QR Code Payment Trap on Resale Platforms — How to Identify & Stay Safe

INDIA — By BharatSecure Threat Intelligence Team · Updated May 30, 2026

Severity: CRITICAL | View Full Scam Details

Beware the QR Code Payment Trap on OLX and Resale Platforms in India — 2026 Alert

A new, critical scam is targeting sellers on popular Indian resale platforms by tricking them into scanning fake UPI QR codes, causing direct financial loss.

What Is the QR Code Payment Trap on Resale Platforms?

This scam is a growing threat on Indian online resale marketplaces like OLX, Quikr, and Facebook Marketplace, where people buy and sell secondhand goods. Fraudsters posing as genuine buyers contact sellers interested in making a purchase. The scam specifically targets sellers who prefer digital payments using UPI QR codes, a popular mode across India.

With millions of Indians relying on platforms like OLX to buy and sell items, this scam is increasingly widespread. According to complaints reported to cybercrime authorities like the Indian Cybercrime Coordination Centre (I4C) and advisories from CERT-In, fraudsters exploit the trust sellers have in QR code payments and WhatsApp chats. While RBI and CERT-In have issued alerts on UPI scams broadly, this particular method is gaining traction as it combines social engineering, phishing, and UPI fund manipulation in familiar resale settings.

Sellers may believe they are receiving legitimate payment requests, but fake QR codes redirect money to scammers. This results in immediate financial loss without an easy way to recover funds as UPI transactions are typically instant and irreversible.

How This Scam Works — Step by Step

1. Initial Contact: The scammer responds to a genuine listing on OLX or similar platforms, claiming interest in buying the listed item. They might claim to be from another city or say they’re busy, adding a layer of seeming legitimacy.

2. WhatsApp Conversation: To build trust, the fraudster moves the conversation to WhatsApp, often using a fake profile with a photo and plausible details. They answer queries patiently, encouraging the seller to feel safe.

3. Request for QR Code Scan: The scammer asks the seller to send a UPI QR code for payment. Instead of sending the genuine QR code linked to the seller’s UPI ID, the scammer sends a fake or tampered QR code or shares their own fake QR code link disguised as the seller’s.

4. Seller Scans the Fake Code: When the seller scans this code to verify payment or sends it to the scammer, the UPI transaction routes money not to the seller but to the scammer’s account.

5. Loss Realised Too Late: Since UPI payments are processed instantly, sellers lose money without any immediate way to revert the transaction. By the time sellers realise the scam, the fraudsters have often blocked them.

This method leverages the trust in QR payments and WhatsApp chats, exploiting the fact that many sellers may not carefully verify QR code authenticity or UPI IDs before scanning or sharing.

Real Warning Signs to Watch For

• The “buyer” insists on communicating only through WhatsApp rather than official platform chat or calls.
• The buyer requests a QR code scan or sends a QR code that differs from your verified UPI QR code.
• The buyer claims to be in a different city and asks for payment before delivery or inspection.
• Pressure to complete the payment quickly or refusal to share verifiable details.
• The QR code sent by the buyer looks different or does not match your official UPI ID (verify carefully on your UPI app).
• Fake profiles with limited social media presence and stock photos.
• Requests to scan QR codes sent via links rather than generated within your trusted app.

What Happens to Victims

Victims often experience immediate financial loss as UPI payments get transferred to scammers instantly and are difficult to reverse. Unlike bank NEFT or RTGS, UPI transactions cannot easily be recalled once completed. This can drain the seller’s bank account linked to their UPI ID or cause loss of funds via unauthorized transactions.

Emotionally, victims feel betrayed and stressed, especially because many transactions are for used personal items often meant to meet urgent financial needs. Some may also face potential SIM swap risks if fraudsters pursue additional attacks after initial success.

Filing complaints can be time-consuming, and recovery through banks or cybercrime cells often takes weeks or months, if it happens at all.

What RBI and CERT-In Say

The Reserve Bank of India regularly warns users about protecting UPI credentials and verifying payee details before initiating transactions. RBI advisories urge customers never to share UPI PINs or scan unknown QR codes. CERT-In advises vigilance against phishing and fraudulent payment requests and recommends verifying sender details.

The Indian Cyber Crime Coordination Centre (I4C) also encourages victims of online payment frauds to immediately report cases through the national cybercrime portal (cybercrime.gov.in) and seek help through the 1930 cybercrime helpline.

How to Protect Yourself

1. Always verify QR codes using your UPI app’s official scan feature before accepting payments.
2. Cross-check the UPI ID embedded in any QR code against your verified official UPI ID.
3. Avoid scanning QR codes sent via WhatsApp messages or suspicious links; generate payment requests within your app.
4. Communicate only through official resale platform channels as much as possible.
5. Do not share your UPI PIN or OTP with anyone, even if they claim to be buyers or customer support.
6. Use two-factor authentication (2FA) on WhatsApp and UPI apps to prevent unauthorized access.
7. Report any suspicious buyer behavior immediately to the resale platform and cybercrime authorities.

What to Do If You’ve Been Targeted

• Immediately block the scammer on WhatsApp and any other communication channel.
• Contact your bank without delay to report the unauthorized transaction and request a review or freezing of your account if possible.
• File an online complaint with the national cybercrime portal at cybercrime.gov.in, providing all chat screenshots, phone numbers, and transaction details.
• Call the 1930 national cybercrime helpline to report the scam and seek guidance.
• Change your UPI PIN instantly and monitor your account for further unexpected debits.
• Consider lodging a First Information Report (FIR) at your local police station for legal proceedings.
• Inform the resale platform (OLX/Quikr/Facebook Marketplace) about the incident to notify other users.

Frequently Asked Questions

Q: How can I tell if a UPI QR code is fake or tampered?
A: Always scan the QR code using your official UPI app and verify that the payee UPI ID exactly matches your known UPI ID. Check for any spelling or format differences and never rely solely on pictures sent over WhatsApp.

Q: Can I get my money back if I fall victim to this QR code scam?
A: UPI payments are generally instant and irreversible. While you should report to your bank and cybercrime authorities immediately, recovery is not guaranteed and depends on bank investigations and police action.

Q: What official resources exist to report such scams in India?
A: Victims can file complaints on the national cybercrime portal (cybercrime.gov.in) and call the 1930 helpline. Banks should also be informed quickly to try to block further fund transfers.

For any suspicious messages or payment requests, always verify at BharatSecure.app and report suspicious activities promptly at 1930 to help protect yourself and others.

Disclaimer: This article describes a pattern of fraud reported in public sources for public-safety awareness. It is not legal, financial, or medical advice. To request correction or removal of any content, write to hello@bharatsecure.app.