The scammer sneaks in and pastes their sticker over the shop's code.
The real scenario
You stop at a juice stall. The owner has a printed QR code taped to the counter. You scan it with your UPI app and pay ₹80 for your juice. But what you didn't notice is that a scammer had carefully pasted their own printed QR code sticker on top of the shop owner's original one. Your ₹80 went straight to the scammer's account. The shop owner doesn't know, you don't know — until someone checks their balance at the end of the day.
How does this work?
This scam is shockingly low-tech, which makes it highly effective. The scammer simply prints out a sheet of QR codes linked to their own disposable bank accounts or digital wallets. They walk around targeting busy shops, tea stalls, restaurants, parking lots, and petrol pumps — places where people pay by scanning QR codes quickly without thinking twice.
When the shopkeeper is distracted or the shop is closed for the night, the scammer places their sticker directly over the legitimate one. The next day, every customer who scans that code is sending money to the scammer.
Because the victim scans the code and sees a legitimate UPI payment screen (which the scammer might have set up with a similar-sounding merchant name like "Juice Point"), they confidently enter their PIN. The payment goes through successfully, but the shopkeeper never receives the SMS confirmation.
🚩 Red flags to watch for
🚩
The QR code looks like a loose sticker pasted on top of an acrylic stand or another laminated paper.
🚩
The edges of the QR code are slightly raised, peeling, or misaligned with the branding behind it.
🚩
The merchant name shown on your screen after scanning does not match the name written on the shop's board.
🚩
The UPI ID shown on your phone looks like a personal name (e.g., rahul123@upi) instead of a verified merchant account.
✅ How to stay safe
✅
Verify the name: Always read the merchant name displayed in your UPI app aloud. Ask the shopkeeper, "Is this going to [Name]?" before you enter your PIN.
✅
Physical inspection: Before scanning, take half a second to look at the code. If it looks like a cheap paper sticker slapped over a plastic stand, be cautious.
✅
Use SatarkScan: Scan the code through the SatarkScan app first. Our engine checks the VPA reputation and flags suspicious personal accounts masquerading as businesses.
✅
Dynamic Codes: Whenever possible, ask the shopkeeper to show you a dynamic QR code directly from their UPI App or billing machine, rather than scanning the static code on the desk.