SAFETY GUIDE · REVIEWED AUGUST 25, 2026 · SAKSHI KUMARI

UPI QR safety: scan, verify and pay carefully

A QR code can contain payment information, a web address or plain text. Scanning it is not proof that the request is legitimate. Pause long enough to read the payment screen and verify who is being paid.

Receiving money does not require your UPI PIN

NPCI’s fraud-awareness guidance warns that scanning a QR code and entering a UPI PIN is for making a payment, not receiving money. Do not enter a PIN to claim a refund, prize, cashback or payment from an unknown caller. Never disclose the PIN, OTP, card details or screen-share access to someone who contacts you unexpectedly.

Before approving a payment

  1. Check the displayed payee name, UPI ID and amount—not just the message or QR image.
  2. Ask the merchant or known person to confirm the intended amount if anything differs.
  3. Do not rely on a screenshot, sound or chat message as proof of a successful payment; check your own UPI app and bank transaction history.
  4. Decline unfamiliar collect requests and do not install an app or share your screen at another person’s instruction.

Fake or replaced QR codes

A printed QR sticker can be replaced or a digital image can be forwarded out of context. Where practical, compare the merchant name shown by your UPI app with the counter, invoice or person you intend to pay. A QR code that opens a link should be treated as a link: inspect the destination and do not sign in or enter sensitive information merely because it came from a code.

If a transaction looks suspicious

Use your UPI app’s complaint or help channel promptly, contact your bank through a verified number, and keep the transaction reference and screenshots of relevant messages. Do not share a PIN or OTP while seeking help. NPCI states that UPI users can raise a complaint from their mobile app; your bank or app can explain the applicable process.

Using a QR generator

The techSA QR Generator creates code images from the input you give it. It does not validate a merchant, recipient or payment request. Test a QR code with a separate scanner and check its decoded text before printing or sharing it.

Official sources

Read NPCI fraud awareness and the NPCI UPI FAQs for current official safety information.