Do you blindly scan every QR code?:New ‘Rogue Auto QR Code’ scam could put UPI users at risk; follow these 5 tips to protect yourself

More than 55.49 crore users were onboarded onto UPI in India as of June 2026, according to NPCI, showing just how deeply digital payments have become part of everyday life. From paying an auto driver to buying groceries or splitting a restaurant bill, scanning a QR code has become almost second nature for millions of Indians. But the growing popularity of UPI has also made it an attractive target for scammers. A new alleged fraud, being referred to online as the ‘Rogue Auto QR Code’ scam, has raised concerns after a Mumbai commuter reportedly received multiple UPI registration alerts from different banks after encountering a suspicious QR code during an Uber auto ride. What is the ‘Rogue Auto QR Code’ scam? The name ‘Rogue Auto QR Code’ comes from a viral warning circulating on social media about an alleged UPI device-takeover technique. The reported Mumbai incident involved a passenger who allegedly noticed something suspicious about a QR code shown by an auto driver after an Uber ride. Instead of scanning it, the passenger reportedly paid in cash. Soon afterwards, however, she allegedly began receiving multiple SMS alerts related to UPI registration from different banks. The incident was shared publicly by journalist Ashish Chaturvedi, who said his sister had experienced the situation. The incident itself does not prove that the QR code caused the subsequent alerts. However, it has prompted cybersecurity discussions around how malicious QR codes could potentially be used to trigger unwanted actions on smartphones. How is the scam claimed to work? According to a viral X post by a user named Soham, the alleged attack could involve a specially created QR code rather than a normal payment QR code. The claim is that the QR code could contain a link or command designed to trigger an action on an Android phone. Instead of simply opening a payment screen, it could potentially launch another process or redirect the user to an unexpected action. The post described it as: The ‘Rogue Auto QR Code’ Device Takeover. The post further claimed that the QR code could potentially trigger a verification SMS related to UPI registration. If a scammer already knows the victim’s mobile number, they could then attempt to initiate UPI registration on another device. However, these technical claims are based on the viral post and have not been independently verified as the mechanism behind the Mumbai incident. Why did the victim receive messages from different banks? This is one of the biggest concerns raised by the incident. UPI registration can involve mobile-number verification through SMS. If someone tries to register a UPI profile using your phone number, you may receive an unexpected message or notification related to the process. According to the viral explanation, scammers could potentially try initiating registration across multiple banking apps. This could explain why a victim might suddenly receive several UPI-related messages from different banks. But receiving these messages does not necessarily mean that the scammer has successfully taken control of all your bank accounts. Also read: Google marks 10 years of Pixel family of devices: New Pixel 11 series adds a multicolored LED to camera bar — top 7 rollouts

Who could be targeted? The alleged scam could potentially affect people who frequently use QR codes for everyday payments. This could include: The important thing to remember is that the scam is not limited to Uber users. The same type of social engineering could potentially be attempted anywhere a fraudster can convince someone to scan a QR code. What happens if you scan a suspicious QR code? A QR code is simply a way of encoding information. Scanning one does not automatically mean your bank account has been compromised. The risk depends on what the QR code contains and what the user does after scanning it. A suspicious QR code could potentially: That is why users should stop immediately if a QR scan leads somewhere unexpected. Never scan a QR code to receive money One of the most important UPI safety rules is simple: you do not need to enter your UPI PIN to receive money. Scammers may tell victims to scan a QR code to receive a refund, cashback, prize money, or payment. Be suspicious of such requests. Before making a payment, always check the name of the person or business receiving the money on your UPI app. If the details do not match, cancel the transaction. How to protect yourself from the Rogue Auto QR Code scam You do not have to stop using QR payments. Instead, be more careful about what you scan and what you approve. Unexpected UPI registration messages, bank alerts, or authentication messages should be treated seriously. Also read: ChatGPT starts showing ads to Indian users: OpenAI emails about the update; how ads could change the way you search and research

What should you do if you receive unexpected UPI registration alerts? First, don’t panic. Receiving a registration message does not automatically mean your money has been stolen or that every bank account linked to your mobile number has been compromised. Don’t blindly trust a QR code The biggest lesson from the alleged Rogue Auto QR Code incident is that QR codes should be treated like links. Just because someone shows you a QR code does not mean it is genuine. Before scanning, ask yourself whether you know who provided it and why you are being asked to scan it. If you are simply paying an auto driver, for example, make sure the payment details shown inside your UPI app match the intended recipient before entering your PIN.