⏰ 7 min read | August 13, 2026
The Uber auto scam in Mumbai is the newest reminder that a simple QR code scan can turn your phone against you in seconds. A passenger who hopped into an Uber auto in Mumbai recently found this out the hard way — and her story, first flagged by journalist Ashish Chaturvedi, is now doing the rounds as a warning for every UPI user in India. If you use QR codes to pay for autos, cabs, or street vendors on a regular basis, this one is worth five minutes of your time.
What Happened in Mumbai
Here is the short version. A woman booked an Uber auto in Mumbai, registration number MH02EF3779, for a regular ride around the city. When the trip ended, the driver showed her a QR code to collect the fare — something lakhs of us do every single day without a second thought. She scanned it like she always does. Within minutes, her phone started buzzing with a string of messages from different banks, all about UPI registration attempts she never asked for. That flood of alerts is what tipped her off that something was very wrong. The incident was shared publicly by CNBC Awaaz journalist Ashish Chaturvedi, and it quickly caught the attention of cybersecurity watchers because of how ordinary the setup looked from the outside.
What makes this case unsettling is that there was nothing unusual about the situation itself. No stranger calling with a fake offer, no suspicious link in a text message, no "you have won a prize" trap. Just a driver, a fare, and a QR code — the exact routine millions of Indians go through daily after an auto or cab ride.
How the Fake QR Code Scam Works
Most of us assume a QR code only does one thing: open a payment screen so we can enter an amount and our PIN. According to cybersecurity expert Soham, who explained the mechanics behind this incident, a rigged QR code does not have to behave that way at all. Instead of taking you to a normal "pay to" screen, a manipulated code can quietly trigger your phone to fire off a verification message in the background, without you realizing it happened.
Did You Know? That single automatic message is enough for scammers to register your UPI ID on a completely different phone, using your own mobile number, without ever needing your PIN or OTP at that stage.
Once the scammer’s device is linked to your number through UPI, they have effectively planted a foothold into your digital payment identity. It does not immediately drain your bank account, but it opens the door for follow-up fraud, since the attacker now has a registered UPI presence tied to your details. This is exactly why the victim in Mumbai got hit with a wave of "UPI registration" texts from multiple banks almost immediately after scanning the code — her number was being used to set up UPI access on a device she had never touched.
Warning Signs You Should Never Ignore
The good news is that this kind of scam is loud, not silent. It leaves a trail of alerts that most victims notice within minutes, which is exactly what happened here. Keep an eye out for these red flags every time you pay through a QR code:
- Multiple SMS alerts from different banks about UPI registration right after scanning a code.
- App notifications about a "new device" being linked to your UPI ID.
- A QR code payment screen that looks slightly off, blurry, taped over an older code, or does not show the expected merchant or driver name.
- Being asked to scan a code to "receive" money, a refund, or cashback — genuine incoming payments never need a PIN or a scan.
- A payment app that suddenly asks you to re-verify or re-register your UPI account without you initiating it.
None of these signs require any technical knowledge to spot. They are just things worth noticing in the thirty seconds after you tap "scan."
What to Do If You Scan a Fake QR Code
If you ever find yourself in a similar spot, speed matters more than panic. Here is the sequence experts recommend:
- Stop immediately. Do not enter your UPI PIN under any circumstances, even if the app prompts you to "confirm" something.
- Check your UPI app. Open the linked devices or manage accounts section and look for any device or registration you do not recognize.
- Call 1930. This is India’s national cybercrime helpline, and it is built exactly for moments like this.
- File a complaint online. Use the government’s official cybercrime reporting portal to log the incident formally.
- Inform your bank. Ask them to flag your account and watch for any unusual UPI activity tied to your number over the next few days.
Acting within the first hour genuinely improves your odds of stopping further misuse, so do not wait to "see if anything happens."
How to Stay Safe From UPI QR Scams
You do not need to give up on QR payments altogether — they are still one of the most convenient things about paying digitally in India. You just need a few habits that take seconds but close most of the loopholes scammers rely on.
- Always check the payee name that pops up after scanning, before entering your PIN. If it does not match the driver, shop, or person in front of you, cancel the transaction.
- Never scan a QR code to receive money. Receiving money never requires scanning anything.
- Avoid scanning codes that look stuck-on, printed separately, or pasted over an existing sticker on a vehicle or counter.
- Turn on transaction notifications for every bank account and UPI app you use, so you catch unusual activity the moment it happens.
- Periodically check your UPI app’s device management section for anything you do not recognize, even if nothing seems wrong.
This particular scam works because it hides inside a completely routine action. The fix, thankfully, is just as routine — a five-second glance at the payee name before you tap confirm.
Scam Snapshot
| Specification | Details |
|---|---|
| Scam Type | Fake QR code triggering unauthorized UPI registration |
| Location Reported | Mumbai, India (Uber auto, reg. no. MH02EF3779) |
| Date Reported | August 12, 2026 |
| Method Used | Rigged QR code sends a verification message from the victim’s phone automatically |
| First Warning Sign | Multiple bank SMS alerts about UPI registration within minutes |
| Reporting Helpline | 1930 (National Cybercrime Helpline) |
Cost of Ignoring This
| Item | Details |
|---|---|
| Original Price | Not applicable — this is a safety alert, not a product |
| Current Price | Free to read, but a moment of carelessness could cost your entire UPI access |
| Bank Card Offer | Not applicable — no purchase involved |
| EMI | Not applicable |
| Exchange | Not applicable — only exchange here is your caution for peace of mind |
Frequently Asked Questions
A woman riding in a Mumbai Uber auto was shown a fake QR code by the driver after her trip ended. Within minutes of scanning it, she started receiving multiple bank messages about UPI registration attempts on devices she did not recognize.
Instead of opening a normal payment page, a rigged QR code can trigger your phone to send a verification message on its own. Scammers use that message to register UPI on their own device using your registered mobile number, effectively hijacking your UPI identity.
The biggest giveaway is a sudden flood of SMS or app alerts about UPI registration or device linking that you never initiated, especially right after scanning a QR code from a stranger, driver, or vendor.
Do not enter any UPI PIN. Close the payment app, check your UPI app for unknown linked devices, call the national cyber helpline at 1930, and file a complaint on the government cybercrime portal right away.
A QR code by itself cannot pull money out of your account, since a PIN is needed for that. But a malicious code can trick your phone into sending registration texts, which lets fraudsters set up UPI access on their own device using your number, setting up a bigger scam later.
The Verdict
The Uber auto scam in Mumbai is not really about Uber, autos, or even this one victim — it is about how much trust we place in a routine tap-and-scan action every single day. The fix does not require you to stop using UPI or start distrusting every driver you meet. It just means slowing down for a few seconds: check the payee name, never scan to "receive" money, and treat a sudden wave of bank alerts as your cue to act fast, not shrug it off. Small habits like these are what stand between a normal auto ride and a UPI headache that follows you home.
Want more real-world tech safety breakdowns like this one, explained without the jargon? Head over to JatinTechTalks for more stories that help you stay a step ahead of scammers.
No comments:
Post a Comment