integrated Financial Crime and Cyber Crime Coordination Centre (I4C) encourages affected users to report such incidents promptly to cybercrime.gov.in and utilize the national cybercrime helpline 1930 for immediate assistance.

How to Protect Yourself

1. Do not scan QR codes received via WhatsApp or SMS from unknown or unverified sources.

2. Only scan QR codes from official LPG distributors, authenticated payment apps, or verified digital wallets.

3. Never share your UPI PIN, OTP, or Aadhaar details with anyone, even if they claim to be from a trusted authority.

4. Verify cashback offers by contacting your LPG distributor directly or through their official app or website.

5. Use your bank’s UPI app features like transaction alerts and blocking to monitor unauthorized payments.

6. Report suspicious QR codes or messages to CERT-In or the 1930 cybercrime helpline immediately.

7. Keep your mobile device and banking apps updated to benefit from the latest security patches.

What to Do If You've Been Targeted

• Immediately block or freeze your UPI payment app or linked bank account by contacting your bank’s customer service.

• Report the unauthorized transaction to your bank, making a formal complaint for UPI payment reversal.

• File a complaint with the cybercrime portal at cybercrime.gov.in detailing the incident.

• Call the national cybercrime helpline at 1930 for guidance and support.

• Keep records (screenshots, message texts, payment receipts) for evidence during investigation.

• Change all related passwords and enable two-factor authentication on your accounts.

• Inform your mobile service provider if SIM swap fraud is suspected and request an immediate lock on your number.

Frequently Asked Questions

Q1: Can scanning any LPG-related QR code give me cashback?
No. Official cashback offers from LPG distributors or payment apps are only available through verified channels. Scanning random or unsolicited QR codes can expose you to fraud.

Q2: What should I do if I accidentally shared my UPI PIN after scanning a QR code?
Immediately contact your bank to block transactions, change your UPI PIN, and report the incident to cybercrime authorities via the 1930 helpline or cybercrime.gov.in.

Q3: How can I verify if a cashback offer on LPG payments is genuine?
Contact your LPG distributor directly via their official site or customer service, or check your trusted payment app for official announcements regarding cashback promotions.

Verify suspicious cashback messages and QR codes before acting — visit BharatSecure.app for trusted alerts and safety tips. If you encounter fraud, report it quickly to the cybercrime helpline 1930.

Disclaimer: This article describes a pattern of fraud reported in public sources for public-safety awareness. It is not legal, financial, or medical advice. To request correction or removal of any content, write to hello@bharatsecure.app.