Many Indian users now prefer UPI payments, but scammers are now coming up with new ways to abuse them and target your bank accounts. A recent case in Mumbai highlights this growing risk, where a passenger was allegedly given a tampered QR code by an Uber auto-driver. The passenger reportedly received several messages regarding UPI registration from various banks following the incident. The exact details of the incident are still under the wrap. Follow along with the article to learn everything we know about the Rogue Auto QR code scam and how you can stay safe.
Journalist Ashish Chaturvedi of CNBC Awaaz recently shared a post on his official X account where he stated that his sister faced a suspicious payment situation after booking an Uber auto in Mumbai. According to the post, his sister booked an Uber auto, and once the ride ended, the auto driver showed her a tampered QR code. She suspected it and settled the bill in cash. However, following that, she started receiving multiple SMS messages from different banks for UPI registration.
My sister booked an Uber auto MH02EF3779. After the ride, the driver showed a fraudulent QR code. My sister suspected this and paid in cash. However, after a few minutes, she started receiving many messages from different banks for UPI registration. Please help. @MTPHereToHelp… pic.twitter.com/fRkBsXBpri
— Ashish Chaturvedi (@Ashish_4vedi) August 12, 2026
An X user named Soham later explained how the scam may work. According to his viral post, scammers first show a fake QR code. Scanning it could trigger an action on the phone instead of simply opening a payment page.
🚨 NEW UPI SCAM: The "Rogue Auto QR Code" Device Takeover 🚨
— Soham | Strong Opinions (@__my__opinions) August 12, 2026
A highly sophisticated UPI scam is targeting commuters using Android phones. Within minutes, victims are seeing their bank accounts linked to remote devices without their consent.
Here is exactly how this technical… https://t.co/CRff08K8er
The post claimed this could send a verification message from the victim’s phone. If scammers already have the victim’s mobile number, they could then try to register UPI on their own devices.
If they try this with several banks, the victim may receive many alerts within a short time. However, getting these alerts does not necessarily mean that all the victim’s bank accounts have been moved to another device.
Also read: Google Pixel Tag vs JioTag 2 vs Apple AirTag 2: Price, tracking, battery and more features compared
Staying safe from such scams is easy. Just make sure that you avoid scanning suspicious QR codes. Not only that but you should check the payee name before entering your UPI PIN. Make sure that you never scan a QR code to receive money, cashback or a refund.
If you’re receiving unexpected UPI registration messages, then you should immediately contact your bank and report suspected cyber fraud by calling 1930 or using the government cybercrime reporting portal.
You are also advised to check your UPI apps for unknown registrations or devices regularly. If you find any irregularities, then immediately contact the concerned app and your bank.