How to spot a fake UPI QR or payment link

UPI has become the way India pays — it handled 24.07 billion transactions in September 2026 alone (source: StartupTalky). Scammers go where the money is, and two of their favourite tools are the QR code and the payment link. The good news: almost every QR and link scam breaks one of a few simple rules. Learn these six checks and you, your family and your customers will spot most of them.

1. You never scan or enter your PIN to receive money

This is the single most important rule. Scanning a QR code and entering your UPI PIN always sends money from your account. Nobody needs your PIN to pay you.

The classic scam: you are selling a sofa or a phone online. A "buyer" — often claiming to be in the army or posted out of town — agrees to your price without bargaining and sends you a QR code "to receive the advance". You scan it, enter your PIN, and the money leaves your account. If anyone asks you to scan or approve something so that you can receive money, stop. It is a scam, every time.

2. Check the name before you pay

After you scan a QR code, your UPI app shows the name of the account that will receive the money. Read it before you enter your PIN.

• At a shop, the name should match the shop or its owner. If you are paying "Sharma Sweets" and the app shows a stranger's name, ask before paying.
• For a bill or a booking, the name should match the company. A "train ticket refund" that pays to a personal account is a red flag.

Shop owners: look at your own payment QR every day. A common trick is to stick a different QR on top of yours so customers pay the scammer. Laminate your code, print your shop name in big letters next to it, and keep it where staff can see it.

3. Decline collect requests you did not expect

A UPI collect request is someone asking you to pay them. It pops up in your UPI app and asks for your PIN. Scammers send collect requests and then call you: "I have sent the refund, just approve it." Approving it pays them.

If you did not start the payment yourself, decline the request. Real refunds arrive in your account without you doing anything.

4. Read the link, not the message

Payment links arrive by SMS, WhatsApp, email and social media. The message will look urgent and official — "Your electricity will be cut tonight", "KYC pending, account blocked", "Parcel on hold, pay ₹25 re-delivery fee", "Income tax refund approved". The only thing that matters is the website name in the link.

• Look at the part just before the first single slash. sbi.co.in belongs to SBI. sbi-kyc-update.xyz does not, no matter how real the page looks.
• Be suspicious of short links in "official" messages. You cannot see where they go. Add + to the end of any hi4.in link to preview it, or paste any other short link into our link safety checker to see every address it passes through.
• Banks, electricity boards and government departments do not ask you to update KYC or avoid a disconnection through a link in a message. Open their official app or website yourself.

5. Never install apps or share your screen because someone asked

Some scams send you an app file (an APK) as a "bill", "invitation" or "KYC form" on WhatsApp, or ask you to install a screen-sharing app so "support" can help. Either one can give a stranger control of your phone, your SMS and your OTPs.

• Install apps only from the Google Play Store or Apple App Store.
• Never share an OTP, UPI PIN, card CVV or screen with anyone who calls or messages you — not even someone who says they are from your bank.

6. If it is too good, too urgent or too secret — stop

Almost every scam uses one of three pressures: a reward (cashback, lottery, a job that pays daily), a threat (account blocked, power cut, police case) or secrecy ("do not tell anyone, do it now"). When you feel any of them, put the phone down for ten minutes and check with someone you trust.

For shopkeepers: protect your QR and your counter

• Wait for confirmation. Hand over goods only after your sound box, app or bank SMS confirms the money arrived. Payment screenshots can be edited and "fake payment" apps exist.
• Check your poster daily for stickers or replaced codes.
• Use a code with your name on it. Our UPI QR code generator prints your shop name next to the code, so customers can match it with the name their app shows.
• Train your staff on rule 1: nobody scans a customer's QR "to receive a refund".

Scan unknown QR codes safely

Not sure about a QR code on a poster, a parcel or a message? Our free QR code scanner reads the code with your camera or from a photo and checks the link before you open anything.

If you have already been cheated

1. Call 1930, the national cyber crime helpline, as soon as possible. Speed matters — the faster you report, the better the chance of stopping the money.
2. Report online at cybercrime.gov.in.
3. Call your bank on the number printed on your card or on the bank's official website, and ask them to block the card or UPI and raise a dispute.
4. Report the message or call on the government's Sanchar Saathi portal (Chakshu), at sancharsaathi.gov.in.
5. If the link was a hi4.in link, report it to us so we can disable it for everyone else.

The six checks, in short

1. No PIN, no scan to receive money.
2. Check the payee name before you pay.
3. Decline collect requests you did not start.
4. Read the website name in every link.
5. No unknown apps, no screen sharing, no OTPs.
6. Reward, threat or secrecy? Stop and check.

Share this with your family and staff — the people most often targeted are the ones who have never heard of these tricks. See also our Trust & safety page.