How to Protect Your Business From Online Fraud: A Shopkeeper's Guide

This guide is for shopkeepers, restaurant owners, service providers and small traders in Bihar who take payments by UPI and use WhatsApp for business. It explains the online frauds that target shopkeepers most often, simple habits that stop them, and exactly how to report fraud through the 1930 helpline and cybercrime.gov.in if something goes wrong.

Fraudsters love small businesses because owners are busy, counters are crowded, and most payments are digital. A single mistake can wipe out a week's profit. The good news: almost every scam below depends on one trick, and once you know the trick, you can spot it.

Fake payment screenshots and fake payment apps

How it works: A customer buys goods, taps on their phone, and shows you a "payment successful" screen. Sometimes it is a screenshot, sometimes a fake app that makes a realistic success screen with a sound. No money reaches you. This is common at mobile shops, jewellers, and busy counters during festivals.

How to stop it:

• Treat only your own bank or UPI app as proof. Open the transaction history and check the exact amount and time.
• Use a soundbox linked to your own merchant account. It announces only real credits.
• Never accept an SMS from a mobile number as proof. Bank credit SMS come from the bank's sender ID, not a 10-digit number.
• For big bills, wait for the credit before handing over goods.

Our guide on UPI and QR payments for small businesses covers safe settlement habits in more detail.

UPI "request money" and PIN tricks

How it works: A caller says they want to pay an advance or refund and sends a request on UPI. You enter your PIN thinking you will receive money, but the money leaves your account instead.

NPCI stopped person-to-person "collect requests" on UPI from 1 October 2025 to curb this fraud, but tricks around the PIN have not disappeared. Scammers now send QR codes on WhatsApp ("scan to receive payment") or send merchant payment requests.

The one rule to remember: you never need to enter your UPI PIN or scan a QR code to receive money. Entering a PIN always means money is going out.

The fake "army officer" bulk order scam

How it works: Someone calls claiming to be from the army, CRPF, BSF or a government office nearby. They place a large order (sweets for a function, 200 plates of food, cement, AC units, tent-house items) and sound very disciplined and polite. Then comes the twist:

• They say army payments go through a special process and ask you to "first send ₹1 to verify your account"
• Or they send a QR code and ask you to scan it to "receive" the advance
• Or they "overpay" and ask you to return the extra amount

Restaurants, sweet shops, caterers and tent houses across the country, including in Bihar, have reported such calls.

How to stop it: Genuine buyers pay you; they never ask you to pay them first. Ask for a written purchase order and visit the unit or office before cooking or dispatching a large order. If they refuse or pressure you, hang up.

Fake KYC, GST, electricity and bank calls

How it works: You get an SMS or WhatsApp saying:

• "Your electricity will be disconnected tonight. Call this officer."
• "Your GST number is blocked. Pay penalty via this link."
• "Your bank KYC has expired. Update now or account will be frozen."
• "Your UPI merchant account is suspended."

The caller asks you to install an app (often a screen-sharing app), share an OTP, or pay a small "update fee." With screen sharing, they can see your OTPs and empty your account.

How to stop it:

• Never install apps like AnyDesk or TeamViewer because a caller asks you to
• Never share OTP, PIN, CVV or passwords with anyone, including "bank staff"
• Verify electricity dues on the official discom website or app, GST notices on the GST portal, and bank issues by visiting your branch
• Government departments do not collect penalties through a personal UPI ID or WhatsApp link

You can report such fraud calls and messages on the Chakshu facility of Sanchar Saathi, even if you did not lose money.

QR code sticker swap at your counter

How it works: Someone pastes their own QR sticker over yours, or swaps the printed standee when the counter is busy. Your customers pay the fraudster for days before you notice.

How to stop it:

• Laminate your QR and fix it where staff can see it all the time
• Check every morning that the name shown on scanning is your business name
• Use a soundbox so you notice when payments are not announced
• Ask customers to confirm your shop name on their screen before paying

Our Hindi guide on UPI QR payment precautions has a simple checklist for staff.

Fake Google listing edits and fake customer care numbers

How it works: Fraudsters "suggest an edit" to your Google Business Profile and replace your phone number with theirs. Customers searching for your shop call the fraudster, who asks for advance payment for bookings or delivery. Some also create fake "customer care" numbers for brands and service centres.

How to stop it:

• Claim and verify your Google Business Profile so you control edits; our Google Business Profile guide shows how
• Check your listing every week for changed phone numbers or timings
• Keep your number consistent everywhere, including your Bihar Directory listing, where only you can edit your page
• Tell regular customers to call only the number printed on your bill

Fake supplier, loan and job offers

A few more scams to watch for:

• Fake supplier deals: very cheap stock offered on social media, with full advance payment. Buy from known distributors or visit before paying.
• Instant loan apps: apps that give small loans and then harass you by accessing your contacts. Borrow only from banks, NBFCs and apps linked to RBI-regulated lenders.
• "Part-time job" and task scams sent to staff: small payouts first, then large "deposits." Warn your employees.
• Fake business listing or advertising agents who promise "top ranking" for a fee. Be careful with anyone who asks for money to get you verified.

Train your staff: a 5-minute counter checklist

Put these rules on a card near the billing counter:

1. Confirm every payment in the app or soundbox, never by screenshot.
2. We never enter a PIN or scan a QR to receive money.
3. No OTP, PIN or password is shared with anyone on call.
4. No screen-sharing apps are installed on the shop phone.
5. Large orders from unknown callers need the owner's approval.
6. Check the QR sticker every morning.
7. Any doubt: hang up and call the owner.

How to report online fraud: 1930 and cybercrime.gov.in

If you lose money, speed matters. The sooner the complaint is registered, the better the chance that banks can freeze the money in the fraudster's account.

1. Call 1930 (National Cyber Crime Helpline) immediately and give details of the transaction.
2. File a complaint on cybercrime.gov.in under financial fraud. Note the acknowledgement number.
3. Call your bank's official helpline (from the back of your card or the bank's official website) to block the card, UPI or account.
4. Save evidence: screenshots of chats, caller numbers, UTR or transaction IDs, time and amount.
5. Visit your local police station or cyber police station with the acknowledgement if asked.

Report quickly also to your bank in writing; RBI rules limit a customer's liability for unauthorised electronic transactions when they are reported promptly.

Next steps

Share this page with your family members and staff who handle the counter, and put the checklist near your cash box. Keep your business details accurate everywhere customers look: list your business free on Bihar Directory with your correct phone number and payment methods. Also read our WhatsApp Business guide to set up a verified-looking business profile, and the Hindi version of this guide, ऑनलाइन ठगी से व्यापार कैसे बचाएँ.

This is general information, not legal advice. For fraud, call 1930 or file a complaint at cybercrime.gov.in.