Mumbai Police’s cyber cell arrested three men on Sunday who investigators said operated a Telegram channel coaching kirana owners to accept forged unified payments interface confirmation screenshots, a scheme that drained small-shop ledgers across western suburbs as merchants stocked sweets and dry goods ahead of Diwali. Officers told reporters the channel had more than 2,400 members and circulated templates mimicking bank success screens that victims only discovered were fake when wholesalers demanded settlement.
How the collect scam worked
According to the first information report, organisers instructed shopkeepers to share their UPI collect-request QR codes in the channel under the pretence of “verification exercises.” Accomplices then sent doctored images showing completed payments while no credit hit the merchant account; when owners complained, moderators blamed bank delays and urged them to honour cash-on-delivery orders for high-margin FMCG bundles that never arrived.
Detectives traced cryptocurrency wallet deposits linked to premium Telegram subscriptions and seized phones they said contained chat logs instructing members to target elderly proprietors who rely on sons or daughters to verify payment notifications during evening rush hours.
Enforcement steps
The cyber cell booked the accused under provisions covering cheating and computer-related forgery, according to the police statement; courts will decide bail after remand hearings this week. Officers urged merchants to confirm credits via bank SMS or account statements rather than customer-supplied screenshots, repeating guidance the National Payments Corporation of India publishes ahead of festival seasons.
WhatsApp and Telegram compliance teams received takedown requests for channel mirrors; investigators said copycat groups reappeared within hours, a pattern that pushes police to publicise modus operandi faster than moderators delete channels.
Why kirana stores are targeted
India’s neighbourhood grocery trade still mixes cash and UPI, with thin margins on festival impulse buys. Scammers exploit trust when queues are long and owners avoid arguing with customers holding up lines. Cybercrime.gov.in helpline data show payment-fraud reports rise each October as stocking intensifies.
The Reserve Bank of India’s customer-awareness bulletins warn against sharing collect QR codes publicly; yet training reaches owners slowly in languages they prefer, leaving gaps Telegram operators exploit with Hindi and Marathi voice notes.
Platform and bank responses
Banks tightened velocity limits on new collect requests from unknown handles after similar scams in 2025, but forged screenshots bypass switch logic because victims voluntarily release goods. Payment apps added shimmer animations on genuine success screens that screenshots struggle to replicate—merchants must learn to look for those cues.
Industry groups representing FMCG distributors plan webinars with Mumbai Police speakers before Dussehra, emphasising that no brand authorised “clearance sales” requiring upfront UPI collect from kirana QR codes.
What shopkeepers should do
Officers recommend separate static QR codes for display payments and never posting the same codes in social groups. Two-person verification—one owner, one family member checking the banking app—cut losses in pilot awareness drives in Thane district last month.
For Mumbai’s western suburbs, Sunday’s arrests mark one enforcement win; the broader fight is teaching merchants that a payment screenshot is not money until the bank ledger agrees—a lesson festival season will test again this week.
Retail association outreach
Federation of Retail Traders Welfare Association chapters in Mumbai scheduled morning briefings at wholesale markets in Dadar and Vashi, distributing laminated cards that show how to verify UPI credits inside banking apps rather than gallery folders where forged JPEGs hide. Police speakers played screen recordings of Telegram chats redacted for privacy, highlighting red flags such as requests to share collect QR codes for “lucky draw” prizes.
Payment aggregators that onboard kirana stores said they would push firmware updates to soundbox devices so audio confirmations play only after switch settlement, closing a gap where some merchants disabled speakers to reduce noise during rush hours.
Local banks reopened fraud hotlines staffed in Marathi and Hindi after midnight following the arrests, a staffing shift normally reserved for New Year’s Eve sales rushes.
Prosecutors told magistrates they would seek custody to retrieve cloud backups from seized phones, arguing accomplices abroad could wipe Telegram channels if suspects warn contacts before interrogation.