Last week, Dilip Bhandari, 30, decided to put his mattress up for sale on an online platform for second-hand goods. Within hours, he was contacted by a man, Lakshman Singh, who claimed to be an army personnel and expressed willingness to buy the mattress for ₹23,500. He then forwarded Bhandari a link to a Quick Response (QR) code and asked him scan it so that he could transfer the money into his account.
Bhandari was a little puzzled by this mode of transaction, but saw no harm as he wasn’t giving out his bank details or other sensitive information. However, seconds after he scanned the QR code, he got a message that ₹10,000 had been debited from his account. He immediately called Singh, who apologised and said it was a mistake. He requested him to scan the code again promising to wire the ₹10,000 along with ₹23,500 to his account.
“Bhandari scanned the code again only to see another ₹40,000 disappear from his bank account. When Bhandari tried to call Singh, his mobile phone was not reachable. He filed a complaint,” said the police.
This is not an isolated case. In the last seven days, the police have received as many as five complaints from citizens who have been duped after being asked to scan a QR code.
In a majority of the cases, the conmen claimed to be Indian Army personnel. “These conmen are cashing in on the trust and respect citizens have for the Indian army,” said the police, who are trying to get to the bottom of the scam.
A QR code is like a bar code, an image that can be read by a machine. It allows people to make payments by scanning the image and confirming the transaction. Many apps and e-wallets have this feature for easy payment. The police suspect that in all these cases, the QR codes contained malware that drained information from smartphones.
In another case, a 23-year-old lost ₹1.1 lakh. The conman introduced himself to the victim, Niharika G., as an army personnel and offered to buy a table that she had put up for sale on an online platform.
“The accused had not only taken money from her account but also accessed her father’s phone. An amount of ₹70,000 was withdrawn from his account. We suspect that the accused either accessed Niharika's father phone number through her phone, or she may have shared the contact number of her father with the accused. We are probing the case,” said the police. The police believe that the fraudsters are using online marketing platforms to target people. Cyber crime officials said they would be consulting banks to see if security features can be upgraded for online transactions.
Other cases
All the victims were selling personal items on an online site for second-hand goods
1) Puneeth placed an ad to sell his bike and was contacted by a man who identified himself as Paramjith Singh who offered to buy it. After chatting for a while, Paramjith told him that he would send the cash online and asked him to scan a QR code, which he would send for easy transfer of money. As soon as the QR code was scanned, a sum of ₹24,800 was withdrawn from Puneeth’s account.
2) Ankur Dutta, 30, a private firm employee, lost ₹46,000. He was trying sell his motorcycle online. The buyer, Srikanth, claimed to be an army personnel. He sent him a QR code which Ankur scanned. The moment the code was scanned ₹46,000 was withdrawn.
3) Mudith S., 31, lost ₹1.8 lakh when he tried to purchase a second-hand car online. The seller asked him to pay ₹10,000 as an advance to book the car, which he did via a routine online transaction. A few minutes later, another man called him and told him to scan a QR code to pay a security deposit for the car. When Mudith obliged, he got an alert that ₹1.8 lakh had been removed from his account.
