In short
A legitimate-looking QR code has been replaced or altered to redirect the victim elsewhere The objective is typically to redirect payment or steal login/financial information through a malicious destination.
What it is
The code appears to lead to an expected payment or service destination. The victim is then pushed to scan the tampered QR and enter login/payment details or complete a payment.
How it starts
A legitimate-looking QR code has been replaced or altered to redirect the victim elsewhere.
What they tell you
The code appears to lead to an expected payment or service destination
What they want you to do
Scan the tampered QR and enter login/payment details or complete a payment
How you lose money
redirect payment or steal login/financial information through a malicious destination
What happens next
After the first successful step, the fraudster may demand more money/information, deepen account or device access, or disappear.
Warning signs
trust | habit | QR tampering | malicious redirect | phishing site
Where this is documented
India — officially documented by an Indian authority/regulator
How to avoid it
Remember that a UPI PIN authorizes a debit; verify collect requests and QR codes before approving; do not install screen-sharing or SMS-forwarding apps at a stranger's request.
If it already happened
Contact the bank/payment provider immediately if money moved; report financial cyber fraud promptly via 1930 and cybercrime.gov.in; preserve messages, transaction IDs, phone numbers and URLs.