Guides / Safety Box
How to Spot a Fake UPI QR Code
Published August 24, 2026 · Toolsda
Have a UPI QR or ID to check right now?Paste it, scan it, or upload the image — the checker runs 8 checks entirely on-device.The trick behind almost every fake UPI QR code
A fake UPI QR code almost never asks you to pay in plain terms — it asks you to scan "to receive" a refund, cashback, prize, or payment, then walks you into entering your UPI PIN. The catch: entering your PIN never confirms you're receiving money on UPI. It only ever confirms you're sending it. A QR that combines "receive" wording with a PIN prompt is, by construction, asking you to pay — the wording is the only part that's fake.
What a UPI QR code actually encodes
Every UPI QR code, scanned by any app, decodes to a plain text link in the form upi://pay?pa=...&pn=...&am=...&tn=.... Here's what each part means:
| Parameter | What it is |
|---|---|
pa | Payee address — the UPI ID the money actually goes to. |
pn | Payee name — free text the sender sets; not verified against pa by UPI itself. |
am | Amount — if present, your app pre-fills it and asks you to confirm and PIN-authorize a payment. |
tn | Transaction note — also free text; this is where "Receive Cashback ₹500" gets written. |
The link's structure — pay, with an amount attached — is what determines what happens when you confirm it. pn and tn are just labels the sender chose; nothing checks that they describe the transaction honestly.
Why the "receive" wording works even though it's technically false
Most people's mental model is: scanning a QR to receive money is how UPI works day to day (a shopkeeper shows you a QR, you scan it to pay them — so a QR feels like it could plausibly go either way). Scammers rely on that ambiguity, plus urgency ("claim before it expires") and a plausible amount, to get a PIN entered without the person reading the confirmation screen closely. The confirmation screen itself almost always says "Pay ₹X to Y" — the scam only works if that line goes unread.
How to check a QR code before you scan — 3 steps
- Upload the QR image, scan it live, or paste the UPI text into the UPI & QR Safety Checker — nothing leaves your device.
- Read the verdict, not just the payee name. The checker specifically flags the pay-vs-receive mismatch, brand impersonation (a payee name claiming to be a bank or company on an unrecognised handle), and known scam-bait wording — the same signals worth checking by eye if you don't have the tool open.
- If it says pay, and you didn't mean to buy anything — stop. Never enter your UPI PIN on a screen you don't fully understand, regardless of what the QR or the sender told you it was for.
Frequently Asked Questions
Is scanning a QR code itself dangerous?
No. Scanning just decodes text — your risk starts only when you act on what it says, specifically when you enter your UPI PIN. A QR code cannot pull money out of your account by being scanned; it can only ask your UPI app to open a payment screen, which you still have to confirm with your PIN.
How can a QR code that says "receive money" actually be a request to pay?
A UPI QR encodes a link like upi://pay?pa=scammer@bank&am=5000&tn=Receive+Cashback. The "pay" in that link is the real instruction — your UPI app opens a payment screen. The words "Receive Cashback" are just text in the transaction note field, which the scammer can set to say anything. Your app shows what the link actually does (pay), not what the note claims.
Does a real "receive money" QR code ever need an amount or a PIN?
No. To genuinely receive money, someone pays you — you share your UPI ID or a receive QR with no amount attached, and you never touch your PIN. Any QR that has a pre-filled amount AND asks you to enter your PIN is, by definition, a payment request, regardless of what the surrounding text says.
What if the QR code has a well-known brand name or logo on it?
Logos and payee names on a QR code are just text and images anyone can add — they aren't verified by UPI. A payee name of "Amazon Refunds" paying into a personal-looking handle that doesn't match Amazon's real registered UPI ID is a classic impersonation pattern, not a guarantee of who you're actually paying.
What should I do if I've already paid a scam QR code?
Report it immediately on the National Cybercrime Helpline (call 1930 or visit cybercrime.gov.in) and contact your bank or UPI app's support to request a transaction freeze — acting within the first hour meaningfully improves the odds of recovery.