Malicious QR Code UPI Scam
दुर्भावनापूर्ण क्यूआर कोड यूपीआई घोटाला
INDIA — By BharatSecure Threat Intelligence Team ·
Category: UPI
Verdict Summary
Malicious QR Code UPI Scam is a confirmed scam. Do not engage — block the sender and report to 1930 (National Cyber Crime Helpline) immediately.
Risk score: 8/10 · Severity: High · Verdict: Dangerous
Scam Intelligence: Malicious QR Code UPI Scam
Proprietary signals from BharatSecure's scam-tracking database.
| Scans & lookups | 11 |
| Last reported | Apr 05, 2026 |
| First documented | Apr 05, 2026 |
How Malicious QR Code UPI Scam Works
- Scammers present malicious QR codes to victims.
- Scanning these codes can lead to unauthorized large payments, even if a small amount is displayed.
- Or, the QR code might initiate a 'request money' transaction, tricking the user into authorizing a transfer to the scammer.
How This Scam Works — Detailed Explanation
In India, Unified Payments Interface (UPI) has revolutionized digital payments by making instant money transfers extremely easy through mobile apps like Google Pay, PhonePe, and BHIM. However, cybercriminals have found new ways to exploit this convenience using malicious QR code UPI scams. Scammers create or tamper with QR codes in public places such as local shops, street vendors, or even inside WhatsApp messages, pretending they belong to trusted vendors or individuals. When victims scan these malicious QR codes, they inadvertently send money to the fraudsters rather than receiving payment.
Typically, a scammer will paste fake QR code stickers over genuine ones on walls or shop counters, or share such codes via chats claiming it’s for receiving money. Many people in India rely on quick scans without verifying the code origin, especially when asked to scan a QR code to receive payments, which should not happen since UPI QR codes are only for sending money. Additionally, the displayed amount during payment confirmation might differ from what the victim intends to pay, leading them to unknowingly transfer larger sums. The scammers exploit the habit of rushing transactions without carefully checking the payment details, a common scenario in busy market areas.
The fraudsters often approach victims through WhatsApp messages, pretending to be customers or sellers, urging them to scan a QR code for refunds or payments. Sometimes, they impersonate banks or government schemes to gain trust. Once the victim scans the malicious QR code, the payment goes directly to the scammer’s account. Since UPI transactions are instant and irreversible, victims lose their money immediately and struggle to recover it. Often, victims don’t realize the scam until they check their bank statement or get suspicious messages from their bank.
Victims can suffer significant financial losses this way, especially if they are elderly or less tech-savvy and unaware of these tactics. The scamming technique also exploits India’s vast network of mobile banking and the popularity of Aadhaar-linked UPI transactions. This scam highlights the urgent need to verify QR code sources, check transaction amounts carefully, and be vigilant about unusual payment requests on chat platforms or public places.
Visual Intelligence: Visual Pattern Recognition
BharatSecure's AI has identified this as a visual pattern recognition used in scams targeting Indian users.
Who Does Malicious QR Code UPI Scam Target?
UPI users, especially those using QR code payments in India.
Red Flags — How to Identify Malicious QR Code UPI Scam
- QR codes from untrusted or unofficial sources.
- Being asked to scan a QR code to *receive* money (it's for sending).
- The amount displayed on the payment confirmation screen not matching the intended transaction amount.
- QR codes that appear altered or pasted over legitimate ones in public places.
What To Do If You Encounter Malicious QR Code UPI Scam
- Verify the source of QR codes before scanning, especially in public places or unfamiliar messages.
- Always check that the amount displayed on the payment confirmation screen matches the intended payment.
- Avoid scanning QR codes sent via WhatsApp or other messages requesting you to send or receive money unexpectedly.
- Report suspicious QR codes or transactions immediately to your bank and BharatSecure’s scam alert platform.
- Block and report any contacts that pressure you into scanning QR codes or making payments via instant messaging apps.
How to Report Malicious QR Code UPI Scam in India
- Call 1930 — National Cyber Crime Helpline (24x7)
- File a complaint at cybercrime.gov.in
- Contact your bank immediately if money was lost
- Call RBI helpline: 14440 for banking fraud
Frequently Asked Questions
- What is Malicious QR Code UPI Scam?
- Malicious QR Code UPI Scam is a reported upi scam that BharatSecure has documented as affecting Indian users. Fraudsters use it to trick victims into sharing money, OTPs, or personal and banking details. It currently carries a risk rating of 8/10 (High).
- Is Malicious QR Code UPI Scam dangerous, and how common is it in India?
- Yes. This scam is rated High severity (8/10) because it can lead to direct financial loss or identity theft. It spreads through SMS, WhatsApp, phone calls, and fake websites, and variants are reported across India throughout the year. Treat any unexpected message or call matching this pattern as suspicious until verified.
- How can I protect myself from Malicious QR Code UPI Scam?
- Verify the source of QR codes before scanning, especially in public places or unfamiliar messages. Always check that the amount displayed on the payment confirmation screen matches the intended payment. Avoid scanning QR codes sent via WhatsApp or other messages requesting you to send or receive money unexpectedly. Report suspicious QR codes or transactions immediately to your bank and BharatSecure’s scam alert platform. Never share OTPs, UPI PINs, card numbers, or passwords; verify any request independently using official numbers from the company's real website; and avoid clicking links in unsolicited messages.
- How do I report Malicious QR Code UPI Scam in India?
- Call 1930 (the National Cyber Crime Helpline) within 24 hours for the best chance of recovering funds, and file a complaint at cybercrime.gov.in with screenshots and transaction details. Notify your bank's fraud team to freeze transactions, and report the suspect UPI ID or phone number to BharatSecure so other users can be warned.
How This Scam Works — BharatSecure AI
Spreading fastA plain-language breakdown based on 100 real reported scams of this type.
| How they reach you | Reported primary contact occurs through unsolicited phone calls, WhatsApp/SMS messages, and fake links or QR codes, with fraudsters impersonating bank officials, customer support, government agencies, |
| How they gain your trust | Observed trust is established via authority impersonation (bank, RBI, PM-Kisan, army officers), logo-laden profiles, AI-generated deepfake voices/videos, and small initial payouts to build credibility |
| How they take your money | UPI platforms (Google Pay, PhonePe, Paytm) dominate, primarily via disguised collect/'request money' notifications, QR code payments, malicious paymen |
| Who they target | Documented targets span the general population but concentrate on the elderly, homemakers, students, rural residents, small business owners, and urban professionals. Vulnerability is tied to digital-p |
- authority bias (impersonating banks/government/officials)
- urgency and scarcity (account frozen, limited-time grant/offer)
- trust/familiarity exploitation (deepfakes, known contacts, reciprocity via small payouts)
- Incoming 'collect request' or QR code that requires entering your UPI PIN to 'receive' money
- Unsolicited calls/messages claiming urgent KYC, account freeze, or suspicious transaction requiring immediate PIN/OTP sharing
- Requests to install remote-access or screen-sharing apps (AnyDesk, TeamViewer) for 'support' or 'refunds'
- Mismatched or misleading recipient display names (e.g., 'Verified Merchant', 'Bank Refund Dept') on UPI payments
- Small initial payouts followed by pressure to deposit large sums, or emotional/romantic urgency demanding fast transfers
Related Scams in India
Verify Any Suspicious Message
Check any suspicious message, link, or call for free at bharatsecure.app. BharatSecure uses AI to detect scams in real-time and protect Indian users.