UPI QR codes have changed how India pays. From a chai stall to a big showroom, you scan, enter the amount, type your PIN and you are done. Scanning a UPI QR code is safe when you understand one simple rule, and most QR payment fraud depends on people not knowing it. This guide explains how UPI QR codes work, the scams to watch for, and the checks to make before every payment.
The one rule: you never need your PIN to receive money
Your UPI PIN is only for sending money out of your account. You do not need to scan a QR code or enter your PIN to receive money, a refund or a prize. If anyone asks you to “scan this code to receive payment”, it is a scam, every time. Real refunds and payments arrive in your account without you doing anything.
What is inside a UPI QR code?
A UPI QR code is a short link that your UPI app understands. A simple one looks like this:
upi://pay?pa=shopname@okbank&pn=Gupta%20Stores&cu=INR
- pa is the payee address, the UPI ID that receives the money.
- pn is the payee name that the code shows. Anyone making a code can type any name here, so it can't be trusted on its own.
- am is an optional fixed amount. If it is present, your UPI app fills in the amount for you.
When you scan it, your UPI app looks up the UPI ID with your bank and shows the name registered to that account. That registered name is the one to trust, not the name printed on a sticker.
Common UPI QR code scams
- “Scan to receive money.” Someone buying your old phone or furniture online sends a QR code and says it will send you the payment. When you scan it and enter your PIN, money leaves your account instead.
- Stickers pasted over a shop's code. A fraudster sticks their own QR code on top of a shopkeeper's real one at a petrol pump, parking lot or market stall. Customers pay the fraudster without noticing.
- Fake “refund” or “cashback” codes. A caller pretending to be customer care says a refund is waiting and sends a code to “claim” it.
- Codes with a pre-filled amount. The code fills in a large amount, and the victim types their PIN in a hurry without reading it.
- QR codes that open fake websites. Some codes are not UPI codes at all. They open a website that looks like a bank or payment app and asks for your card number, OTP or PIN.
Five checks before you pay
- 1. Read the name in your UPI app. After scanning, your UPI app shows who you are paying. Make sure it matches the shop or person in front of you. A name that is completely different is a red flag.
- 2. Check the amount. Never pay a pre-filled amount without reading it. If it looks wrong, cancel.
- 3. Look at the sticker. In shops, look for a code stuck on top of another code, or a sticker that looks newer than the rest of the stand.
- 4. Ask the shopkeeper to confirm. Most shops have a sound box that announces payments. Wait for it, or ask them to check before you leave.
- 5. Never enter your PIN outside your UPI app. No website, form or caller should ever ask for it.
How a scanner app can help
A good scanner shows you what is inside a code before it does anything. The Apna QR app reads the UPI code on your phone, shows the payee's UPI ID and name, and reminds you to check the payee name in your UPI app before you pay. It then hands the code to the UPI app you choose. It never sees your PIN and never touches your money. For QR codes that contain links, it warns you about risky-looking addresses before you open them.
Even with these features, the most important check is always yours: the name and amount shown in your own UPI app.
For shopkeepers: protect your QR code
- Laminate your QR code or put it in a stand, and check it every morning.
- Print your shop name clearly next to the code, so customers can compare it with the name their UPI app shows.
- Use a payment sound box or notifications so you know immediately when money arrives.
- If you make your own UPI code with a QR generator, scan it yourself and make a small test payment before you display it.
What to do if you are cheated
- Report the transaction in your UPI app straight away, and call your bank.
- Call the national cyber crime helpline 1930 or file a complaint at cybercrime.gov.in. Acting within the first few hours gives the best chance of the money being frozen.
- Keep screenshots of the chat, the QR code and the transaction details.
Remember: scanning to pay is safe when you check the name and amount in your UPI app. Scanning to receive money is always a scam.