QR, NFC and Contactless Frauds in India Explained

Every chai stall, autorickshaw and temple donation box now carries a QR sticker, and every new debit card taps. Payments that take two seconds leave two seconds to notice something is wrong. Contactless fraud in India is mostly built on that gap, and on one confusion that scammers exploit relentlessly: the idea that scanning a code or entering a PIN can bring money in.

This explainer separates the real contactless frauds from the folklore, describes how each works, and lists the settings that cap the damage. It covers UPI QR codes, phone tap-to-pay, and NFC-enabled cards.

The one rule under every QR fraud

A UPI QR code is a picture of an address. When you scan it, your app reads the receiver's UPI ID and asks you how much to send. When you enter your UPI PIN, money leaves your account. There is no version of this in which scanning or entering a PIN causes money to arrive. The same is true of a collect request: the notification that asks you to "approve" a payment is a request for your money, however it is labelled.

Every "scan to receive" scam, whether the refund for a cancelled order, the buyer on a marketplace paying for your old sofa, or the "cashback" from a delivery app, depends on the victim not knowing this. We cover the scripts in detail in why "scan to receive money" is always a lie; the rest of this post assumes you know the rule and looks at the frauds that work even when you do.

Contactless fraud at the counter: the swapped sticker

The most common physical QR fraud needs no technology beyond a printer. A fraudster prints a QR code for a UPI ID they control, usually with a name chosen to resemble a business, and sticks it over the merchant's sticker at a busy counter, a parking booth, a petrol pump or a temple. Customers scan, see a plausible name, pay, and walk off. The shopkeeper notices only when the day's takings do not match, by which time the receiving account has been emptied.

Variations include a fake "sound box" that announces payments received so the shopkeeper hears a confirmation that never reached their account, and a customer who shows a doctored "payment successful" screen. Both are frauds on the merchant rather than the payer.

NFC and tap-and-pay: what is real

NFC payment lets a card or phone exchange payment data with a terminal a few centimetres away. The folklore says a thief with a reader can brush past your pocket and charge you. The practice is less dramatic. A reader needs a registered merchant account to receive funds, which is traceable; the card limits a PIN-free contactless transaction to ₹5,000 under RBI rules; and a card in a wallet among other cards tends to confuse readers. Stories of crowd skimming in Indian trains mostly collapse under those facts.

What is real: a card lost in a cab is tapped several times at fuel stations and small shops before the owner notices. Each tap is below the PIN threshold, so no PIN is asked for. The defence is speed (block the card the minute it is missing, through the bank app or the 24-hour number) and the card controls that RBI required banks to offer from 2020: switch contactless off if you never tap, set a low per-transaction contactless limit if you do, and switch international and online use off until you need them. Each toggle removes a category of fraud in one tap of your own.

Phone tap-to-pay is generally safer than the plastic. The phone sends a token rather than the real card number, requires the phone to be unlocked, and can be wiped remotely. The card number itself never crosses the terminal.

Three settings that limit the damage

1. A separate UPI account with a small balance. Link UPI to an account you top up weekly, not your salary account. A swapped sticker or a tricked PIN entry then costs you the float, not the month. The setup is in secure UPI setup.
2. Daily and per-transaction limits. Set them in the UPI app and in the bank's card controls. Choose the lowest number that does not inconvenience you on a normal day.
3. Alerts on every transaction. SMS and app notifications are the only way to catch a run of small taps or a sticker fraud the same hour rather than the next statement.

When money has gone

Treat a QR or contactless loss exactly like any other online fraud. Call 1930 first; the receiving UPI ID or merchant account can be frozen only while the money is still in the system. File on cybercrime.gov.in within 24 hours. Write to your bank the same day: under the RBI's 6 July 2017 circular on customer liability, reporting an unauthorised electronic transaction within three working days gives you zero liability, and days four to seven cap it at a fixed amount by account type. For a disputed UPI payment, the app's dispute flow and the NPCI dispute mechanism run alongside the police complaint. If the bank stalls for 30 days, the route is the RBI Ombudsman.

Two cautions. Banks often call a PIN-entered payment "customer-induced" and refuse; contest it in writing, because deception is third-party fraud under the circular. And a "recovery agent" who calls offering to get the money back for a fee is the second scam; nobody legitimate contacts a victim unsolicited. The whole sequence, in order, is in how to report cyber crime.

Reporting window: notify the bank within three working days of an unauthorised electronic transaction and your liability is zero, provided the loss was not caused by your own negligence. (Source: RBI circular DBR.No.Leg.BC.78/09.07.005/2017-18, 6 July 2017)

For shopkeepers

Merchants carry the sticker risk and a second one: the fake "payment received" screen from a customer. A sound box tied to your own account, a daily check of the sticker, a photographed copy of the genuine QR, and a rule that large payments are confirmed on your own app before goods leave the counter cover most of it. Report sticker tampering to the local police as well as 1930; it is usually done to several shops on the same street in one night. The broader catalogue of UPI frauds, eleven of them with the fix for each, is in UPI fraud: 11 ways scammers steal, and the legal sections that apply are on the online financial fraud page.