QRJacking
Definition
Physical replacement or overlay of a legitimate merchant QR (typically a UPI QR at a shop counter) with a fraudster's QR pointing to the attacker's VPA. Customers scan the wrong code and the funds settle to the attacker; the merchant only notices at end-of-day reconciliation.
- Method
- Physical overlay of a fraudulent QR code
- Common target
- UPI merchant QR codes
- Detection point
- End-of-day merchant reconciliation
- Loss direction
- Funds settle to attacker's VPA
Common questions
Why is QRJacking hard for a merchant to detect in real time?+
The overlay looks visually identical to the legitimate QR sticker, and the customer's payment app confirms a successful transaction, so nothing on either side signals a problem until the merchant reviews settlement records against expected sales.
What digital evidence typically supports a QRJacking investigation?+
Investigators examine the payment app's transaction logs and VPA destination on the victim's phone, CCTV footage of the counter showing the overlay sticker's presence, and UPI transaction records from the payment service provider identifying the attacker's account.
How does QRJacking differ from a phishing QR code sent electronically?+
QRJacking requires physical access to tamper with a real-world payment point, while a phishing QR sent by message or email relies on the victim scanning a digital image, so the two involve different attack surfaces and evidence trails.
Related terms
- CLI Spoofing
- Caller Line Identification spoofing: the caller forges the Calling Party Number sent in the SS7 IAM or SIP From header so the...
- IMSI Catcher
- A rogue base station (commercial: Stingray, Hailstorm, KingFisher; research: USRP plus srsRAN or YateBTS) that impersonates a cellular cell, forces nearby phones...
- Phreaking
- Tone-based exploitation of the public switched telephone network, pioneered in the 1960s and 1970s. The 2600 Hz tone, generated by a toy...
- SIM Swap
- Fraud pattern where the attacker convinces the telco to port the victim's MSISDN to a SIM the attacker holds. Once active, the...
- TRAI 24-Hour Cool-Off
- Telecom Regulatory Authority of India directive (2018 and tightened thereafter) requiring that after a SIM swap the new SIM cannot be used...