QR Code Swap Merchant Terminal Scam

INDIA — By BharatSecure Threat Intelligence Team ·

Verdict: Suspicious | Risk Score: 8/10 | Severity: high

Category: UPI, Government Impersonation

How QR Code Swap Merchant Terminal Scam Works

Overview: This scam targets shoppers and store owners using QR code-based UPI payments. Fraudsters secretly swap the legitimate merchant’s QR code for one linked to their own bank account. When the customer pays, the money is diverted to the fraudster, leaving the merchant unpaid and the customer unwittingly contributing to financial crime. This scam is particularly damaging for small retailers in cities and bazaars. How It Works: 1. Fraudster visits a shop on a pretext—posing as a customer or vendor. 2. They discreetly cover the real UPI QR code with a counterfeit that points to their own account. 3. Customers make purchases, scan the QR, and pay as usual. 4. Merchant receives no payment; customer believes transaction is complete. 5. The fraud continues until the merchant or a vigilant customer notices. India Angle: Metropolitan markets in Delhi, Mumbai, and Hyderabad are being targeted. Small shop owners, fruit vendors, and independent retailers are most vulnerable due to lack of QR code supervision. UPI adoption across India, especially among MSMEs, makes this crime easy to scale in crowded markets. Real Examples: - Customers reporting, "Paid via GPay, but the shopkeeper says no money received." - Shop owners find extra QR sheets stuck over their stand after reviewing CCTV. Red Flags: - QR code looks tampered, has layers, or is on loose paper. - No payment notification received on merchant’s app after scans. - Mismatched merchant name on payment confirmation screen. - Shopkeeper unable to verify payment received in their records. Protective Measures: - Merchants should regularly inspect QR codes for tampering or replacements. - Customers must verify recipient name before completing payment. - Only scan QR codes that appear permanent and clear, not loose slips. - Immediately raise disputes with the payment app if transaction is unpaid. If Victimised: - Merchants should collect CCTV or eyewitness evidence and inform the police. - Report scam to UPI app’s grievance cell and file at cybercrime.gov.in. - Call 1930 and notify bank immediately. Related Scams: - Fake UPI collect requests - Counterfeit product payment scams

How This Scam Works — Detailed Explanation

The QR Code Swap Merchant Terminal Scam primarily targets small shopkeepers and consumers engaged in digital payments via UPI (Unified Payments Interface). Scammers typically operate in densely populated areas like bazaars and local markets, where they can easily come into contact with their victims. The scam starts when a fraudster poses as a potential customer, visiting a shop and engaging in casual conversation. They observe the merchant’s QR code setup and later return under the pretext of purchasing something. Once they identify a suitable opportunity, the fraudster discreetly swaps the legitimate merchant’s QR code with one they have created, tied to their own bank account, often passing it off as an upgrade or a temporary change.

To manipulate their victims psychologically, con artists employ various tactics. They may feign interest in the merchant's products or create a sense of urgency, leading the shopkeeper to feel pressured to comply with the scammer's requests, such as making small talk while they adeptly swap the QR codes. Scammers also frequently take advantage of the confusion around UPI transactions, since they can sometimes appear instantaneous and seamless. The fraudsters often assure shopkeepers that the new QR code is reliable and even offer to help them set it up, using their perceived goodwill to gain trust. Such manipulations can make it difficult for merchants to immediately recognize the scam, especially as they focus on serving their customers.

Once the QR code is swapped, the impact on victims is particularly severe. For the shopper, they may complete a payment to what they believe is the merchant’s legitimate account. However, unbeknownst to them, they are actually transmitting funds directly to the fraudster. The shopkeeper, later noticing that the payment wasn't received, may contact the customer, who is confused given that their transaction showed as complete. In numerous instances reported across India, small vendors in cities like Mumbai and Delhi have suffered substantial financial losses, often ranging from ₹10,000 to ₹1 crore, which is significant for local businesses. The situation escalates when the merchant seeks to verify the transaction, only to learn through their bank that the funds were never received, thus unraveling their financial credibility and putting them in a difficult position against their own customers.

The financial impact of scams like the QR Code Swap Merchant Terminal Scam is alarming, with an estimated ₹400 crore lost to various UPI scams in just the first half of 2023. The Ministry of Home Affairs (MHA) has been continually notifying citizens about such scams, emphasizing the importance of vigilance while making UPI transactions. Additionally, authorities like the Reserve Bank of India (RBI) and CERT-In regularly issue guidelines to raise awareness about emerging fraud methods. The rapid rise in these scams has forced institutions to ramp up educational efforts, but too many consumers and small businesses continue to fall prey to these fraudulent activities, demonstrating an urgent need for increased awareness and preventive measures.

To effectively spot this scam, customers and merchants alike should stay alert for key indicators. If a QR code looks layered, recently replaced, or stuck, it could be a red flag. Furthermore, when making payments, be sure that the name displayed on the payment app aligns with the name of the merchant. If a payment appears successful but isn’t reflected instantly to the merchant, this may raise suspicion of a scam. Merchants must also be vigilant if they report non-receipt of payments, as this directly correlates with the chances of being duped. Ensuring that transaction notifications are promptly received on both ends is essential in maintaining financial security during UPI operations. Understanding these nuances can empower business owners and consumers alike to act responsibly and protect themselves from potential fraud in the marketplace.

Visual Intelligence:

BharatSecure's AI has identified this as a used in scams targeting Indian users.

Who Does QR Code Swap Merchant Terminal Scam Target?

General public across India

Red Flags — How to Identify QR Code Swap Merchant Terminal Scam

  • QR code appears layered, stuck, or recently replaced
  • Payee name on app doesn’t match merchant
  • Shopkeeper claims non-receipt of funds after payment
  • Payment not reflected instantly for merchant

What To Do If You Encounter QR Code Swap Merchant Terminal Scam

  1. Report this scam immediately by calling the cybercrime helpline at 1930 or visiting cybercrime.gov.in.
  2. Notify your bank's hotline like SBI at 1800-11-1109 or HDFC at 1800-202-6161 to freeze your account if you suspect fraud.
  3. Verify the QR code’s authenticity before making any payments, especially if it appears tampered with or recently replaced.
  4. Immediately confront the shopkeeper if there’s a discrepancy about the payment received to clear up misunderstandings.
  5. Educate others in your community about this scam to create awareness and reduce further incidents.
  6. Document all transactions, including screenshots of payment confirmations, to support any claims of fraud.

How to Report QR Code Swap Merchant Terminal Scam in India

  • Call 1930 — National Cyber Crime Helpline (24x7)
  • File a complaint at cybercrime.gov.in
  • Contact your bank immediately if money was lost
  • Call RBI helpline: 14440 for banking fraud

Frequently Asked Questions

What to do if I shared my UPI details in a scam?
Immediately contact your bank's customer service and the cybercrime helpline at 1930 to report the incident. They can help secure your account and investigate the matter.
How can I identify the QR Code Swap Merchant Terminal Scam?
Look for signs like a mismatched payee name, signs of tampering on the QR code, and discrepancies between payments received and reported by the merchant.
How can I report a QR code scam in India?
You can report the scam at the cybercrime helpline 1930 or by visiting cybercrime.gov.in, where you can submit details of your incident.
What steps can I take to recover funds after being scammed?
Contact your bank immediately to restrict the misleading transactions. If you made the payment via UPI, provide them with transaction details for a potential reversal. Also, file a complaint with local authorities and relevant cybercrime departments.

Related Scams in India

Verify Any Suspicious Message

Check any suspicious message, link, or call for free at bharatsecure.app. BharatSecure uses AI to detect scams in real-time and protect Indian users.