Exposing Qwiklabs Email Misuse in Sneaky Payment Scams involving setting up UPI merchant accounts

CloudSEK details a payment fraud vector where attackers exploit Qwiklabs temporary Gmail access to register Google Pay merchant accounts without phone verification, enabling brand impersonation and deceptive UPI VPAs/mandates that appear legitimate to victims; the report outlines the workflow, attacker advantages, user safety steps, and recommended controls for payment providers.