As the festive season gains momentum in India, the demand for household appliances, electronic goods, apparel, and more is expected to rise. In sync with the nation's growing affinity for contactless payments, consumers are increasingly turning to digital payment methods, including UPI (Unified Payments Interface), credit/debit cards, and QR codes.

Live TV

Loading...

Particularly, millennials and Gen Z are leading the charge in adopting these digital payment options for both high and low-value transactions. However, amidst this digital payment revolution, the spectre of cyber fraud looms large, with the UPI QR code scam posing a significant threat.

Understanding the UPI QR code scam

Ankit Ratan, CEO and co-founder at Signzy, a digital fintech platform, sheds light on the UPI QR code scam, explaining, "There are various QR code scams, each with its own modus operandi."

Sender sharing QR code to the receiver: In a legitimate QR code payment, the sender scans the receiver's QR code, enters the payment amount, and initiates the transaction. However, in this scam, the fraudsters (posing as senders) manipulate the situation.

"They share a fake QR code with the receiver and convince them to scan it, enter the desired amount, and provide the OTP. The result? The receiver's money is debited, and the fraudsters disappear," Ratan told CNBC-TV18.com.

For example, imagine someone is selling a used smartphone. The scammer, claiming to be the buyer, sends a QR code, instructing the seller to scan it for payment. In reality, it's a fraudulent QR code, and the seller loses money.

Duplicate QR Code above an original QR code: Fraudsters employ a more deceptive tactic by superimposing their fraudulent QR code on top of a legitimate one. This occurs commonly at parking lots, in marketing campaigns, or even on snack boxes. Unsuspecting victims who scan these codes end up losing their money.

QR code email scam, aka phishing: Scammers send phishing emails containing QR codes that mimic those from reputable e-commerce sites, banks, or donation companies. These emails typically contain messages like "your previous payment failed, please make a fresh payment" or "activate your account by scanning this QR code." Falling for these emails can lead to financial losses.

Protection from QR code scams

To safeguard finances during this festive season, here are some crucial steps to follow, as outlined by industry experts:

According to Akshay Mehrotra, CoFounder and CEO at Fibe, a digital loan app, consumers should not share their personal information with anyone, and they should be aware of how much to share and why are they being asked about certain personal details on phone/ email because banks do not ask for such details.

"Individuals must also ensure to change their internet banking passwords. UPI pin and card pins every three weeks to avoid falling prey to online financial frauds. It is also important that they keep a constant check of their bank transactions/ statements, track incorrect payments and report to bank authorities for any suspicious activity. During the festive season, there might also be an increase in scams related to gift cards or holiday packages. It is recommended for individuals to be vigilant about emails from unknown websites and phone calls from unknown numbers," Mehrotra told CNBC-TV18.com.

Ankit Ratan further said, "No sender will send his/her QR code asking for OTP." If someone does, consider it a red flag and report it to the authorities immediately.

Additionally, consumers must avoid scanning QR codes in public places to avoid exposing personal information and e-wallet/ UPI pins.

Before scanning QR codes received via email, users should validate them with the respective company or organization's representative. They should ensure that the website starts with "https://" and contains contact information, email IDs, and clear cancellation and refund policies.

Amit Relan, Co-Founder and CEO of mFilterIt, a fraud detection company, advises users to stay vigilant and not fall for offers that seem "too good to be true." He suggests refraining from paying through suspicious links and not sharing personal or payment-related information with unknown individuals.

"Remember, QR codes are for making transactions, not for receiving funds. Never share your OTP or PIN," he told CNBC-TV18.com.

Saiprasad Shankar, CTO at Deciml, an investment app, stresses on verifying the receiver's name when sending money via UPI.

Amit Kumar, CTO of Easebuzz, a payments solution platform, warns against the common lure of rewards or cash promises in messages accompanying QR codes. He urges individuals to review transaction deductions carefully and stay vigilant when lending their phones to others.

(Edited by : Amrita)