Tampered Physical QR Sticker Fraud

INDIA — By BharatSecure Threat Intelligence Team ·

Verdict: Suspicious | Risk Score: 9/10 | Severity: critical

Category: UPI, OTP

How Tampered Physical QR Sticker Fraud Works

Overview: Tampered QR sticker scams are on the rise across Indian cities, particularly in public places such as restaurants, parking lots, utility bill counters, and transit stations. Fraudsters discreetly paste their own QR stickers over legitimate ones, tricking unsuspecting people into scanning them. This typically leads to either direct financial theft (by diverting payments) or data capture via fake payment portals. All age groups are vulnerable, from college students to families dining out. Such scams are especially dangerous, as the printed surroundings appear fully authentic, making it hard to identify the fraud in real time. How It Works: 1. Scammers print out fake QR codes styled to match Paytm, Google Pay, or PhonePe stickers. 2. They paste these over existing, genuine QR codes at payment counters, canteens, bill kiosks, or even on roadside utility bills. 3. You scan the visible QR code thinking it is for a legitimate merchant. 4. The fake code might directly redirect your payment to the scammer OR open a webpage impersonating a payment portal for further data entry. 5. In some cases, after entering payment details, the portal asks for sensitive info like OTPs or PINs—stealing your credentials. India Angle: This scam is most rampant in metros like Delhi, Mumbai, and Bengaluru, but recent cases have been reported in tourist hotspots (Goa, Jaipur) and tier-2 cities as well. UPI-based QR code payments (Paytm, PhonePe, Google Pay, BHIM) and utility bill counters are common targets. Real Examples: - A café in Pune had several customers unknowingly transfer money to a fraudulent account using a pasted QR sticker on the bill folder. - In Bengaluru, commuters found tampered QR codes on BMTC bus payment boards, losing money immediately after scanning. Red Flags: - QR sticker looks tampered, wrinkled, or sits unevenly over an old sticker. - Colour or branding slightly misaligned, blurry logo, or spelling errors. - Page asks for PIN, full card number, or OTP—instead of processing just a payment. - Merchant claims they didn’t receive your payment. Protective Measures: - Always inspect QR stickers for signs of tampering before scanning. - Double-check with the shopkeeper or staff for the correct payment method. - Pay by card or cash if QR code looks suspicious. - Verify payment success on your UPI app and ensure the merchant’s name matches. If Victimised: - Halt any further transactions immediately. - Call your bank and raise a complaint if financial loss occurred. - Inform shop management and urge them to check all QR stickers. - Report the fraud through 1930 helpline or cybercrime.gov.in . Related Scams: - Fake QR codes placed on petrol pump machines - Tampered Fastag payment stickers near toll plazas - Similar frauds during festival pop-up stalls

How This Scam Works — Detailed Explanation

Tampered Physical QR Sticker Fraud has become a popular mode of operation for scammers across various urban landscapes in India. Scammers often target busy public locations such as restaurants, parking lots, utility counters, and transit stations, where payment transactions are frequent. They find legitimate QR stickers, an essential part of the UPI payment system in India, and stealthily overlay their own stickers that lead to fraudulent accounts. This is especially concerning in busy areas where consumers are in a rush, causing them to scan the QR codes without scrutinizing them. The ease and speed of UPI transactions make it a lucrative opportunity for these fraudsters, as they can exploit people's trust in digital payment systems.

The tactics employed by scammers are both cunning and psychological. They realize that most people have become accustomed to scanning QR codes for various payments, and they leverage this trend. For example, a customer at a popular café may see a QR sticker on the table that looks almost legitimate. These fraudsters often use visually appealing designs that mimic the original stickers but may have slight variations in colors or logos that could go unnoticed by an unsuspecting eye. Psychological tricks include creating a sense of urgency or commonality—scammers may disguise themselves as staff or even install tampered stickers after seeing real personnel handle payments. When consumers feel they are making a legitimate transaction, they are more likely to ignore warning signs or take extra precautionary steps.

Victims of Tampered Physical QR Sticker Fraud face a series of unfortunate events. Imagine a popular location, such as a mall, where a group of friends or families decide to order food through UPI. They scan a QR sticker that appears to be from the restaurant, enter their payment details, and, as per routine safety protocols, provide their PIN or OTP. Shortly after, the merchant denies having received the payment, and the victims realize they have been duped. This can escalate further, especially if the victims have used Aadhaar-linked bank accounts or linked UPI apps like PhonePe or Paytm, as scammers may have also captured their personal information for additional fraudulent activities. Local bank helplines often report an uptick in complaints related to this specific form of fraud, with individuals losing anywhere from ₹1,000 to ₹10,000 each, sometimes aggregating into crores lost across the city.

The reach of this scam isn't just limited to monetary loss but encompasses a broader societal issue, with Cybercrime reports revealing that in 2022 alone, ₹300 crore was lost to UPI-related frauds in India. According to advisories from CERT-In, an increase in digital payment frauds correlates with the increase in QR code usage following innovations by NPCI and RBI guidelines to promote cashless transactions. The Ministry of Home Affairs and various regulatory bodies have been alerted to the increasing incidence of such scams, prompting them to issue alerts. These messages often recommend that citizens rely on verified sources and platforms, advocating for awareness in order to avoid being easy targets for fraudsters.

Identifying Tampered Physical QR Sticker Fraud comes down to careful scrutiny of QR stickers before scanning. Some red flags include stickers that appear pasted over genuine ones, are wrinkled or misaligned, or that feature blurry logos. If you notice that a QR code looks different from those found on neighboring counters or it prompts you for sensitive information (like your PIN or OTP), you should steer clear. It’s also advisable to have conversations with local businesses to confirm payment processes and showcase any illicit activities, thereby increasing awareness and promoting community vigilance. Ultimately, educating oneself and staying alert can act as a significant deterrent against such scams.

Visual Intelligence:

BharatSecure's AI has identified this as a used in scams targeting Indian users.

Who Does Tampered Physical QR Sticker Fraud Target?

General public across India

Red Flags — How to Identify Tampered Physical QR Sticker Fraud

  • QR sticker appears pasted, wrinkled, or poorly aligned
  • Brand logos/colors are off or blurry
  • Page asks for PIN, OTP, or extra sensitive details
  • Local merchant denies receiving your payment
  • QR code sticker is different from nearby counters

What To Do If You Encounter Tampered Physical QR Sticker Fraud

  1. Report the incident immediately by calling the cybercrime helpline at 1930 or visiting cybercrime.gov.in for guidance.
  2. Notify your bank as soon as possible using helplines like SBI 1800-11-1109 or HDFC 1800-202-6161, and block your UPI-linked account if suspected fraudulent activity occurs.
  3. Check your bank statements for unauthorized transactions and maintain a record of all relevant details for future reference.
  4. Educate peers and family about these scams to ensure they are aware and vigilant when making payments via QR codes.
  5. Check with the merchant directly if a payment transaction seems unclear; don’t hesitate to get clarification on payment methods.
  6. Consider using a trusted mobile payment method for transactions; many wallets offer insurance against fraud.

How to Report Tampered Physical QR Sticker Fraud in India

  • Call 1930 — National Cyber Crime Helpline (24x7)
  • File a complaint at cybercrime.gov.in
  • Contact your bank immediately if money was lost
  • Call RBI helpline: 14440 for banking fraud

Frequently Asked Questions

What to do if I shared my OTP in a UPI scam?
Immediately contact your bank at their helpline (SBI 1800-11-1109 or HDFC 1800-202-6161) to block your account and prevent further transactions. Report the incident to cybercrime helpline 1930.
How to identify if a QR sticker is tampered?
Check for obvious indicators like a pasted appearance, misalignment, and unclear logos. If it asks for your PIN or OTP, it is likely a scam.
How to report this type of scam in India?
You can report the scam to 1930 for immediate assistance, along with filing a complaint at cybercrime.gov.in and notifying your bank about the fraudulent activity.
What are the steps for recovering money or protecting accounts after this scam?
Begin by reporting the fraud to your bank and asking them to reverse unauthorized transactions. Regularly check your accounts for suspicious activity and change your passwords immediately.

Related Scams in India

Verify Any Suspicious Message

Check any suspicious message, link, or call for free at bharatsecure.app. BharatSecure uses AI to detect scams in real-time and protect Indian users.