Shop Counter QR Sticker Swap Targeting Small Merchants through an app

How it looks through an app, the red flags and what to do.

A fake app can be installed from a link, from a file sent on chat or even from a lookalike listing. Once on your phone it can ask for powerful permissions. Shop Counter QR Sticker Swap Targeting Small Merchants is one of the ways this shows up: Scammers paste their own payment QR over a shop's real code so customers pay the wrong account. Shopkeepers and customers should check the name.

What shop counter qr sticker swap targeting small merchants looks like through an app

• A loan app that asks for contacts and photos.
• A "KYC", "challan" or "bank rewards" app from a link.
• An .apk file sent on WhatsApp or by SMS.

The set-up is a quick visit. The scammer, acting like a customer, buys a small item and places a printed QR sticker over the shop's code, or leaves a new standee on the counter that looks like the old one. The code he uses belongs to an account under his control. The sticker uses the same colours and style as the shop's board, so a quick glance shows nothing unusual.

Red flags to check on the app

• A QR board looks newer, thicker or slightly misaligned.
• The soundbox or app does not confirm a payment the customer says was made.
• The payee name shown to customers does not match the shop's name.
• A stranger spent time at the counter and touched the board.
• It asks you to turn off Play Protect.
• The app does not come from the official store listing of the company.

What to do

1. Check the QR board each morning and evening for stickers or changes.
2. Prefer a soundbox or app alert linked to your own account for each payment.
3. Ask customers to confirm that the payee name matches your shop.
4. Run a phone scan (Safeavio Sentinel lists risky apps and settings).
5. Call your bank, and call 1930 if money moved.
6. Do not install it. If it is installed, uninstall it now (Settings, Apps).

Report the fake app to the store it came from and, if money moved, call 1930 and report at cybercrime.gov.in.

If money or a code is already gone

1. If you or a customer paid the wrong account, call 1930 and report at cybercrime.gov.in with the UPI reference.
2. Tell your bank through its official app so the receiving account can be noted.
3. Keep a photo of the sticker, the shop's board and the transaction list.
4. Replace the QR board with a fresh one from your own bank's app.

National Cyber Crime Helpline: 1930; report at cybercrime.gov.in.

QR check in Safeavio Sentinel scans a code and shows where it goes before you pay, which helps customers and shopkeepers notice a payee that does not match the shop. Money Shield explains what to verify before paying. Safeavio cannot detect a sticker on a physical board, cannot confirm that payments arrived and cannot recover money sent to the wrong account.

Full guide: Shop Counter QR Sticker Swap Targeting Small Merchants: how it works, signs and what to do. Other channels: QR code, social media, phone call.

Questions