QR Code Scams at Shops and Counters: How Fraudsters Swap Your Payment QR

QR codes make payments easy for customers and businesses. They also create an easy fraud: replace or cover the QR so payments go to someone else. QR code scams affect shops, petrol pumps, taxis, restaurants and anyone with a printed payment code.

Common tricks

1. Sticker over your QR: a fraudster pastes their own QR on top of yours at the counter or on the vehicle
2. Swapped standees at busy counters
3. Fake QR on posters or flyers for "discount" or "registration"
4. "Scan to receive money": a buyer (often on marketplaces) sends a QR saying "scan to receive payment". Scanning a QR and entering a PIN always sends money
5. Fake parking, EV charging or menu QR codes leading to phishing pages that collect card details
6. QR in emails ("quishing") that bypass link filters and lead to fake login pages. See phishing signs

Protect your payment QR

• Use a soundbox so every real payment is announced. See UPI scams
• Check the name shown when you scan your own QR at the start of the day
• Keep the QR behind glass or laminated and fixed, not loose
• Train staff to confirm payments on the soundbox or merchant app, not on the customer's phone
• Display "Check payee name: [Your Business Name]" next to the QR
• Prefer a dynamic QR from your POS or payment app for larger amounts

For customers

Encourage customers to check the payee name before paying. A small line on the counter helps everyone.

QR codes in marketing

QR codes on visiting cards, vehicles and flyers are great for marketing. Use your own domain in the link, short and recognisable, and check the printed codes periodically. See QR codes in marketing.

If you're hit

1. Remove the fake QR and photograph it
2. Note the payee name/UPI ID shown on the fake QR
3. Report on cybercrime.gov.in or call 1930
4. Inform your bank/payment app

FAQs

Can a QR code hack my phone?

Scanning itself usually just opens a link. The risk is what you do next: entering PINs, passwords or installing apps.

Are static QR codes unsafe?

They're fine with the checks above. The main risk is physical swapping.