Fake QR Stickers on UPI Payment Boards
INDIA — By BharatSecure Threat Intelligence Team ·
Verdict: Suspicious | Risk Score: 9/10 | Severity: critical
How Fake QR Stickers on UPI Payment Boards Works
Overview: Fraudsters are physically tampering with merchant payment points by placing their own QR code stickers over legitimate UPI QR codes at shops, fuel pumps, restaurants, and parking lots. Gullible customers think they’re paying the shopkeeper, but end up sending money directly to a scammer. This scam is quick, hard to notice, and is a growing threat to small businesses and their customers. How It Works: The scammer prints a well-designed fake QR sticker (often with UPI or banking logos), then sticks it over or next to the original payment QR at a physical location. Unsuspecting shoppers use their favourite Indian payment app (like Google Pay, PhonePe, or Paytm) to scan the QR and complete the payment, but the funds go to the fraudster’s UPI ID or wallet instead of the business owner. Some variants even direct users to malicious payment pages that attempt to harvest further banking details or card info. India Angle: This scam is rampant in metros like Mumbai, Bengaluru, Delhi, as well as smaller cities—basically anywhere UPI payments are common. It targets both business owners (loss of revenue, trust) and customers (loss of money), especially in areas with heavy footfall like train stations, petrol pumps, and food vendors. Both urban and rural populations are at risk, given UPI’s popularity. Real Examples: - A tea vendor in Lucknow had his QR code sticker replaced overnight, leading dozens of morning customers to unknowingly transfer money to a scammer’s account. - At a Mumbai parking lot, a fraudster placed a new QR code that redirected payees to a fake payment page that harvested their card details. Red Flags: 1. QR stickers that look freshly pasted or cover another sticker 2. Merchant name or payment holder name doesn’t match the shop/name 3. Damaged, worn, or misaligned stickers and unusual placement 4. Sudden request to scan a new QR for a 'discount' or 'offer' Protective Measures: - Always confirm the merchant's or shopkeeper’s name on your payment screen before approving the transaction - Tap the sticker gently to check if it is layered or mismatched - Prefer using QR codes printed behind the counter or attached securely - Shop owners should check their payment boards daily If Victimised: - Immediately call your bank/payment provider to attempt reversal - Report details and screenshots to 1930, cybercrime.gov.in, and alert the shopkeeper Related Scams: - UPI collect request fraud - Fake payment links over WhatsApp/SMS
How This Scam Works — Detailed Explanation
Fraudsters are increasingly relying on physical tactics to cheat unsuspecting individuals, particularly focusing on UPI payment boards. They target merchants across various establishments such as shops, fuel stations, restaurants, and parking lots. To execute the scam, these criminals locate vulnerable businesses and approach them with a façade of legitimacy. Utilizing platforms like WhatsApp and Facebook, they often research the business to ensure their QR codes appear tailored for the shop in question. Once they've identified a target, they strategically place fake QR code stickers over legitimate UPI payment codes. This act of tampering creates confusion for customers who mistakenly believe they are completing a legitimate transaction with the merchant, when in fact, they are transferring money directly to the fraudster’s account.
The scammers have perfected their approach by employing psychological tricks that exploit common customer behaviors. They design the fake QR stickers to look sophisticated and authentic, often incorporating recognizable UPI and banking logos. Customers are attracted by promotional language on the sticker or the promise of special offers, which cloud their judgment and compel them to scan the fake QR code. Additionally, these fraudsters sometimes claim that the genuine QR code is malfunctioning or not working, further promoting the urgency to use their alternative. This manipulation plays a significant role in making the scam effective as customers are pressed into completing what they believe is a regular transaction, often overlooking essential verification steps that could prevent them from falling victim.
Once a customer scans the QR sticker, the transaction process unfolds rapidly. The customer inputs the amount and authorizes payment, believing it is going to the rightful merchant. However, the transaction is processed to the scammer's UPI ID instead, immediately transferring their hard-earned money into the scammer's account. Real cases have shown amounts ranging from ₹500 to ₹10,000 lost per victim, leading to considerable financial strain on individuals who rely on these small expenses in their everyday lives. In India, reports suggest that the cumulative losses from such scams have reached tens of crores. As payment methods evolve and digital transactions become more prevalent, Public awareness campaigns and advisories from organizations such as CERT-In, the Ministry of Home Affairs, and the Reserve Bank of India (RBI) underline the importance of vigilance when making UPI transactions.
The impact of these scams on the Indian economy is concerning, particularly among small businesses that heavily rely on customer trust and rapid cash transactions. When small amounts are repeatedly scammed, it adds up to significant losses. The RBI has issued guidelines urging businesses to secure their payment interfaces while the Ministry of Home Affairs is actively working on measures to combat such fraudulent schemes. As small businesses struggle to foster a secure payment environment, victims are left feeling violated and financially insecure, struggling to recover lost funds and rebuild their trust in these digital payment systems. Currently, organizations are working collaboratively with banks and law enforcement to highlight these scams and offer clear directions for reporting incidents.
To distinguish between scams and legitimate transactions, customers must be educated about known red flags. For instance, customers should scrutinize QR code stickers for any signs of tampering, like new or misaligned stickers covering old ones, or check for any discrepancies in merchant names displayed in their payment app compared to the actual merchant shop name. If a sticker appears damaged or poorly adhered to the surface, or if customers are pressured into scanning a code for so-called limited-time offers, they should exercise caution and reconsider their actions. Staying informed and aware of these details can prevent customers from becoming unwitting victims of these increasingly sophisticated scams.
Visual Intelligence:
BharatSecure's AI has identified this as a used in scams targeting Indian users.
Who Does Fake QR Stickers on UPI Payment Boards Target?
General public across India
Red Flags — How to Identify Fake QR Stickers on UPI Payment Boards
- QR code stickers that look new, misaligned or cover old ones
- Payee name in app does not match merchant/shop name
- Request to scan a QR for a special offer or urgent reason
- Damaged, smudged, or peeling QR stickers
What To Do If You Encounter Fake QR Stickers on UPI Payment Boards
- Report the scam immediately to the cybercrime helpline by dialing 1930 or visiting cybercrime.gov.in.
- Contact your bank helpline (SBI 1800-11-1109, HDFC 1800-202-6161) to report unauthorized transactions.
- Freeze your UPI account temporarily to prevent further unauthorized access.
- Notify the merchant about the tampered QR code for their awareness and action.
- Advise friends and family about this scam to avoid them becoming victims.
- Keep track of transaction notifications and regularly review your bank statement for any suspicious activity.
How to Report Fake QR Stickers on UPI Payment Boards in India
- Call 1930 — National Cyber Crime Helpline (24x7)
- File a complaint at cybercrime.gov.in
- Contact your bank immediately if money was lost
- Call RBI helpline: 14440 for banking fraud
Frequently Asked Questions
- What to do if I shared my OTP in a UPI scam?
- Immediately change your UPI PIN and register a complaint with your bank's helpline. Report the incident at cybercrime.gov.in.
- How can I identify fake QR stickers?
- Look for stickers that seem new, don’t align properly, or obscure old QR codes. Always check payee names in the app.
- How to report this type of scam in India?
- You can report it by contacting the cybercrime helpline at 1930, filing a report at cybercrime.gov.in, or notifying your bank.
- What are the steps to recover money after being scammed?
- Contact your bank immediately, report the scam to cybercrime authorities, and keep a record of all transaction details for follow-ups.
Related Scams in India
Verify Any Suspicious Message
Check any suspicious message, link, or call for free at bharatsecure.app. BharatSecure uses AI to detect scams in real-time and protect Indian users.