Indian Police Detect Petrol Pump QR Codes Used to Cash Out Cybercrime Proceeds

Chitrakoot Police have arrested three men from Prayagraj accused of converting cyber-fraud credits into cash at two petrol pumps by paying large sums to the pumps' merchant QR codes and taking the difference after buying fuel.

Superintendent of Police Arun Kumar Singh announced the arrests on 5 November 2026. The district Cyber Cell and Police Station Raipura, working under Additional Superintendent of Police and Nodal Officer for Cyber Crime Piyush Kant Rai and Circle Officer (Mau) Fahad Ali, arrested the three at Bandhana More, Jayanti Bandh, Hanumanganj, in the Raipura police station area at 6:45 pm on 4 November. Police recovered two mobile phones and seized a Hero Splendor Plus motorcycle used in the crime, chassis number MBLHAW476THL5046, under Section 207 of the Motor Vehicles Act.

Police said the gang hit both pumps on 2 November 2026, and that the credits to the merchant QR codes came from hacked mobile phones in Chengalpattu, Tamil Nadu, and Jaisalmer, Rajasthan. Two other accused remain wanted. Police have registered two cases at Police Station Raipura.

The Accused

Arrested

• Siddharth Adivasi, son of Samarjeet Adivasi, of Osa, police station Kaudiyara, Prayagraj
• Priyanshu, son of Udayraj, of Ikauni, police station Kaudiyara, Prayagraj
• Nitin Pratap Singh, son of Rajendra Pratap Singh, of Ikauni, police station Kaudiyara, Prayagraj

Wanted

• Raj Mishra, son of unknown, of Karchhana, Prayagraj. The short police note listed his residence as unknown; the detailed note and media reports name Karchhana.
• Alok Shukla, son of Manoj Shukla, of village Osa, post Beura, police station Kaudiyara, district Prayagraj

Police said a search of Siddharth Adivasi yielded one Oppo phone and a search of Priyanshu yielded one Vivo phone.

How the Fraud Worked

According to the police press note, the method was simple. The accused bought a modest quantity of petrol or diesel, transferred a much larger sum to the pump's merchant QR code, claimed the extra payment was a mistake, and asked the salesman to deduct the fuel charge and hand over the rest in cash. Police said a petrol pump's QR code is a merchant QR and can accept much larger credits than an ordinary person-to-person transfer, which is why the gang used it.

Speaking on video at the press conference, SP Arun Kumar Singh described the same sequence: the men get fuel filled, say they will pay online, transfer about Rs 65,000, then say it happened by mistake, that Rs 65,000 arrived instead of Rs 650, and take the balance in cash.

Kamala Filling Station, Deudha

On 4 November, Ravikant Singh Patel, a petrol-pump operator of Manauri (मनोरी), Prayagraj, told Police Station Raipura that at 7:48 pm on 2 November, at Kamala Filling Station in Deudha, the three arrested accused had Rs 650 of petrol filled and deliberately transferred Rs 65,000 to the pump's QR code. At the same time, police said, a call from Raj Mishra and Alok Shukla came through on Siddharth Adivasi's phone, saying the Rs 65,000 had gone to the pump QR by mistake. Raj Mishra asked the salesman to deduct Rs 650 and return the rest. The salesman handed Rs 64,350 in cash to Siddharth Adivasi.

Police said the pump's bank account was put on hold on 3 November. That evening the same three men returned and told the salesman they would transfer Rs 1,00,000 and to keep the cash ready. The owner, Ravikant Singh Patel, arrived, grew suspicious and began questioning them. They fled on a motorcycle. He informed police at Chowki Hanumanganj, Police Station Raipura.

Raipura Filling Station, Bodipokhari

Also on 4 November, Devraj Yadav, son of Brijnarayan Yadav, of Kalapur, police station Unj, district Bhadohi, told Police Station Raipura that at about 9:30 pm on 2 November, Raj Mishra came to Raipura Filling Station, Bodipokhari. He said canal work was under way and that he needed diesel and cash. Police said he took diesel worth Rs 70,495, transferred Rs 2,08,696 to the pump's QR code, and took Rs 1,38,200 in cash. That pump's account was then put on hold as well.

Together, the two visits extracted Rs 2,02,550 in cash and Rs 71,145 in fuel, or about Rs 2.73 lakh.

What the Investigation Found

SP Arun Kumar Singh directed the in-charge of the Cyber Cell and the in-charge of Police Station Raipura to investigate. Inspector Vijay Kumar Singh, in-charge of the Cyber Cell, with Constable Pranat Kumar and Constable Sarvesh Kumar, obtained the bank transaction records. Police said both incidents checked out.

The Cyber Cell's technical analysis, set out in the police note, found that credits of Rs 2,08,696 at Raipura Filling Station were sent from a hacked mobile phone in Jaisalmer, Rajasthan, in several transactions, after which cash was taken. At the Deudha pump, Rs 65,000 was sent from a hacked phone in Chengalpattu, Tamil Nadu, and cash was taken the same way.

On video, the SP said the hacked account used for one of the payments was in South India. That victim, he said, complained to cyber authorities, after which a lien was placed on the petrol-pump owners' account. The owner realised the men might return; when they did, he informed the police.

During questioning, police said, the three arrested men stated that for the past three months, at the instance of Raj Mishra and Alok Shukla, they had been turning fraud proceeds into cash at petrol pumps in the Kaudiyara, Handia (हड़िया) and Naini police station areas of Prayagraj by the same method. In return they received petrol for the motorcycle and Rs 2,000 to Rs 3,000 for expenses on each transaction. They said that on 2 November their associates used already hacked mobile phones to send money to the two Chitrakoot pumps' QR codes, after which the pump accounts were put on hold, and that they were caught when they came back for another round because the owners had grown suspicious.

Police said the investigation so far shows the gang committed cyber fraud on a large scale, and that efforts are on to arrest the other accused. On video, the SP said the two wanted men are also from Prayagraj and would be arrested soon. Asked whether the money had been recovered, he said the accused had taken the amount in cash, that the relevant account remains under lien, that further recovery would follow once the lien is lifted, and that some of the money taken has already been recovered. He did not give a figure. He also said that because this was organised crime, the investigation would act against anyone involved, whether from outside or inside. That is not a finding that pump staff were complicit.

Cases have been registered at Police Station Raipura as:

• Crime No. 294/2026, under Bharatiya Nyaya Sanhita sections 318(4) (cheating), 319(2) (cheating by personation), 316(2) (criminal breach of trust), 317(2)(5) (stolen property), 3(5) (common intention) and 62 (attempt), and Section 66D of the Information Technology Act, 2000 (cheating by personation using a computer resource)
• Crime No. 295/2026, under BNS sections 318(4), 319(2), 112(2) (petty organised crime), 317(2) and 3(5), and IT Act Section 66D

The team that made the arrests, according to the short police note, was Sub-Inspector Harikesh Rai, Chowki in-charge, Hanumanganj, Police Station Raipura, and Head Constable Ashok Kumar.

Merchant QR Codes as a Cash-Out Rail

The Chitrakoot case is not only a local cheating story. It is a working example of product abuse: a legitimate banking and payments product, the merchant QR code linked to a petrol pump's current account, used to layer and cash out money that police say was moved from hacked accounts far away.

In the UPI system, a person-to-person transfer is tightly limited and closely watched. A person-to-merchant (P2M) credit to a fuel retailer's QR code is meant for a real sale. It can carry a much larger value, which is what police themselves noted. Once the credit appears to have landed, a salesman who is authorised to give change can be talked into paying cash against it. If the paying account is later frozen after the remote victim complains, the pump is left with a hold on its account and a hole in the till. The gang, meanwhile, has converted stolen digital value into banknotes.

Police did not name the banks, the UPI apps or the payment service providers. Nothing below is a finding about this pair of accounts. It is the monitoring and compliance test that this typology sets for every acquiring bank and every merchant PSP.

What Transaction Monitoring Should Catch

The Reserve Bank's Master Direction on Know Your Customer, 2016, updated as on 14 August 2025, makes monitoring of transactions one of the four elements of a regulated entity's KYC policy. Paragraph 35 requires ongoing due diligence so that transactions stay consistent with what the bank knows about the customer, the customer's business, the risk profile and the source of funds. Paragraph 36 says the following must be monitored:

• large and complex transactions, and those with unusual patterns, that are inconsistent with the customer's normal activity and have no apparent economic rationale
• transactions that exceed the thresholds set for that category of account
• high turnover that does not match the balance kept in the account
• third-party cheques or drafts paid into an account, followed by large cash withdrawals

Paragraph 36 also allows banks to use artificial intelligence and machine learning for that monitoring. Paragraph 50 requires robust software that raises alerts when transactions do not match the customer's risk category and updated profile.

A petrol-pump current account receiving a Rs 65,000 or Rs 2,08,696 inbound UPI credit from a first-time payer in Tamil Nadu or Rajasthan, at night, against a local fuel sale, then showing a cash payout, sits inside that paragraph 36 list even though the instruments here are UPI credits rather than paper cheques. The digital analogue of "third-party instrument in, cash out" is exactly this pattern.

Red flags that transaction-monitoring systems should already be able to raise on a fuel-retail merchant account include:

• Velocity: several unrelated P2M credits from new payers in a short window, as at Bodipokhari, where police said Rs 2,08,696 arrived in several transactions
• Payer-location mismatch: a device or account in Jaisalmer or Chengalpattu paying a pump in rural Chitrakoot
• Ticket-size mismatch: a Rs 65,000 credit against a Rs 650 fuel sale, or a Rs 70,495 diesel sale to a walk-in customer at 9:30 pm
• Round figures: Rs 65,000, and the attempted return visit for Rs 1,00,000
• Credits followed quickly by cash leaving the business, whether as a "refund" or a withdrawal
• A hold or lien arriving from a cyber-fraud complaint shortly after a large inbound credit, which is itself a reason to review the merchant's recent payouts

None of this required a new law. It required the acquiring bank to treat a fuel retailer's merchant QR as a cash-intensive product and to compare inbound P2M activity with the merchant's known ticket size, hours, location and customer mix.

The Rules That Already Apply

Suspicious transaction reports. Section 12 of the Prevention of Money-laundering Act, 2002, requires every reporting entity to maintain transaction records that allow each transaction to be reconstructed, and to furnish prescribed information to the Director, Financial Intelligence Unit-India (FIU-IND). The Prevention of Money-laundering (Maintenance of Records) Rules, 2005, define a suspicious transaction as one that, to a person acting in good faith, may involve proceeds of crime, appears unusually complex, or appears to have no economic rationale or bona fide purpose, including attempted transactions, whether or not in cash. The reporting entity's Principal Officer must send a suspicious transaction report to FIU-IND promptly, and not later than seven working days after being satisfied that the transaction is suspicious. Chapter VIII of the KYC Master Direction, paragraphs 47 to 50, repeats that duty and forbids the bank from restricting an account merely because an STR has been filed.

Fraud-risk management. On 15 July 2024 the Reserve Bank issued the Master Directions on Fraud Risk Management in Commercial Banks (including Regional Rural Banks) and All India Financial Institutions (RBI/DOS/2024-25/118). They set a board-level framework for prevention, early detection and timely reporting of fraud to law-enforcement agencies and to the Reserve Bank, and they replace the 2016 fraud-classification directions. The Reserve Bank later issued the consolidated Reserve Bank of India (Commercial Banks – Fraud Risk Management) Directions, 2026 on 31 July 2026. A large unexplained P2M credit into a merchant current account, followed by cash out and a cyber-fraud hold, is the kind of incident that framework is meant to surface early. Police have not said whether any bank in this case classified the events as fraud or reported them under those directions.

Mule accounts. The Reserve Bank Innovation Hub built MuleHunter.AI, an artificial intelligence tool that studies patterns of mule-account behaviour. In a Rajya Sabha reply circulated by the Press Information Bureau on 24 March 2026, the Minister of State for Finance, Pankaj Chaudhary, said the Reserve Bank had rolled out MuleHunter.AI to detect mule accounts, that it was then live in 26 banks and being scaled up, and that banks had been advised to deploy robust software for real-time monitoring and to use artificial intelligence and network analytics against mule networks. Whether any payer account in this case had been, or should have been, flagged as a mule is not known from the police material.

1930 and the Suspect Registry. When a victim reports financial cyber fraud on the 1930 helpline or at cybercrime.gov.in, the Indian Cyber Crime Coordination Centre (I4C) routes the complaint through the Citizen Financial Cyber Fraud Reporting and Management System so that banks can try to place a hold on the suspected credits. That is the mechanism that matches what police and the SP described: a remote victim complained, and the petrol-pump accounts were put on hold. I4C also launched a national Suspect Registry on 10 September 2024, sharing cybercrime identifiers with banks and financial institutions so that suspicious customers and transactions can be declined. Police have not said whether the paying accounts in this case appeared on that registry.

Merchant onboarding. The products abused here sit with the acquiring side as much as with the victim's issuing bank. The Reserve Bank's Master Direction on Regulation of Payment Aggregators dated 15 September 2025 (RBI/DPSS/2025-26/141), which consolidates the 17 March 2020 Guidelines on Regulation of Payment Aggregators and Payment Gateways, requires a payment aggregator to carry out customer due diligence of its merchants under the KYC Master Direction, to run background checks, and, after onboarding, to monitor the merchant's transactions to ensure they match the merchant's business profile. The same direction sets responsibilities for the acquiring bank. NPCI's UPI merchant-ecosystem circulars similarly place onboarding, merchant category codes and monitoring on the payee payment service provider. A bank that issued a merchant QR directly to a petrol pump owes the same ongoing due diligence on that current account under paragraphs 35 and 36 of the KYC Master Direction, whether or not a payment aggregator sat in the middle.

The pumps in this case appear as complainants, not as accused. A salesman who pays cash against a QR credit he believes is a genuine overpayment is usually the victim of social engineering. Product abuse does not require the merchant to be a willing mule. It only requires that the product, a high-limit merchant collecting account that can be settled in cash at the counter, is available to someone who knows how to push stolen value through it.

What Should Change

1. Acquiring banks should treat fuel-retail current accounts as cash-intensive. Monitoring scenarios should include first-time P2M payers, payer locations far from the outlet, credits several times the merchant's usual ticket, round-figure credits, and inbound UPI followed quickly by cash leaving the business.
2. The payee PSP should alert the merchant in real time when a payer is new, distant or far above the average ticket for that merchant category code, and should warn the salesman not to pay cash against that credit.
3. Merchant rules should be blunt: do not refund a UPI credit in cash. Send the extra back on the same UPI rail after settlement is confirmed and no hold has been placed.
4. A burst of third-party UPI credits into a merchant account, immediately converted to cash, should be escalated for a suspicious transaction report to FIU-IND under the KYC Master Direction and the PMLA rules, even if the merchant later files a police complaint.
5. Payer accounts that send large first-time P2M credits to cash-intensive merchants should be screened against the I4C Suspect Registry and against mule-detection tools such as MuleHunter.AI.
6. The 1930 and Citizen Financial Cyber Fraud Reporting and Management System hold should reach the beneficiary merchant's bank fast enough to stop a cash refund at the counter, not only to freeze what is left after the cash has gone.
7. NPCI and acquiring banks should treat "small fuel sale, large QR credit, cash refund" as a named typology, with step-up confirmation for first-time P2M payers above a set threshold at fuel merchant category codes.

Advice for Pump Operators and Customers

• Do not hand over cash because a customer says too much money went to the QR code. Ask them to reverse the extra payment on UPI.
• A successful-looking UPI credit can still be pulled back or placed on hold if the paying account was hacked or reported on 1930.
• Report suspected fraud at once on 1930 or at cybercrime.gov.in, and tell the bank that issued the merchant QR.
• Customers whose UPI or banking app has been taken over should report on 1930 immediately, before the money is cashed out through a merchant.