What are the red flags of this scam?

Received a WhatsApp or email with a 'corrected' or 'updated' version of your own QR code — verify any incoming QR by scanning it yourself to check where payment goes • Customers say their payment was successful but the amount never appears in your bank account • The displayed merchant name on a QR sticker matches your shop but the UPI ID in the payment confirmation is unfamiliar • Someone you do not recognise offered to 'help fix' or 'generate' your QR code and then sent you an image • For customers: the payment confirmation after scanning shows a different merchant name or unfamiliar UPI ID

What should I do if this happened to me?

Merchants: scan your own displayed QR code with a second phone and verify the UPI ID and merchant name in the payment confirmation screen match your bank account — do this weekly • Never accept a QR code image sent by anyone over WhatsApp, email, or SMS — always generate QR images yourself through your bank's official app or payment gateway • If customers report successful payments that never arrive, take down the QR immediately and report to your bank and cybercrime police • For customers who paid to the wrong merchant: raise a UPI dispute with your bank immediately; cross-account UPI redirects are recoverable if reported within 24 hours • Report at https://cybercrime.gov.in or call 1930 (national cyber helpline).

HIGH phishing Last reported: 14 Sept 2026 Share

Fraudster sends a merchant an AI-edited QR code — customer payments silently go to the scammer

Q: Is this a scam?

Yes. This is a documented scam pattern. A fraudster uses AI image-editing to replace the payment destination in a merchant's UPI QR code while keeping the displayed shop name. The doctored QR is returned to the shopkeeper — every customer who scans it pays the fraudster.

A fraudster uses AI image-editing to replace the payment destination in a merchant's UPI QR code while keeping the displayed shop name. The doctored QR is returned to the shopkeeper — every customer who scans it pays the fraudster.

Also known as: AI QR code tampering, fake merchant QR scam, UPI QR swap fraud, QR code image editing fraud India

Already happened to you? Do this in the next few minutes

Call 1930 now

1 Call 1930 — the national cyber-crime helpline — right now. The sooner you report, the better the chance of freezing the money before it moves.
2 Call your bank to freeze the account and block the card immediately. Use the number printed on your card, never a number from the message or caller.
3 File a report at cybercrime.gov.in and keep every message, screenshot, and transaction ID.

What to do right now

1 Merchants: scan your own displayed QR code with a second phone and verify the UPI ID and merchant name in the payment confirmation screen match your bank account — do this weekly
2 Never accept a QR code image sent by anyone over WhatsApp, email, or SMS — always generate QR images yourself through your bank's official app or payment gateway
3 If customers report successful payments that never arrive, take down the QR immediately and report to your bank and cybercrime police
4 For customers who paid to the wrong merchant: raise a UPI dispute with your bank immediately; cross-account UPI redirects are recoverable if reported within 24 hours
5 Report at https://cybercrime.gov.in or call 1930 (national cyber helpline).

Red flags

⚠ Received a WhatsApp or email with a 'corrected' or 'updated' version of your own QR code — verify any incoming QR by scanning it yourself to check where payment goes
⚠ Customers say their payment was successful but the amount never appears in your bank account
⚠ The displayed merchant name on a QR sticker matches your shop but the UPI ID in the payment confirmation is unfamiliar
⚠ Someone you do not recognise offered to 'help fix' or 'generate' your QR code and then sent you an image
⚠ For customers: the payment confirmation after scanning shows a different merchant name or unfamiliar UPI ID

Known variants

Physical QR sticker overlay at toll/parking/petrol (2026): scammer sticks a fake QR over the official payment QR at FASTag toll points, parking lots, and petrol pumps. Consumers pay the fraudster instead of the operator. NHAI warned about manipulated QR at toll plazas; a Delhi victim lost ₹5,000 on a fake toll QR in Jan 2026.

Last seen: 9/14/2026

Already happened to you? Do this in the next few minutes

What to do right now

Red flags

Known variants

Sources