According to the Power Division, fraudsters are placing or circulating deceptive QR codes that redirect users to unofficial links, where victims are gradually pushed into handing over sensitive details under the impression they are registering for subsidy benefits.

The scam reportedly unfolds in stages. Consumers are first encouraged to scan a QR code and follow a link claiming to verify eligibility for electricity relief. They are then asked to fill in personal information step by step before finally submitting a six digit verification code effectively handing control of sensitive data to cybercriminals.

Officials say the operation is sophisticated enough to appear legitimate, especially to users unfamiliar with digital security tactics.

The government has now clarified that entering electricity billing information on external websites or unofficial forms is neither required nor legally authorized under the current subsidy process. Law enforcement agencies have also been alerted as authorities attempt to track those behind the scheme.

What makes this scam particularly dangerous is its timing. Rising electricity costs and growing public dependence on relief programs create the perfect environment for digital manipulation. In moments of financial pressure, people tend to trust anything that appears connected to government assistance.

And cybercriminals know that. The incident highlights a broader shift in online fraud tactics across South Asia, where scammers are increasingly blending technology with everyday public services. QR codes once marketed as fast and convenient tools are now becoming digital bait in phishing operations targeting ordinary citizens.

Security experts often describe this kind of fraud as “social engineering”: not hacking systems directly, but hacking human trust.

For consumers, the warning is straightforward but urgent: do not scan unofficial QR codes, avoid entering personal data on unknown links, and never share verification codes sent to your phone. Because in today’s digital economy, a single scan can sometimes open far more than a webpage.