QR Code Fraud Alert: Spot the scam and protect your money

What is a QR Code Fraud?

QR code fraud is a type of cyber fraud where fraudsters use fake or tampered QR codes to trick people into transferring money from their bank accounts. With UPI becoming India’s most popular digital payment mode, QR codes are everywhere at shops, restaurants, petrol pumps, and parking lots. Scammers exploit this widespread trust to redirect payments into their own accounts.

Many assume QR code fraud only targets the careless but even cautious users fall victim because these scams manipulate everyday payment habits. The core deception: most people do not realise that scanning a QR code is used only to send money, never to receive it.

Scammers exploit the lack of awareness and the trust people place in digital payment systems. The Reserve Bank of India and NPCI regularly issue warnings about such frauds, highlighting the importance of vigilance.

Watch the video to see the scam in action.

How QR Code Scams Work

QR code fraud follows a step-by-step approach designed to exploit people’s trust and payment habits.

Step 1: Initial Contact – Scammers reach out in two ways. In physical scams, they visit shops, parking lots, or temple donation boxes and paste their own QR code sticker over the merchant’s genuine one. In online scams, the fraudster contacts you through platforms like OLX, Quikr, or WhatsApp, often posing as a buyer interested in a product you have listed for sale. They express urgency, agree to your asking price quickly, and offer to pay immediately via UPI.

Step 2: Creating Trust – In physical scams, the trust is built into the location itself. Customers naturally assume the QR code displayed at a familiar shop is genuine. In online scams, the fraudster builds credibility by acting like a serious buyer. They may confirm deal details, share fake identity proof, and then claim they are sending you money through a QR code. They share this QR code over WhatsApp or chat, telling you to scan it to “receive” the payment.

Step 3: Escalation – This is where the core deception happens. When you scan the QR code, whether at a tampered physical location or one sent to you online, your UPI app opens a payment request, not a collection. The scammer instructs you to enter your UPI PIN to “complete” or “confirm” the transaction. Since entering your UPI PIN always authorises an outgoing payment, the money transfers from your account to the scammer’s the moment you enter it.

Step 4: Final Objective – The scam ends in one of two outcomes: money is transferred directly to the scammer’s account, or the QR code redirects to a phishing website mimicking your bank app, where entering your credentials or OTP gives the scammer access for repeated unauthorised transactions. In both cases, the victim typically realises the fraud only after the money is gone.

Common Tactics and Warning Signs

Fraudsters use different approaches, but the patterns remain consistent. Recognising these warning signs can prevent losses:

• Being told to scan a QR code to receive money is the biggest red flag, as QR codes are only for sending payments.
• Pressure to act immediately, with claims like “the refund will expire” or “I’ll cancel the deal.”
• QR codes sent by strangers via WhatsApp or messaging platforms during online transactions.
• Tampered or overlaid stickers at shops or public payment points where the name does not match the merchant.
• Requests to enter your UPI PIN after scanning, with assurances that it is needed to “confirm receipt.”
• QR codes that redirect to unfamiliar websites instead of your UPI payment interface.
• RBI and NPCI regularly issue advisories about such tactics. Following official communications is crucial to verify any suspicious scenario.

Safety Tip for Senior Citizens

Fraudsters often target senior citizens by asking them to scan a QR code to “receive” money. Remember, QR codes are used only to send money. If in doubt, seek help from a trusted family member before scanning or entering your UPI PIN.

How to Protect Yourself

Prevention and awareness are key to avoiding QR code fraud:

• Remember the golden rule – You never need to scan a QR code or enter your UPI PIN to receive money. If someone asks you to, it is a scam.
• Verify before you pay – Check the name and UPI ID displayed after scanning. If it does not match the merchant, do not proceed.
• Do not share sensitive data – Never share your UPI PIN, OTP, or bank credentials with anyone.
• Be cautious with strangers – If a stranger sends you a QR code via SMS, WhatsApp, or another messaging platform, treat it with suspicion. Legitimate buyers do not need you to scan anything to send money.
• Inspect physical QR codes – Look for stickers pasted over original codes, torn edges, or mismatched names. If something seems off, confirm with the merchant.
• Report suspicious activity – Report QR code fraud via the Cyber Crime Portal (http://www.cybercrime.gov.in) or Helpline (1930). Suspicious communications can also be reported on sancharsaathi.gov.in.
• Stay informed – Follow RBI advisories, NPCI guidelines, and credible financial news to remain aware of common scams and new threats. 

By staying alert, verifying every QR code before entering your PIN, and reporting suspicious activity promptly, you can protect yourself and others from QR code fraud.

Disclaimer

This content is sponsored and does not reflect the views or opinions of IE Online Media Services Pvt Ltd. No journalist is involved in creating sponsored material and it does not imply any endorsement whatsoever by the editorial team. IE Online Media Services takes no responsibility for the content that appears in sponsored articles and the consequences thereof, directly, indirectly or in any manner. Viewer discretion is advised.