QR code payment safety

Updated: 2026-10-11

UPI QR codes are safe when both sides follow a few habits. Most fraud comes from three tricks.

1. A fake sticker over the shop's code

A fraudster pastes their own QR code over the shop's printed one, so customers' payments go to the fraudster. Shop owners: keep the stand where you can see it, look at it every morning, and ask customers to read out the name their app shows. Laminate it or keep it under a clear cover so a sticker is easy to spot. Customers: before entering your PIN, check that the name in your app matches the shop.

2. "Scan this to receive money"

You never scan a code or enter your UPI PIN to receive money. Someone who sends you a QR code and says it will credit your account (for an OLX sale, a refund or a prize) is asking you to pay them. Entering your PIN always means money leaves your account.

3. Codes that open a website instead of a payment

A code can open a fake bank or "KYC update" page that asks for card numbers, OTPs or passwords. When your camera shows a web address, read it before you tap. A real payment code opens your UPI app with the payee's name, never a form that asks for your bank login.

Good habits

• Shop owners: turn on payment sound alerts (a speaker or your app's voice alert) so you hear every payment, and check the amount before handing over goods.
• Never share your UPI PIN or an OTP with anyone, including people claiming to be from a bank.
• If money goes to the wrong person, report it in your UPI app's help section, call the national cyber helpline 1930, or file a complaint at cybercrime.gov.in as soon as possible.

Make your own code with the UPI QR code generator and test it with a ₹1 payment before printing.