What is QR code payment fraud?

It is any scam where a QR code is used to take or move money, either by tricking someone into scanning a fake code or by abusing a genuine payment code. In the Chitrakoot case the code was genuine, and the fraud relied on attendants returning cash for a supposed overpayment.

How did the petrol pump QR scam reportedly work?

Suspects reportedly bought a little fuel, paid a much larger amount to the pump's merchant QR code, claimed it was an error and asked for the difference in cash. The reports say the money came from hacked phones elsewhere in India.

Should a shop ever refund an overpayment in cash?

No. Ask the customer to reverse the payment through their app or bank, so the money goes back the way it arrived and can be traced. Check with your bank if the amount looks unusual.

Can a dynamic QR code platform stop this kind of fraud?

No. A dynamic QR platform does not handle payments or staff cash handling, so it would not have prevented this case. It helps with your own printed codes by letting you pause or re-point them and by logging scans.

How do I check a printed QR code has not been replaced?

Look at the code regularly and feel for stickers or raised edges over the original. A dynamic code's scan log can also show unusual drops or location changes, but it cannot detect a physical overlay by itself.

Security November 2026 6 min read

Three Held in India After Petrol Pumps' Payment QR Codes Were Used to Cash Out Hacked Accounts. What QR Software Can and Cannot Fix

Police in Chitrakoot, India, reportedly arrested three men who used two petrol pumps' payment QR codes to turn money from hacked phones into cash. The QR code was genuine; the trick was in the refund. Here is what that means for anyone who prints codes.

This week's QR code payment fraud story from India involves no fake sticker and no malicious link. Police in Chitrakoot district, Uttar Pradesh, reportedly arrested three men on 4 November 2026 for using two petrol pumps' genuine payment QR codes to turn money taken from hacked phones into cash. The code did exactly what it should. The weak point was a person handing back "excess" money in cash. A dynamic QR platform cannot prevent that, and this article explains what it can and cannot do.

What reportedly happened in Chitrakoot

According to reports published on 6 and 7 November 2026 by The 420 and Ministry of Cyber Affairs (an independent news site, not a government body), the pattern was simple. A customer bought a small amount of fuel. They then paid a much larger sum to the pump's merchant QR code, said it was a mistake, and asked the attendant to return the difference in cash.

The reports say the larger payments came from phones that had been compromised elsewhere in India, in Chengalpattu in Tamil Nadu and Jaisalmer in Rajasthan. Once the attendant paid out the "refund" in notes, the stolen money had been converted into untraceable cash, with the pump's own bank account sitting in the middle.

The figures reported

Both outlets give similar numbers for two incidents on 2 November 2026. At one pump, reportedly, fuel worth Rs 650 was bought, Rs 65,000 was transferred and Rs 64,350 was returned in cash. At a second pump, diesel worth Rs 70,495 was bought, transfers totalled Rs 2,08,696 and Rs 1,38,200 went back as cash. Together that is roughly Rs 2.73 lakh moved, of which about Rs 2.03 lakh left as cash.

Who was arrested, and what is still open

Chitrakoot Police reportedly arrested three men from Prayagraj and are looking for two more. Two cases were registered at Raipura police station. The pump operators are treated as complainants, and the reports describe no finding that they knew about the fraud. Both pump bank accounts were reportedly put on hold. The reports say the arrested men described doing this for about three months, which is their account as reported, not something a court has established. All of this is allegation until proven.

Why this QR code payment fraud is hard to spot

Most QR warnings are about a tampered code: a sticker over a real one, or a poster altered to point somewhere else. We have covered those, including fake stickers on parking meters and altered event posters. This case is different in a way that matters.

The code was real. It belonged to the pump and paid the pump's account.
The payment really arrived. The attendant could see a credit, which is what makes the "I paid too much" story believable.
The risk was in the reversal. Money that arrives by a payment app can usually be recalled later. Cash cannot.

In other words, the QR code is just a pointer to an account. Whoever controls the account controls what happens next, and a criminal who can push money in can also try to pull cash out through a person.

What a business should do about QR code payment fraud

None of this needs special software. The reports and standard banking advice point to a few habits:

Never refund an "overpayment" in cash. Ask the customer to reverse it through the payment app or bank, so the money returns the way it came.
Compare the credit with the sale. A Rs 65,000 credit for a Rs 650 purchase is a flag in itself.
Give staff a rule they can follow without a manager. A pump attendant at 9:30 pm should not have to judge a stranger's story.
Report quickly. In India the reports mention the 1930 helpline and cybercrime.gov.in; elsewhere, tell your bank and local police at once.
Check your printed codes still belong to you. Walk the counter and pumps regularly for stickers placed over the genuine code.

What a dynamic QR platform can and cannot do

We make one of the tools this article is about, so here is the plain version. A dynamic QR platform such as D-QR does not process UPI or card payments, does not sit between a customer and your bank, and cannot stop an attendant handing over cash. It would not have prevented what happened in Chitrakoot. If someone tells you software alone fixes this, be sceptical.

It does help with the neighbouring problems any business with printed codes has:

Printed codes you can pause or re-point

With a dynamic QR code, the printed square points to a short address you control. If a code is compromised or a campaign ends, you can pause it or re-point it in seconds, and every printed copy follows. The pillar guide to dynamic QR codes explains how. This is useful for your own information, menu, loyalty or contact codes. It does not change a bank's merchant payment QR.

A scan log that shows odd activity

Each code keeps a scan log with country, city and device, and bot traffic is counted separately (see bot filtering). On the Pro plan you can also set scan alerts and webhooks. A burst of scans from the wrong country on a code that normally serves one town is the kind of signal worth noticing. Our tracking page covers the details.

Controls per code

You can set an expiry date, a password or a country restriction on an individual code, and custom domains are available on paid plans so a scanned link shows your own name rather than a generic one. Codes have no expiry unless you set one, and free-plan codes stay live (the free plan allows 3 codes). CSV export of scan data is on paid plans.

What no software can fix

A QR code is printed matter, and printed matter can be covered. If someone sticks a new code over yours, a platform cannot see it; your logs would simply show fewer scans. Regular physical checks, as the police advice in the sticker cases says, remain the only defence. Our guide to QR code safety sets out the checks for scanners and owners, and our retail page shows where codes usually sit in a shop.

The lesson for anyone who prints codes

The Chitrakoot case is a reminder that QR fraud is not always about the code. Sometimes the code is the least interesting part, and the process around it, such as refunds, change and cash handling, is what gets exploited. Build rules for that process first. Then use your QR tooling for what it is good at: keeping printed codes editable, visible in the numbers and easy to shut off. For the wider picture of how printed codes fit into a campaign, see QR codes in marketing campaigns and the marketing campaigns overview.

Sources: The 420 (7 November 2026) and Ministry of Cyber Affairs (6 November 2026), both linked above. Details such as the arrests, amounts and the alleged three-month duration are as reported there and have not been independently confirmed by us.

Part of the guide to QR codes in marketing and retail

Start here QR Codes in Marketing Campaigns: Bridging Print and Digital Print is not dead — it just needs a way to connect to digital. QR codes on posters, direct mail, and packaging can drive measurable online actions. Here's how to do it right. Try it QR Codes for Marketing Campaigns Attribute print spend with per-placement scan data and A/B splits.

Keep reading

Security · 7 min read Malicious QR Code Leaflets Fell From a Drone Near Kyiv. What the Incident Teaches Anyone Who Prints Codes Ukrainian forces reportedly found leaflets with phishing QR codes inside a downed Russian drone near Kyiv. Here is what was reported, and what it means for anyone who prints QR codes. Security · 7 min read Police in Buena Vista, Virginia Warn About a QR Code on an Unordered Package. What Legitimate Brands Should Do Buena Vista police say a woman received a phone she never ordered, with a QR code on the package. Here is what was reported, what to do if it happens to you, and how legitimate brands can make their own codes easier to trust. Security · 6 min read Unordered Packages, a QR Code Inside: A Missouri Woman's Brushing Scam Warning, and What Honest Brands Can Learn A Springfield, Missouri woman reportedly keeps receiving parcels she never ordered, and experts warn a QR code inside could be the next step of the scam. Here is what to do, and how genuine brands can make their own package codes easier to trust.

Put this into practice

Dynamic QR Code Generator Editable, trackable QR codes you can repoint after printing. Free QR Code Generator Make a QR code at no cost — no watermark, no trial timer. Bulk QR Code Generator Upload a CSV and get thousands of unique, trackable codes as a ZIP.

Ready to create your first dynamic QR code?

Free, no credit card required — up and running in under 60 seconds.

Create a Free QR Code