The short version
A QR code is just text in a pattern. Anyone can make one that pays their own UPI ID and attach any name they like to the image around it. The image is not evidence of anything.
There is exactly one part of a UPI payment that a stranger cannot control: the account holder name your payment app shows in the final confirmation screen. That name comes from the bank. Read it, every time, before you tap confirm.
Checking a QR you received in a chat
When a QR arrives as an image on WhatsApp, email, or inside an invoice PDF, you can read its contents before you scan it.
- Save the image, or take a screenshot of it.
- Open the UPI QR checker and drop the image in. It decodes in your browser and nothing is uploaded.
- Read the UPI ID it pays. Compare it against whatever the sender told you their UPI ID was. If they never told you, ask, and compare their answer against what you already read.
- Check whether an amount is locked in, and whether it is the amount you agreed.
This tells you what the code does. It cannot tell you whether the person behind it is honest.
Checking a QR at a counter
Nobody is going to photograph a QR and upload it to a website while a queue forms behind them, so here is the version that actually works in a shop.
- Look at the sticker itself. QR swap fraud usually means a printed sticker pasted over the real one. Peeling edges, a QR that sits crooked over another, a fresh sticker on a faded board, or a laminated card taped on top are all worth a second look.
- Read the name in your app. If you are paying Sharma General Store and your app says a personal name you have never heard, stop and ask. This one check defeats almost every swapped QR.
- Say the amount out loud. Confirming the figure with the shopkeeper before you confirm in the app catches both mistakes and manipulation.
- Show the payment confirmation. A completed payment screen is the receipt. Let the shopkeeper see it.
What a QR can never ask you for
Receiving money over UPI requires nothing from you. If a QR, or the person who sent it, leads to any of the following, it is fraud without exception:
- Entering your UPI PIN to receive money. A PIN only ever authorises money leaving your account.
- Reading out an OTP to anyone, for any reason.
- Installing a screen sharing or remote access app so somebody can help you.
- Scanning a code to claim a refund, a cashback, a prize, a lottery, or a KYC update.
The refund scam is the most common of these by a distance. A real refund arrives on its own. It never requires you to scan or approve anything.
What checking cannot achieve
Verifying a QR confirms the destination. It does not confirm the person. Most money lost over UPI in India goes to a payment that worked perfectly and reached exactly the account it was meant to, for goods that never arrived.
So treat the QR check as one step. For an unknown seller, the questions that matter more are whether you can identify them, whether there is any recourse if nothing arrives, and whether you would still make this payment if the money were simply gone.
If you have already paid the wrong person
Contact your bank immediately and ask them to raise a dispute. Report cyber financial fraud on the 1930 helpline or at cybercrime.gov.in. Move quickly, because funds can sometimes be held before they are withdrawn. Keep the QR image, the chat, and the payment reference number.