QR Code Sticker Scam: How Your Shop Catches a Swapped UPI QR

The counter shows no error. The customer scans, the app says payment successful, and the screen is real. They leave with their medicines, and the credit never reaches you. That is the QR code sticker scam: a fake QR code pasted on a shop's own, or a code quietly swapped, so the money lands in someone else's account.

It is not the fake UPI payment screenshot problem, where no money moved. Here the money did move, so the customer's proof is genuine, and you may only see the gap at day close.

We found no national prevalence or loss figure for this fake QR code store scam, so we won't offer one. What exists is police reports and tips for payers. This post is for the owner or cashier of a kirana, medical store, jeweller or restaurant taking UPI on a printed QR: how to tell, a daily check, the staff risk, who bears the loss, and what to do next.

How do I know a QR code was swapped at my shop?

Four signs show up in reported cases:

• No credit after a "successful" payment. On 12 Jul 2025 a paan stall owner in Khar West, Mumbai, got no notifications after customers paid. A neighbouring shop had the same trouble (Free Press Journal, 20 Jul 2025).
• A name you don't recognise when you scan. The same owner found a code pasted over his, scanned it, saw an unfamiliar name and went to the police. Police arrested a suspect, froze three accounts and recovered ₹49,000. That is the recovered sum, not the loss, and the report doesn't say whether anyone was made whole.
• Soundbox silence. Paytm says its soundbox announces successful payments on the mapped QR. Our inference: a payment to another account won't trigger your device. Silence can also be device or network trouble, so treat it as a prompt to check your provider app.
• Several shops at once. In Khajuraho, the SP cited complaints from 10 to 12 shops, including food stalls and medical shops and police used CCTV (PTI via NewsDrum, 14 Jan 2025). Free Press Journal says over a dozen plus a petrol pump. Reported loss figures conflict, so we quote no total.

Don't rely on peeling the sticker's corner. In Chandni Chowk, ₹1.40 lakh in two UPI payments by one customer never reached a garment shop, and police said the codes looked visually unchanged (The Tribune, 23 Dec 2025). The payee name matters more than the paper.

What name should appear when a customer scans your QR?

The exact banking name on your account. NPCI circular OC-101A (24 Apr 2025, compliance by 30 Jun 2025) requires apps to show the banking name from Validate Address, not names from the QR or user-defined names, for person and merchant payments. We read it through TaxGuru's reproduction, not NPCI's copy; Outlook Money reports the same rule.

Our inference: the shop name printed on a sticker proves nothing. And your genuine banking name may be the proprietor's, so customers can't always judge it. You can.

Two limits:

• A missing tick is not a fraud signal. Google Pay shows a green checkmark for NPCI-verified merchants, but its page doesn't say what no tick means.
• A matching name is not a guarantee. Reported cases showed unfamiliar or personal names, which makes the name worth checking, but a match doesn't prove all is well.

PhonePe's pre-Diwali warning this year gave payers the same advice, check recipient name and amount (Goodreturns, 27 Oct 2026, paraphrasing PhonePe). Paytm says the same and adds checking for overlays (updated 16 Mar 2026). Don't count on busy customers doing it.

A daily check for the QR code sticker scam at your counter

No official body prescribes a morning check. We found no RBI, NPCI, CERT-In, I4C or Cyber Dost advisory aimed at shops in accessible results, though that is absence in search, not proof. A cybercrime.gov.in PDF on QR tampering is listed in search as Apr 2022, but it would not open for us. RBI's 28 Jan 2022 release cautions on unauthorised QR use and isn't about shop tampering.

So this is Cybiqon's suggested routine, reasoned from the reports above. It costs nothing:

1. Note your exact banking name. Take it from your account or provider app, spelled as shown, and keep it on the owner's phone.
2. The owner scans every printed QR at opening and at each shift handover. Go to the payee screen, compare the name, don't pay. Include any QR outside the counter. In Tirupur, after night-time pasting was caught on CCTV, the SP urged shopkeepers not to stick QRs on outer walls (DT Next, updated 18 Feb 2022).
3. Match credits to bills at close, one by one. Every bill marked UPI needs a credit in your provider app or bank. Totals hide the gap. Our shift close and UPI matching routine has the format.

Know what this misses. Scans miss a swap made after you scan. Staff checking their own swap prove nothing, which is why the owner does it personally. Scans can also miss a tampered image altered after your check. The day-close match is the backstop, hours late.

When an employee replaced the shop QR code

The largest sums we found reported are alleged staff cases, not strangers with stickers. All of these are police or FIR allegations:

Where	Alleged sum	Period or source
Medical store, Calangute	About ₹49.68 lakh (police estimate)	Feb 2020 to Oct 2025; FIR 16 Mar 2026 (The Goan)
Imitation jewellery store, Kowdiar	Over ₹60 lakh per police, ₹69 lakh per FIR	Onmanorama, 11 Jun 2025
Toll plaza, Kozhikode	₹7 lakh	Onmanorama, 16 Oct 2026
Food courts, Hyderabad	₹4.15 crore	Telangana Today, Jun 2024

These are not a representative sample: big numbers make the news. So this table can't tell you how common staff theft is compared with outside pasting. It does tell you that a check run only by counter staff isn't a control.

For a shop with 2 to 6 staff, three habits do most of the work:

• The person taking UPI at the counter is not the person who signs off the match at close.
• Credit alerts reach the owner's phone, not only the counter phone.
• Only the owner changes a QR, through the provider, and updates the noted name.

You can't physically stop someone replacing a sticker. You can make it show up the same day.

Who bears the QR code sticker scam loss when a customer paid to a fake QR code?

Nobody has settled this. We found no RBI, NPCI, court, ombudsman or consumer commission source that allocates a swapped-QR loss, or says whether paying the wrong account settles the shop's bill. A flat answer either way goes beyond the sources. What they do say:

• RBI's 6 Jul 2017 circular on unauthorised electronic banking: the page we read doesn't mention QR codes or deceived customers.
• RBI's Third Amendment Directions, 24 Jun 2026 (RBI/2026-27/167), for transactions from 1 Jan 2027. Fraudulent transfers cover fraudulently obtained credentials, coercion or duress, and unauthorised transactions. A bona fide individual, including a sole proprietor, with a customer-negligence fraud loss up to ₹50,000 can get 85% of net loss or ₹25,000, whichever is lower, once in a lifetime, if reported to the bank and NCRP or 1930 within 5 calendar days.
• The limb that might have fitted is gone. The March 2026 draft mentioned being tricked into willingly sending money. It isn't in the final definition as we read it. No source applies these rules to swapped QRs, or to a shop whose account was never debited, so coverage is not established.
• Google Pay tells a payer whose merchant says the money wasn't received to file a chargeback with their bank. That assumes a real merchant payee, not a stranger's account.

The Khar report doesn't say who ended up bearing the loss either. So don't quote a rule at the customer; none exists. Record the bill, the payee name and the screenshot, then decide commercially. Our guide to recovering delayed payments assumes the debt itself isn't in dispute; here it is. For a large sum, see a lawyer first. This post isn't legal advice.

Static vs dynamic UPI QR code: what per-bill QR does and doesn't do

	Printed (static) QR	Per-bill (dynamic) QR
The code	Same one all day	New QR per order, through billing software (PhonePe)
Amount	Customer usually enters it	Customers can't change it (Paytm)
Closing the bill	Whatever the cashier sees	Paytm says close only after status verification
Who can get it	What most shops already have	Paytm: select enterprise customers with high volumes, on request. Razorpay's Dynamic Soundbox: per-invoice QR for high-checkout retail including pharmacies, with API integration said to take 2 to 3 days

By design this helps against swaps only if two things are true: the printed QR leaves the counter, and the bill closes on server status rather than a glance at a phone. Keep the old sticker up "just in case" and you keep the exposure. No source we found tests dynamic QR against swaps, so we won't call it the fix.

Getting one may be the real obstacle. You need billing software that talks to the provider, and a provider that will take you on. We found no current all-in price for a small shop, so get a written quote covering device, integration and monthly charges. For a one-counter owner, the name check, the soundbox and the day-close match may be enough.

What to do after a QR code sticker scam at your shop

Once you confirm a QR code swapped at your shop, work in this order. Steps 1 and 7 are our advice, not a sourced procedure.

1. Stop using the code. Photograph it in place, scan to the payee screen without paying, save the name and UPI ID, and keep the sticker.
2. Preserve CCTV. Police used it in Khajuraho and Tirupur. We found no sourced retention period, so copy it today.
3. Call 1930 and file at cybercrime.gov.in. RBI's directions name both. Ask whether they'll take a complaint from a shop whose account wasn't debited; the portal wouldn't open during our research, so we can't confirm. We found no sourced general deadline, so don't wait.
4. Tell affected customers to report from their side, through their bank and 1930. The payer holds the debit record.
5. Go to local police. Shop owners complained directly in Khar and Khajuraho, and the Chandni Chowk customer filed an e-FIR.
6. Inform your payment provider. PhonePe merchants: Help in the Business app or dashboard, or 080-6872-7777 / 022-6872-7777. Level 1 aims for 15 business days, then grievance.phonepe.com (checked on the live page, 2 Nov 2026). Others: use in-app support, and beware fake helplines from search results.
7. Replace the QR through your provider, then scan the new one and check the app.

A separate risk: if a lien or freeze ever lands on your own account after a cyber complaint, that is a different process.

As of 2 Nov 2026. Three things would change this post: RBI's rules taking effect on 1 Jan 2027, an RBI, ombudsman or court ruling on swapped QRs, or a new NPCI circular.

FAQs

How do I know if someone pasted a fake QR over mine?

Scan it to the payee screen without paying and compare the name with your exact banking name. A fake QR code pasted on a shop can look unchanged, so don't rely on the edges. A UPI bill with no matching credit at close is the other signal.

What name should appear when a customer scans my QR?

Your banking name from Validate Address, under NPCI's OC-101A. That may be the proprietor's name rather than the shop's.

Will my soundbox warn me?

No. It can only go quiet, and quiet can also mean device or network trouble. Fake alerts are a separate problem, covered in the screenshot post linked at the top.

A customer paid a fake QR at my shop, do they still owe me?

Unsettled. No source we found says either way. Record everything, decide commercially on small sums, and ask a lawyer about large ones.

Can a customer get money back?

Possibly, but nothing guarantees it, and a successful payment can't be cancelled. On Google Pay they can use "Having issues?" after 2 days; after 21 days its partner banks can't file, so they go to their bank. DigiSaathi is 14431 or 1800 891 3333. If the bank doesn't respond, there is the RBI Ombudsman at cms.rbi.org.in. A fake QR on a personal account may be treated as a person-to-person payment, so in-app help may not apply (our inference). One Hyderabad seller's customer was refunded after he contacted his UPI provider (Deccan Chronicle, 26 Jul 2024), an unverified single anecdote.

Should I call 1930 if the money never left my account?

We would, and ask whether they'll register it from you. The customer's own report matters too, because their account was debited.

Is a dynamic QR safer?

By design it can be, if the printed QR is gone and bills close on server status. No source tests it against swaps, and small shops may struggle to get one.

How do I stop staff replacing the QR?

You can't fully. Have the owner scan at opening and handover, send credit alerts to the owner's phone, and keep the close sign-off away from whoever took the money.

What Cybiqon would build for a multi-counter shop

The check above is free and needs no software, so start there. If you run several counters or shifts and the paper match keeps slipping, Cybiqon would build a small admin panel for it: a close register that lays bills beside your provider's credits and flags every UPI bill with no match, plus a log of who scanned which QR, when, and the name they saw. It is written for how your shop actually bills, not configured from a template, and you own the code. If you want to talk it through, book a 30-minute call, ring +91 9250711473 or write to [email protected].

Conclusion

The QR code sticker scam works because nothing looks wrong at the counter: the customer's success screen is real and the shortage arrives hours later. So stop judging by paper or by the customer's screen. Know your exact banking name, have the owner scan at opening and at handover, and match every UPI bill to a credit at close. Who bears the loss remains unsettled, so keep your evidence and take advice on large sums. If the paper version keeps slipping, Cybiqon can build it properly.