How to Check Whether a UPI QR Code Is Safe Before You Pay
Published September 17, 2026 · By the TryDocsy team
A QR code sticker, a WhatsApp screenshot or a code a “buyer” sends you all look the same: a square of black dots. What matters is the payment request hidden inside, and your UPI app shows only part of it once you are already on the payment screen. This guide shows how to read that request first, and which details should make you stop.
Short answer
Remember the one rule NPCI states plainly: your UPI PIN is entered only to make payments, never to receive money. Before paying an unfamiliar code, open it in the UPI QR Code Scanner to see the UPI ID that will receive the money, any amount locked into the code, the note, and whether it is a one-off payment or a recurring mandate. Then check the name your UPI app shows on its confirmation screen before you enter the PIN.
What is inside a UPI QR code
Most UPI codes hold a short link that starts with upi://pay followed by a few fields. The important ones are pa (the payee address, or UPI ID, such as shopname@okaxis), pn (a display name), am (an amount), cu (currency) and tn (a note). Bank-issued Bharat QR codes pack the same information into a different, checksummed format.
Only one of those fields decides where your money goes: the payee address. The display name is typed by whoever created the code, and nobody checks it. A code can say “State Bank of India” in the name while paying a personal ID. The amount and note are also just whatever the creator chose.
The scam NPCI describes
NPCI's Fraud Awareness page, under its QR Codes heading, describes a pattern aimed at people selling things online. A “buyer” agrees to your price without haggling and sends a QR code, asking you to scan it and enter your UPI PIN for a small amount. They return that money so it feels genuine, then ask you to scan again for a larger amount. When you complain about the debit, they call it a system error and ask you to scan once more for double. The cycle continues until the victim realises what is happening.
The same page lists do's and don'ts. The key ones for QR codes:
- The UPI PIN is to be entered only for payments, not for receipts. If someone says you must scan or enter a PIN to receive money, a refund or cashback, it is a scam.
- Watch the in-app notifications from your UPI app during every transaction.
- Don't use screen-sharing or remote-access apps while making a payment, and avoid paying while on a call with a stranger.
- Find your bank's contact details only on its official website, and report complaints only to your bank or the police.
What we saw when we tested three codes
We generated three QR codes with made-up UPI IDs and uploaded each to the UPI QR Code Scanner: an ordinary shop code, a code designed like a refund scam, and a subscription mandate. The scanner decodes the image in the browser and lists what the code asks for, followed by a Safety check.
| Test code | Fields shown | Main Safety check findings |
|---|---|---|
| Shop: sharmastores@okaxis, name Sharma Stores, no amount | Pays to, name, “Not fixed” amount | Money goes to the address (issuer shown as Google Pay, Axis Bank); no amount fixed; person-to-person code; nothing structurally wrong |
| Refund bait: quickhelp7731@ybl, name State Bank of India, ₹4,999, note “Refund cashback credited” | Pays to, name, amount, note | Headline: 1 serious problem found. Name does not match the address; amount locked into the code; the note promises money, with the advice not to enter your UPI PIN |
| Mandate: streamplus@okicici, ₹499, note “Monthly plan” | Pays to, name, amount, note | Headline: 1 serious problem found. “This sets up a recurring auto-debit”; amount locked |
Two things are worth noticing. The refund code would look harmless on a phone if you only read “State Bank of India”, and the scanner's job is to put the real address and the contradiction in front of you. And the clean shop code still came with a caution: the scanner can confirm that a code is honest about what it will do, but not that the person behind the address is trustworthy.
Step by step: check a code before paying
- Open the UPI QR Code Scanner. Choose Upload image for a screenshot or photo (you can also paste a screenshot), Use camera for a printed code, or Paste UPI link if someone sent you a upi:// link as text.
- Read Pays to (UPI ID). Does it belong to the shop or person you intend to pay? A big brand receiving money on a random-looking personal ID is a red flag.
- Read the amount. If it says Not fixed, you will type the amount yourself. If an amount is locked in and you didn't agree to it, stop.
- Read every Safety check item marked as a problem. Mismatched names, notes about refunds or KYC, collect requests and recurring mandates all deserve a pause.
- If everything matches, pay from your usual UPI app. On its confirmation screen, check the payee name before entering the PIN. That screen is the last point where you can back out.
Red flags that mean “don't pay”
- Anyone asks you to scan a code or enter a PIN to receive money, collect a prize, get a refund or complete KYC.
- The code is a collect request or a mandate when you expected a simple payment. Genuine shops give you a code to pay; they don't ask you to approve a pull from your account.
- The name on the code is a bank, government body or large company, but the UPI ID looks personal.
- A sticker at a shop counter looks newer than the one underneath, or has been pasted over another code. Ask the cashier to show you the payee name on their phone.
- The person hurries you, stays on the call while you pay, or asks you to install a screen-sharing app.
- A Bharat QR code fails its checksum. The scanner flags this as a danger, because it means the contents were altered or the image was damaged.
If you already paid a scammer
- Report the transaction to your bank straight away using the contact details on its official website or the UPI app's help section, not a number from a search result or social media post.
- Call 1930, the national helpline for reporting online financial fraud, or file a complaint at cybercrime.gov.in. The National Cyber Crime Reporting Portal run by the Ministry of Home Affairs promotes both.
- Keep evidence: the QR image, chat messages, the UPI transaction ID and the time of payment.
- Change your UPI PIN if you shared it or typed it while someone could see your screen.
Report as soon as you notice, while the transaction details are fresh. For codes that aren't payments at all, such as Wi-Fi or website QR codes, the general QR Code Scanner shows the link before you open it.
How we measured
- Test codes: three QR images generated with the qrcode library from these payloads: upi://pay?pa=sharmastores@okaxis&pn=Sharma Stores&cu=INR; upi://pay?pa=quickhelp7731@ybl&pn=State Bank of India&am=4999&cu=INR&tn=Refund cashback credited; upi://mandate?pa=streamplus@okicici&pn=StreamPlus&am=499&cu=INR&tn=Monthly plan. All IDs are invented for the test; don't pay them.
- Tool: /image/upi-qr-scanner from the development build of 17 September 2026, Upload image mode, in Microsoft Edge. Findings are quoted from the Safety check panel.
Frequently asked questions
Can scanning a QR code take money without my PIN?
A standard UPI payment needs your UPI PIN to go through. The danger is being tricked into entering it. NPCI's guidance is that the PIN is entered only to make payments, never to receive them.
Is it safe to scan any QR code with the scanner?
Decoding a code in the scanner doesn't pay anything or open links; it only shows what the code contains. Paying happens only if you then open the code in your UPI app and enter your PIN.
Why does the scanner say person-to-person on a shop's QR code?
Many small shops use a personal UPI ID rather than a registered merchant code. That isn't a scam by itself. It means the code has no merchant category code, so check that the ID belongs to the shop.
What is a UPI mandate QR code?
A mandate sets up repeated debits on a schedule, such as a monthly subscription, instead of one payment. Approve one only for a subscription you deliberately chose, and read the amount and frequency first.
Can a fraudster change the name shown in my UPI app?
They can put any name they like inside the QR code. Treat that name as a label, judge the payment by the UPI ID, and read the payee details on your UPI app's own confirmation screen before you enter your PIN.
Tools used in this guide
Sources
- NPCI: Fraud Awareness (QR Codes, do's and don'ts) (read September 17, 2026)
- National Cyber Crime Reporting Portal, Ministry of Home Affairs (1930 helpline banner) (read September 17, 2026)
Spotted something out of date? Tell us through the contact page.