PhonePe says scammers are exploiting the festive rush with tampered merchant QR codes, fake rewards and messages that trick users into authorising payments instead of receiving money.
PhonePe has warned users to be on guard against QR-code fraud as Diwali shopping drives a sharp rise in digital payments, saying scammers often exploit the festive rush with fake stickers, deceptive cashbacks and bogus reward offers. The company said criminals are taking advantage of hurried shoppers by placing counterfeit QR codes over legitimate merchant stickers or by luring people into scanning images sent through messaging apps under the pretence of festive bonuses, refunds or gift hampers.
The basic trick is to push the victim into authorising a payment or sharing banking details under false pretences. According to PhonePe, one common tactic is to send a QR code through WhatsApp or a similar app and instruct the recipient to scan it and enter a UPI PIN to “receive” money. In reality, the payment is sent out rather than received. Moneycontrol has also highlighted that users should never enter a UPI PIN to accept money, a point that remains one of the most important safeguards in India’s fast-growing payments system.
The company said its PhonePe Protect framework is designed to flag suspicious activity during a transaction and warn users before money leaves their account. According to a report in The Times of India, the company has also rolled out a feature that can identify payments linked to government-flagged fraud numbers and block certain high-risk transfers. PhonePe says its wider security stack includes know-your-customer checks, biometric verification, document authentication and two-factor authentication, along with behavioural biometrics that look for unusual device or user patterns.
Security officials have separately warned that fake QR-code fraud is not limited to online messages. Rajasthan Police have cautioned shoppers about tampered stickers being placed over genuine merchant QR codes at shops, diverting payments to criminal accounts. PhonePe advised users to check the recipient name and payment amount before approving any transfer, avoid suspicious links or pop-ups, and treat any pressure to act quickly as a warning sign. Anyone who thinks they have been targeted should report the matter through the PhonePe app, the national cybercrime portal or the 1930 helpline, and should also flag suspicious calls or messages through the Chakshu facility on the Sanchar Saathi portal.
Disclaimer: This article is intended to inform and educate, not to recommend or endorse any financial product, investment or strategy. Please consider your own financial circumstances and seek professional advice where appropriate before making financial decisions.
