Spammed With UPI Registration Texts After Scanning a QR Code? It’s a Scam!

A new type of scam targets Android users after they scan rogue QR codes with the smartphone camera.

People have been targeted with rogue QR codes which 

(Source: X/@Ashish_4vedi/Altered by The Quint)

A highly sophisticated new UPI scam is targeting commuters and users across India, where Android users are made to scan 'rogue' QR codes, linking their bank accounts to remote devices without their consent.

Described as a 'technical exploit', this scam takes over the device within minutes, leading innocent users' bank accounts being drained. A journalist on X shared his sister's experience, stating how despite her vigilance, scammers still attempted to target her with this scam.

The woman was reportedly targeted with the scam despite paying using cash.

(Source: X/Screenshot)

The Quint's Scamguard initiative breaks down how this Android-focused QR code scam works, what you can do if you fall for it, and how you can proactively protect yourself.

Forget fake screenshots or calls asking for your PIN. The newest financial fraud requires you only to scan a manipulated QR code using your phone's default camera. Cybercriminals have weaponised them on Android to force your device to register their devices or platforms with your banking apps.

Modus Operandi

• The Hijacked QR: The scammer displays a custom, manipulated QR code (reportedly found street vendors or drivers). Scanning this does not open a secure payment page. Instead, it triggers a system which puts you at a risk.

• The Forced Verification SMS: The malicious code forces the victim's phone to draft and send a hidden, encrypted UPI registration token via SMS in the background.

• The Remote Device Bind: Simultaneously, the scammers enter the victim's phone number into multiple banking apps on their own devices. When the victim's phone broadcasts that encrypted SMS token, National Payments Corporation of India's (NPCI) systems mistakenly validate the scammer's phone as the legitimate primary device.

• The Multi-Bank Explosion: Once the phone number is bound to the scammer's handset, automated scripts fetch every bank account linked to that number (HDFC, Axis, ICICI, SBI, etc.) in a matter of minutes, granting the scammer full control to drain the accounts.

Red Flags

• Scanning a QR code that prompts your phone to open your SMS or messaging app instead of a payment gateway.

• Unknown outgoing SMSes in your outbox containing cryptic alphanumeric strings (e.g., HDFCUPI).

• A sudden flood of unexpected UPI registration or activation SMSes from banks you hold accounts with.

• QR codes displayed on the street that look heavily tampered with or are presented by vendors rushing you to "scan quickly using your camera."

What To Do

If you or someone you know receives a sudden flood of UPI activation messages or suspects a device takeover, execute these steps immediately:

1. Dial *99# Immediately: From the affected SIM, dial this universal number, facilitated by the NPCI. Select the option to Block UPI or Disable UPI Profile. This works instantly across all banks without needing internet access.

2. Check SMS Forwarding: Dial *#21# to ensure the hacker hasn't secretly set up call or SMS forwarding. If they have, dial ##002# to wipe it out immediately.

3. Deregister Your Apps: If you still have access to your Google Pay, PhonePe, Paytm, or BHIM apps, go directly to settings and select De-register UPI Profile. This forces a termination of all external sessions.

4. Call 1930: Reach out to the National Cyber Crime Helpline immediately to report active device-binding fraud and freeze downstream channels. You can also file a formal report at cybercrime.gov.in.

Golden Rule of Prevention: NEVER scan a street vendor or driver's QR code using your phone's default camera app or generic QR scanners.

• Always open a trusted, official app like Google Pay, PhonePe, BHIM, or your official banking app to scan. Safe payment interfaces will strictly block malicious device-binding intents.

The Quint's Scamguard initiative aims to keep up with emerging digital scams to help you stay informed and vigilant. If you've been scammed or successfully thwarted one, then tell us your story. Contact us via WhatsApp at [phone] or email us at [e-mail]. You can also fill out the Google form and help us take your story forward.

(At The Quint, we question everything. Play an active role in shaping our journalism by becoming a member today.)