Malicious QR Codes Stuck in Public Places
A QR sticker on a parking meter, restaurant table or poster leads to a fake payment page or an app download. Check where it goes before you pay.
A QR code on a parking board says 'scan to pay', or a sticker on a restaurant table says 'scan for menu'. Scammers print their own codes and stick them over real ones or in new spots. The code opens a payment page, a login form or a download. Because the code is a picture, you cannot read where it goes, and a trusted place makes people scan without thinking.
How the scam works
The set-up is a printed sticker that matches the look of a legitimate notice, placed on top of an authentic code or on a spot where payments are common: parking areas, charging stations, bus stops, ATM kiosks and event posters. The sticker may be slightly raised or have a different colour, but most people do not notice. The code leads to a web page that copies a payment gateway, an offer page or a login form.
The pressure is convenience. People are in a hurry to park, order or pay, and a QR code is a quick path. The page asks for a small fee, your phone number or a login to see the menu, and may then prompt for a card or UPI PIN. Some codes start a download of an app that claims to be a parking or event tool, but is really software requesting broad permissions on your phone.
The payoff is the payment sent to the scammer's account, or card and login details captured on the fake page. A parking fee of Rs 50 can be the start, followed by an 'extra charge' page asking for card details. A downloaded app may read SMS or show fake overlays. Because the code was in a real place, victims blame themselves or the venue and may not realise it was a sticker.
An example of what you may see
Example scene (invented): At a mall car park, a board says 'Scan to pay parking Rs 40'. You scan and a page opens asking you to enter your phone number and card details to pay. After you enter them, a message says 'Payment failed, enter the OTP to retry'. Later you notice the code sticker is slightly crooked and has an edge that peels over another printed code. The code on the board next to it shows a different company name when scanned.
This example is written for illustration. Real messages change their wording, names and links all the time.
Red flags
- A QR sticker looks pasted over another code or has uneven edges.
- The page that opens does not show the venue's real name or the payee's name.
- A parking or menu page asks for card details or a login.
- A code starts a download or asks you to install an app.
- The web address is shortened or looks unrelated to the place.
- You are asked to enter a UPI PIN to 'receive' or 'verify' something.
What to do right now
- Before paying, look at the address the code opens and the payee's name in your payment app.
- Prefer paying through the venue's official app or at the counter.
- Do not enter card details or install apps from a scanned code.
- Tell the venue staff if you suspect a sticker has been swapped.
- Use a scanner that shows the link before opening it.
If you already paid or shared a code
- Call 1930 and report at cybercrime.gov.in with the payment reference.
- Call your bank through the number on your card and ask to block the card if details were typed.
- Remove any app you installed and change passwords from a safe device.
- Keep a photo of the sticker and the location for your report.
National Cyber Crime Helpline: 1930. Report online at cybercrime.gov.in. Do it fast: the sooner your bank is told, the better the chance that money can be held.
Where this scam shows up
Read how it looks on each channel:
How Safeavio helps
QR check in Safeavio Sentinel scans a QR code and shows where it goes before you pay or open it, which helps you notice an odd address or a payee that does not match the venue. Link check can test the address further. Phone scan helps if an app was installed from a code. Safeavio cannot tell whether a sticker was swapped and cannot recover money paid.
Check it before you tap or pay
Safeavio Sentinel is a made-in-India Android app: paste a message or link, or scan a QR code, and get a plain verdict with the reasons. It helps you spot a scam; it does not promise to stop every one.
Download for AndroidWhat the app does
Google Play listing: coming soon. Today the signed APK is on safeavio.com/download. Android 7.0 or later.
Questions people ask
How can I check a QR code before paying?
Use a scanner that shows the destination before it opens, and read the payee name in your payment app. If the name does not match the venue, stop and pay another way. Also check that the page address matches the venue or the payment service.
Do QR codes themselves carry viruses?
A code is just a link or data. The risk is the page or file it leads to. Avoid downloading apps or entering card details after a scan. If a page asks for an app download, close it and use the venue's official app from a store instead.
What should I do if I see a suspicious sticker?
Do not scan it, tell the venue staff and take a photo for your records. If you already paid, call 1930 and report at cybercrime.gov.in. Please also take a photo so the venue can remove the sticker.