If you've paid at a petrol pump or neighbourhood kirana store with UPI in the last few months, you need to read this. Fake UPI QR code scams are spreading across India, and they're nastier than most UPI fraud because they happen in person, at places you trust, and the whole thing is over in about three seconds. India Today reported in 2026 that two people were arrested after a fake QR code operation was exposed at petrol pumps across five states. Five states. That's not a local problem anymore.
UPI crossed 14 billion transactions in a single month in 2025. That kind of volume is what makes the system a target. Scammers have figured out that physical QR codes are a weak point in an otherwise fairly secure setup. If you're new to how UPI works, the short version is: you scan a merchant's QR code and your UPI app routes the payment to whatever ID is embedded in it. The problem is there's nothing stopping someone from printing a different QR code that points to their own account instead.
How the fake QR code scam works
The setup is almost embarrassingly simple. Honestly, the first time I read about it I expected something more technical. A scammer walks into a petrol pump forecourt, a kirana store, a tea stall, or even a chemist shop. They peel off the real QR code sticker, or just cover it with their own, and replace it with a fake one that looks identical but routes payments to their UPI ID.
You walk in, scan what looks like the shop's QR code, type in the amount, and confirm with your PIN. The money leaves your account instantly. The shopkeeper never receives it. And because UPI transactions are instant and irreversible, by the time anyone figures out what happened, the money is gone.
The scammer doesn't even need to be there when you pay. They've already done their work. Some operations have placed fake QR codes at dozens of locations across a single city before anyone noticed.
Here's how it typically plays out:
- Scammer prints a QR code linked to a fraudulent UPI ID or a mule bank account.
- They visit high-traffic spots early morning before the shop opens, or during busy periods when staff aren't watching closely.
- They stick the fake QR over the original, sometimes matching shop branding, sometimes just a plain white sticker with no name or logo.
- Customers scan and pay. The UPI app shows a name, but it's the scammer's account, not the shopkeeper's.
- The shopkeeper only discovers the fraud when a customer complains, or when they check their account at end of day.
- By then, the fraudulent account has been emptied and abandoned.
Why petrol pumps and kirana stores are favourite targets
Think about how you actually pay at a petrol pump. You're standing in the sun, there's a queue behind you, the attendant is busy. You just want to finish and leave. If you ask me, it's that rushed, distracted moment that makes this scam work, not any technical cleverness on the scammer's part.
Kirana stores are similar. You're juggling groceries and a bag while the shopkeeper tallies up your items. Nobody is carefully inspecting the QR code sticker. Business Standard reported in 2026 that merchant fraud in India increasingly targets high-volume, low-attention payment environments. It doesn't get more high-volume than a petrol pump handling 200 to 300 UPI transactions in a day.
These locations also tend to have a single prominently placed QR code, sometimes laminated and stuck to the counter or a sign outside. Easy to swap out unnoticed. And many smaller shops don't keep any record of what their original QR code looks like (annoying, I know), so they might not notice the tampering for days. You can read more about how scammers exploit offline payment setups in our broader scam alerts section.
Warning signs the QR code in front of you might be fake
None of these require technical knowledge. I think most people skip this check entirely. Thing is, just a few seconds of attention before you hit confirm is all it takes.
- The name on your UPI confirmation screen doesn't match the shop. This is the biggest one. Before you tap Pay, read the name. If you're at Sharma General Store and the screen shows Ramesh K or something like QR Pay User, stop right there.
- The QR sticker looks slightly different from others in the shop, different size, slightly peeling at an edge, or clearly placed over something else.
- It's a plain sticker with no shop branding, just a bare black-and-white QR code and nothing else.
- The UPI app shows a personal name rather than a business or merchant name.
- The shopkeeper can't tell you their own UPI ID or seems uncertain about what the QR code is actually linked to.
That first point deserves extra weight. Legitimate businesses registered on UPI typically show a merchant name, not just a personal name with no context. A first-name-only entry that doesn't match the shop is your signal to stop and ask before paying.
How to protect yourself from UPI QR fraud
Always read the recipient name before you confirm payment. Every major UPI app shows you this before you confirm. One second. That genuinely is the single most effective habit you can build, and most people just don't bother.
If you're a regular at a shop, save their UPI ID in your phone contacts. Then if the scanned ID is ever different, you'll know immediately without even having to think about it.
Ask the shopkeeper to confirm their UPI ID if something seems off. A genuine shopkeeper will have no problem with that. They'd want to know if someone tampered with their code.
- Never scan a QR code printed on plain paper or one that looks handwritten or improvised.
- Consider paying via the shopkeeper's registered mobile number instead of scanning, especially at unfamiliar places. Enter their number, verify the name that comes up, and pay. One extra step but much harder to fake.
- Keep UPI transaction alerts turned on in your banking app so you spot anything unusual straight away.
- Set a daily UPI transaction limit in your bank app. Most banks let you cap this at Rs. 5,000 to Rs. 10,000, which limits your exposure even if something does go wrong.
- If you spot a suspicious-looking QR code, tell the shopkeeper. They may genuinely have no idea it's been replaced.
There are also broader steps to lock down your UPI account, particularly if you use multiple UPI apps across different banks.
What to do immediately if you've been scammed
Call 1930 right away. This is the National Cyber Crime Helpline, set up specifically for financial fraud. If you call within a few hours of the transaction, there's a real chance the funds can be flagged before they move further. Not guaranteed, but it has worked.
File a formal complaint at cybercrime.gov.in. Before you do, screenshot your UPI transaction details. You'll need the transaction ID and the fraudulent UPI ID shown on your confirmation screen. The exact time of the payment matters too. The complaint form asks for all of this.
Also call your bank directly on their 24-hour fraud helpline. They can flag your account and raise a dispute through the NPCI system (the process is slow, but it exists). Recovering money from UPI fraud is harder than reversing a credit card charge, so speed genuinely matters here. I'm not sure exactly how often recovery fully works out, but reporting quickly does improve your odds.
And if the fraud happened at a specific location, file a police complaint too. The India Today report on the five-state fake QR operation that led to two arrests shows that physical-location fraud does get investigated when people report it. Police can check CCTV footage and track down who placed the stickers. But only if you report it. Check our latest cybercrime news for updates on ongoing fraud operations across India.
CERT-In, India's official cyber emergency response body, has flagged QR code-based UPI fraud as an active threat. For business owners, CERT-In recommends periodically verifying your own QR codes and switching to dynamic QR systems that generate a new code per transaction, making sticker-swap attacks ineffective.
A note for shop owners and petrol pump staff
If you run a shop or manage payments at a fuel station, you're a victim here too, and your customers might not even tell you. In my experience, most shop owners have no idea this has happened to them until a customer comes back to complain. Someone could have paid at your counter today while the money went straight to a scammer, and they've already driven off thinking everything was fine.
Scan your own QR code today. Run a small test payment and confirm the name and amount arrive in your registered account. If your payment provider has a Soundbox or smart terminal with dynamic QR, switch to it. PhonePe for Business and Google Pay for Business both support dynamic QR now. So does Paytm's merchant setup. These codes change with every transaction, so even if someone copies your static sticker, it won't work a second time.
Brief your counter staff too. They should verify the amount shown in the payment notification matches what was charged, not just that a beep happened. A Soundbox beep means nothing if the wrong account is getting the money.
UPI works because hundreds of millions of people trust it every day. India's digital payments system handles over 14 billion transactions monthly, from roadside chai stalls to petrol pumps serving hundreds of customers before noon. That trust is worth protecting. And for most people, protecting it comes down to one habit: read the name on your payment screen before you tap confirm. For more on staying safe with digital payments, see our UPI safety tools and resources.
