QRJacking

Physical replacement or overlay of a legitimate merchant QR (typically a UPI QR at a shop counter) with a fraudster's QR pointing to the attacker's VPA. Customers scan the wrong code and the funds settle to the attacker; the merchant only notices at end-of-day reconciliation.