Payment QR Sticker Swapping Scam — How to Identify & Stay Safe

INDIA — By BharatSecure Threat Intelligence Team · Updated May 30, 2026

Severity: CRITICAL | View Full Scam Details

Payment QR Sticker Swapping Scam in India 2026: How Fraudsters Exploit UPI and WhatsApp

A dangerous new scam is putting millions of Indian shoppers and small merchants at risk by swapping genuine payment QR stickers with fake ones linked to fraudsters’ UPI accounts.

What Is the Payment QR Sticker Swapping Scam?

The Payment QR Sticker Swapping Scam is a type of digital fraud where scammers replace official UPI QR code stickers—commonly used by merchants and public facilities—with counterfeit versions. These fake QR codes redirect payments to the fraudsters’ accounts instead of the intended recipients. This scam mainly targets small business owners, vendors in crowded marketplaces, service providers in temples or parking lots, and people paying for everyday services through UPI.

This scam thrives in India because of the widespread adoption of UPI-based digital payments through apps like Google Pay, PhonePe, and Paytm. Many merchants use printed QR stickers, affixed to shop counters or donation boxes, which customers scan to pay. This system’s convenience becomes a vulnerability when criminals sneak in counterfeit QR codes at times when merchants are less vigilant.

According to public complaints and warnings from CERT-In (India’s Computer Emergency Response Team), this fraud is becoming increasingly common in crowded urban and semi-urban areas. Agencies like RBI and the Ministry of Home Affairs’ I4C (Indian Cyber Crime Coordination Centre) have alerted the public to be cautious about any sudden introduction of new or unfamiliar QR stickers, especially in busy market spots.

How This Scam Works — Step by Step

1. Scouting the Location: Fraudsters quietly observe shops and public service points in busy areas like local markets, temple donation counters, or parking lots. They wait for moments when vendors are distracted or shops are closed briefly.

2. Swapping QR Stickers: In a short window of opportunity, the scammers remove the genuine QR code stickers displayed at payment counters or donation boxes and replace them with counterfeit QR codes. These fake codes are linked to the fraudster's UPI IDs.

3. Triggering Payments: When customers pay by scanning the swapped QR code, the money goes directly into the scammer’s UPI account, unbeknownst to the victim or the merchant.

4. Using WhatsApp for Lures: Scammers sometimes spread fake promotional messages or WhatsApp forwards advertising discounts or special offers at targeted shops. They may send images of fake marketing brochures with links leading customers to scan a particular QR code — which again diverts payments.

5. Victims Realize Too Late: Typically, the merchant notices a deficiency in their payments only after several transactions, or customers report payment failures. By the time the victim tries to trace the lost funds, the scammer has moved on, often using fake or temporary UPI accounts.

Real Warning Signs to Watch For

• QR codes that look new or different from usual, especially if they are not laminated or appear poorly printed.
• Sudden offers or promotions shared via WhatsApp or leaflets urging quick payment through a specific QR code.
• Merchants or vendors discovering a mismatch between recorded sales and money deposited in their bank accounts.
• Customers unable to get payment confirmation or receiving error messages immediately after scanning a QR code.
• Shopkeepers or donation collectors discouraged from handling digital payments themselves or telling you to rely solely on QR code scans.
• Suspicious-looking stickers placed over old QR codes without proper vendor consent.
• Urgency to pay immediately through digital modes without alternative cash payment options.

What Happens to Victims

For merchants, unexpected losses directly affect their daily earnings, especially micro and small businesses that rely completely on digital transactions. Once payment is sent through the fake QR code, reversing the transaction is difficult under UPI rules, unless the payee cooperates. Not all victims can prove the fraud quickly, leading to prolonged financial strain.

For customers, this scam can lead to unauthorized transfers from their linked bank accounts. In some reported cases, scammers use common social engineering tactics after payment to trick customers into revealing OTPs or Aadhaar-linked banking details, causing further breaches like SIM swap fraud. The emotional impact includes stress, loss of trust in digital payments, and hesitation to use UPI or mobile wallets again.

What RBI and CERT-In Say

The Reserve Bank of India (RBI) has consistently urged vigilance in digital payments and issued guidelines to merchants on securing QR codes. While RBI does not endorse any particular payment method, it encourages verification of payment confirmations and immediate reporting of suspicious transactions.

CERT-In provides cybersecurity advisories addressing digital payment fraud and recommends users and merchants regularly check the authenticity of QR codes. The Indian Cyber Crime Coordination Centre (I4C) highlights scams involving payment frauds and urges prompt reporting via the national helpline.

If you suspect digital fraud, you can contact the 1930 cybercrime helpline available 24x7 for guidance and reporting. Additionally, RBI helpline numbers can be used for banking-related queries and complaints.

How to Protect Yourself

1. Always Check QR Stickers Carefully: Inspect the QR codes for visible tampering, poor printing, or stickers placed on top of existing codes.
2. Verify Payment Confirmation: After scanning a QR code and entering the amount, wait for official confirmation on your UPI app before leaving.
3. Avoid Scanning QR Codes Shared Over WhatsApp: Do not scan QR codes received unsolicited via messages or social media offers.
4. Ask Merchants About Payment Modes: Pay only through payment methods that the merchant confirms as official.
5. Keep Your Phone and Apps Updated: Security updates help protect against malware that can facilitate fraud.
6. Do Not Share OTPs or PINs: Never disclose your UPI PIN, OTP, or Aadhaar details to anyone—even if they claim to be officials.
7. Report Suspicious Activity Promptly: Inform your bank and file a complaint with cybercrime.gov.in or call 1930 if you suspect fraud.

What to Do If You've Been Targeted

• Immediately contact your bank to freeze your UPI account or linked bank account to prevent further unauthorized transactions.
• File a complaint with the local police cybercrime cell or through the national portal at cybercrime.gov.in.
• Use the 1930 cybercrime helpline to report the fraudulent transaction and seek assistance.
• Keep all evidence ready: transaction screenshots, WhatsApp messages, photos of QR codes, and complaint acknowledgments.
• Inform the merchant or facility whose QR code was tampered with to prevent more victims.
• Monitor your bank statements and mobile carrier account for signs of SIM swap or Aadhaar misuse.
• Consult your bank or legal advisor for recovery options.

Frequently Asked Questions

Q: How can I know if a QR sticker is fake before scanning it?
A: Look for signs of tampering such as stickers placed over others, poor print quality, or QR codes not matching the style usually used by the merchant. When in doubt, ask the vendor directly or pay by another method.

Q: Can UPI transactions linked to fake QR codes be reversed?
A: UPI transactions are usually instant and final. Reversal depends on the cooperation of the recipient account holder. In fraud cases, filing a police complaint and bank grievance immediately is critical to improve the chances of recovery.

Q: What should I do if I receive a WhatsApp message offering discounts linked to QR code payments?
A: Be wary of any unsolicited offers asking you to pay via QR codes sent through WhatsApp. Verify such offers with the official merchant or avoid scanning the code altogether to prevent being scammed.

Stay vigilant and double-check every digital payment you make. If you receive suspicious messages or face a possible scam, verify it at BharatSecure.app and report fraud immediately by calling 1930.

Disclaimer: This article describes a pattern of fraud reported in public sources for public-safety awareness. It is not legal, financial, or medical advice. To request correction or removal of any content, write to hello@bharatsecure.app.