QR Sticker Swap Shop Scam through an app

How it looks through an app, the red flags and what to do.

Scam apps pretend to be a bank, a loan service, a game, a government service or a "support tool", and they ask for access to SMS, contacts, the screen or accessibility. QR Sticker Swap Shop Scam is one of the ways this shows up: Scammers paste their own QR code over a shop's real one, so customers pay the wrong account and the shopkeeper is never paid.

What qr sticker swap shop scam looks like through an app

• A loan app that asks for contacts and photos.
• A "KYC", "challan" or "bank rewards" app from a link.
• An .apk file sent on WhatsApp or by SMS.

The scammer visits the shop or parking area when nobody is watching the counter. They print a QR code linked to their own account on a sticker the same size as the real one and paste it on top, or on a standee next to the till. The trick takes a few seconds, and the new sticker is often placed on a laminated board so it looks original.

Red flags to check on the app

• A QR sticker is pasted over or beside the original code.
• The receiver name on the pay screen is not the shop's name.
• The code looks crooked, bubbly or newer than the board around it.
• Your sound box or app does not show credits for payments that customers say they made.
• It asks you to turn off Play Protect.
• The app does not come from the official store listing of the company.

What to do

1. Check the receiver name on the payment page before you press pay.
2. As a shop owner, inspect your QR code every morning and use a sealed or engraved code.
3. Ask customers to pay by typing your UPI ID or confirm the name aloud.
4. Change the passwords of your bank and email from a clean device if the app had access.
5. Run a phone scan (Safeavio Sentinel lists risky apps and settings).
6. Call your bank, and call 1930 if money moved.

Report the fake app to the store it came from and, if money moved, call 1930 and report at cybercrime.gov.in.

If money or a code is already gone

1. Call 1930 as soon as you realise you paid the wrong account and give the transaction ID.
2. Tell your bank through the number on your card or passbook.
3. Report at https://cybercrime.gov.in with a photo of the fake sticker and the payment screen.
4. Shop owners should also note the time window when the sticker was in place.

National Cyber Crime Helpline: 1930; report at cybercrime.gov.in.

Safeavio's QR check lets you scan a code and see where it goes before you pay or open it, which can help you notice a code that does not match the shop. Money Shield reminds you to confirm the receiver name before you pay. Safeavio cannot see a physical sticker and cannot tell you whether a UPI account belongs to the shop.

Full guide: QR Sticker Swap Shop Scam: how it works, signs and what to do. Other channels: QR code, social media.

Questions