Beware QR code fraud this festive shopping season

These days even buying a cup of tea often means pulling out a phone and paying by scanning a QR code. But scammers are exploiting this habit through what is called QR code fraud, in which money that is lost is very hard to recover. QR codes seem safe, but the cybercrime hidden behind them is invisible, and that is exactly what fraudsters count on.

A QR code is a square barcode that hides a link or a UPI ID. The code itself is not harmful, but the link behind it can be dangerous. Fraudsters use two main methods. The first is swapping a shop's QR code. If a shop has a Paytm QR code on display, a fraudster can paste a fake QR code over the real one. When a customer scans it, the money goes not to the shopkeeper but straight into the fraudster's account. In some cases, victims are redirected to a fake website that asks for bank details, and the account is emptied as soon as these are entered.

The second method is the most common. A call or message arrives saying "You have received a cashback of Rs 5,000," "You have won a lottery," or "This is regarding your OLX listing, I want to buy your item and am sending you the payment." The victim is then sent a QR code and told to scan it and enter their UPI PIN to receive the money. This is where most people get caught. The Reserve Bank of India has said that scanning a QR code or entering a PIN is never required to receive money. A PIN is needed only when sending money. Entering a PIN in the hope of receiving money instead results in money being deducted from the account.

There is another danger called quishing, a combination of QR and phishing. Scanning a fake QR code can secretly install a virus on the phone. This virus steals all the phone's passwords and OTPs and sends them to the fraudster's server, without the victim realising their account has been emptied.

A few precautions are important. After scanning a QR code, always check that the name displayed on the phone matches the name of the shop. If a different name appears, cancel the transaction immediately. Most importantly, a PIN is never needed to receive money, no matter who asks for it, so it should never be shared. Unknown QR codes received on WhatsApp or Telegram should not be scanned, and lottery or cashback offers should be treated with suspicion, since no one gives away money for free. Payment apps such as Google Pay, PhonePe and BHIM should always be kept updated, as they regularly receive new security features.

If someone falls victim by mistake, they should not panic but act immediately. The first hour, known as the Golden Hour, is critical. The cyber helpline number 1930 should be called right away, and a complaint should be filed on the website cybercrime.gov.in. Filing a complaint quickly allows the police to get the money held. Technology is useful, but users must stay alert, think carefully before scanning any QR code, and avoid scanning altogether if there is any doubt.