Osaka Prefectural Police logged 4,200 PayPay QR skimming and sticker-swap reports in the third quarter, roughly triple the same period last year, as summer festivals and street vendors multiplied unattended payment codes across the city's entertainment districts.
How the scams work
Fraudsters overlay counterfeit QR stickers on legitimate merchant codes or replace laminated sheets at food stalls when owners turn away. Payments route to mule accounts before settlements reach the intended shop. PayPay's merchant app shows recipient names, but tourists and late-night customers often confirm payment without reading kanji account labels, investigators said in a quarterly briefing Wednesday.
Reports spiked in Dotonbori and Tenma alley clusters where part-time staff rotate frequently and codes sit outdoors in humidity that peels tape edges, making swaps harder to spot. Police classified 62 percent of Q3 reports as "sticker overlay" cases, 28 percent as completely replaced printouts, and the remainder as phishing links sent through fake discount flyers near codes.
Platform and merchant responses
PayPay expanded merchant reprint kits with holographic borders and began piloting dynamic QR tokens for registered festivals in cooperation with Osaka city event offices. Vendors who register pop-up stalls receive daily rotating PNG codes through a city portal, reducing value in static sticker fraud. Adoption remains uneven among unregistered street sellers who treat QR payments as informal add-ons to cash boxes.
Osaka's cyber unit assigned six additional analysts to festival season after Kansai-area rail operators reported unrelated phishing waves, though PayPay QR cases dominate mobile payment fraud filings in the prefecture.
Consumer losses and recovery
Documented consumer losses tied to QR swaps reached 186 million yen in the quarter, police said, with median individual loss near 12,000 yen. PayPay's unauthorized transaction dispute window requires reports within 60 days; recovery rates improve when customers photograph codes before paying, a habit police promoted through convenience-store poster campaigns.
Banks coordinating with PayPay on mule account freezes said average shutdown time shortened to four days from seven days in 2025, but overseas mule routes still stall restitution when funds move to crypto exchanges within hours.
What changes in October
Prefectural police will deploy plainclothes patrols during October sports and music events, scanning for duplicate QR layers with UV pens merchants can borrow from koban substations. PayPay plans a merchant webinar on October 8 covering dynamic codes and staff verification scripts when customers show payment confirmation screens.
Analysts note QR fraud remains smaller in yen terms than telephone impersonation losses, but the growth rate worries city tax offices that promote cashless stalls for event licensing. Osaka's tally is a bellwether for other metros running autumn festivals on similar payment rails.