Malicious QR Code UPI Scam
दुर्भावनापूर्ण क्यूआर कोड यूपीआई घोटाला
INDIA — By BharatSecure Threat Intelligence Team ·
Category: UPI
Evidence & AI transparency
Not yet assessed. This older record has not completed the new evidence-governance review.
This page includes AI-assisted analysis. AI assistance does not mean a person reviewed or approved this page.
Sources: 0 · Last automated validation: Not recorded
Evidence-backed facts: statements mapped to cited evidence by the automated validator. BharatSecure analysis: interpretation and safety guidance; it is not an official finding.
Automated analysis can contain errors. Confirm important information and decisions with official authorities.
Verdict Summary
Malicious QR Code UPI Scam is a confirmed scam. Do not engage — block the sender and report to 1930 (National Cyber Crime Helpline) immediately.
Risk score: 8/10 · Severity: High · Verdict: Dangerous
Scam Intelligence: Malicious QR Code UPI Scam
Proprietary signals from BharatSecure's scam-tracking database.
| Scans & lookups | 11 |
| Last reported | Apr 05, 2026 |
| First documented | Apr 05, 2026 |
How Malicious QR Code UPI Scam Works
- Scammers present malicious QR codes to victims.
- Scanning these codes can lead to unauthorized large payments, even if a small amount is displayed.
- Or, the QR code might initiate a 'request money' transaction, tricking the user into authorizing a transfer to the scammer.
How This Scam Works — Detailed Explanation
In India, Unified Payments Interface (UPI) has revolutionized digital payments by making instant money transfers extremely easy through mobile apps like Google Pay, PhonePe, and BHIM. However, cybercriminals have found new ways to exploit this convenience using malicious QR code UPI scams. Scammers create or tamper with QR codes in public places such as local shops, street vendors, or even inside WhatsApp messages, pretending they belong to trusted vendors or individuals. When victims scan these malicious QR codes, they inadvertently send money to the fraudsters rather than receiving payment.
Typically, a scammer will paste fake QR code stickers over genuine ones on walls or shop counters, or share such codes via chats claiming it’s for receiving money. Many people in India rely on quick scans without verifying the code origin, especially when asked to scan a QR code to receive payments, which should not happen since UPI QR codes are only for sending money. Additionally, the displayed amount during payment confirmation might differ from what the victim intends to pay, leading them to unknowingly transfer larger sums. The scammers exploit the habit of rushing transactions without carefully checking the payment details, a common scenario in busy market areas.
The fraudsters often approach victims through WhatsApp messages, pretending to be customers or sellers, urging them to scan a QR code for refunds or payments. Sometimes, they impersonate banks or government schemes to gain trust. Once the victim scans the malicious QR code, the payment goes directly to the scammer’s account. Since UPI transactions are instant and irreversible, victims lose their money immediately and struggle to recover it. Often, victims don’t realize the scam until they check their bank statement or get suspicious messages from their bank.
Victims can suffer significant financial losses this way, especially if they are elderly or less tech-savvy and unaware of these tactics. The scamming technique also exploits India’s vast network of mobile banking and the popularity of Aadhaar-linked UPI transactions. This scam highlights the urgent need to verify QR code sources, check transaction amounts carefully, and be vigilant about unusual payment requests on chat platforms or public places.
Visual Intelligence: Visual Pattern Recognition
BharatSecure's AI has identified this as a visual pattern recognition used in scams targeting Indian users.
Who Does Malicious QR Code UPI Scam Target?
UPI users, especially those using QR code payments in India.
Red Flags — How to Identify Malicious QR Code UPI Scam
- QR codes from untrusted or unofficial sources.
- Being asked to scan a QR code to *receive* money (it's for sending).
- The amount displayed on the payment confirmation screen not matching the intended transaction amount.
- QR codes that appear altered or pasted over legitimate ones in public places.
What To Do If You Encounter Malicious QR Code UPI Scam
- Verify the source of QR codes before scanning, especially in public places or unfamiliar messages.
- Always check that the amount displayed on the payment confirmation screen matches the intended payment.
- Avoid scanning QR codes sent via WhatsApp or other messages requesting you to send or receive money unexpectedly.
- Report suspicious QR codes or transactions immediately to your bank and BharatSecure’s scam alert platform.
- Block and report any contacts that pressure you into scanning QR codes or making payments via instant messaging apps.
How to Report Malicious QR Code UPI Scam in India
- Call 1930 — National Cyber Crime Helpline (24x7)
- File a complaint at cybercrime.gov.in
- Contact your bank immediately if money was lost
- Call RBI helpline: 14440 for banking fraud
Frequently Asked Questions
- What is Malicious QR Code UPI Scam?
- Malicious QR Code UPI Scam is a reported upi scam that BharatSecure has documented as affecting Indian users. Fraudsters use it to trick victims into sharing money, OTPs, or personal and banking details. It currently carries a risk rating of 8/10 (High).
- Is Malicious QR Code UPI Scam dangerous, and how common is it in India?
- Yes. This scam is rated High severity (8/10) because it can lead to direct financial loss or identity theft. It spreads through SMS, WhatsApp, phone calls, and fake websites, and variants are reported across India throughout the year. Treat any unexpected message or call matching this pattern as suspicious until verified.
- How can I protect myself from Malicious QR Code UPI Scam?
- Verify the source of QR codes before scanning, especially in public places or unfamiliar messages. Always check that the amount displayed on the payment confirmation screen matches the intended payment. Avoid scanning QR codes sent via WhatsApp or other messages requesting you to send or receive money unexpectedly. Report suspicious QR codes or transactions immediately to your bank and BharatSecure’s scam alert platform. Never share OTPs, UPI PINs, card numbers, or passwords; verify any request independently using official numbers from the company's real website; and avoid clicking links in unsolicited messages.
- How do I report Malicious QR Code UPI Scam in India?
- Call 1930 (the National Cyber Crime Helpline) within 24 hours for the best chance of recovering funds, and file a complaint at cybercrime.gov.in with screenshots and transaction details. Notify your bank's fraud team to freeze transactions, and report the suspect UPI ID or phone number to BharatSecure so other users can be warned.
How This Scam Works — BharatSecure AI
Spreading fastA plain-language breakdown based on 109 real reported scams of this type.
| How they reach you | Fraudsters primarily reach victims through unsolicited phone calls, WhatsApp/SMS messages, and fake payment links or QR codes, frequently impersonating bank officials, customer support, government sch |
| How they gain your trust | Trust is established by impersonating authority figures (banks, RBI, government departments, army officers) or exploiting existing relationships, often reinforced with logos, AI-generated/deepfake voi |
| How they take your money | UPI transfers via apps like Google Pay, PhonePe, and Paytm dominate, often authorized through disguised collect requests, OTPs, UPI PIN entry, malicio |
| Who they target | Broad targeting across the digitally-active Indian population, with repeated emphasis on the elderly, homemakers, students, small business owners/online sellers, rural users (PM-Kisan/scheme beneficia |
- authority bias (impersonation of banks/officials)
- urgency and scarcity (account frozen, benefit expiring)
- trust and familiarity (known contacts, familiar voices, reciprocity from small wins)
- Unsolicited calls/messages claiming urgent account, KYC, or transaction issues requiring immediate action
- Requests to share OTP, UPI PIN, or to approve a 'collect'/money request to receive funds or refunds
- Pressure to install remote-access or screen-sharing apps (AnyDesk, TeamViewer) for 'support'
- Payment or QR-code scans framed as needed to receive money, claim prizes, grants, or process loans/jobs
- Emotional manipulation via familiar contacts, love-bombing, or authoritative/deepfake voices combined with time pressure
Related Scams in India
Verify Any Suspicious Message
Check any suspicious message, link, or call for free at bharatsecure.app. BharatSecure uses AI to detect scams in real-time and protect Indian users.