Skip to content

UPI QR code and VPA scams: how online merchants stay protected

Laís Peixoto

By Laís Peixoto

Growth Marketer, Proteside

Published · 4 min read

On UPI, scanning a QR code or entering a UPI PIN always sends money and never receives it, which is the rule scams exploit. For online stores the risk sits on the payment page: if the QR code, VPA or link shown is swapped, the customer pays the wrong account.

On UPI, India's instant payment system, scanning a QR code or typing a UPI PIN always authorises money going out, never money coming in. Almost every documented scam exploits that rule. For anyone selling online, though, the sensitive spot is elsewhere: the payment page, where the QR code, VPA and link on screen decide where the customer's money ends up.

How UPI uses QR codes and VPAs

A VPA (virtual payment address, in the form name@bank) identifies the payee without exposing an account number. A UPI QR code is simply a way of carrying that address. Under the linking specification published by NPCI, which operates UPI, it holds a upi://pay link with the payee's VPA and name and, where needed, the amount and a transaction reference. For merchant payments the reference is mandatory, and the specification provides for dynamic QR codes generated for each charge.

The payer's app reads that data and opens a pre-filled payment screen. The customer checks it, enters the PIN and the money leaves instantly, with no easy way back. Scale makes this relevant to any business selling into India: in May 2026, UPI processed 23.2 billion transactions, according to NPCI data reported by Inc42.

The most documented scams

The Reserve Bank of India (RBI) and Indian police forces describe a few recurring patterns:

  • “Scan to receive” QR codes: the fraudster poses as a buyer, often on classifieds sites, and sends a QR code supposedly so the seller can get paid. Delhi Police describes cases where, after the first debit, the criminal claims a mistake and sends another QR code for double the amount, repeating the cycle.
  • Disguised collect requests: UPI lets anyone send a payment request (a collect request). In a January 2022 alert, the RBI flagged misuse of this feature with messages along the lines of “enter your UPI PIN to receive money”. Approving means paying.
  • Unauthorised QR codes and VPAs: the same alert lists unauthorised QR codes among the tactics. A VPA that resembles the shop's, with a plausible name, is often enough for a payer to confirm without a second thought.

The official guidance is blunt: according to the RBI, receiving money never requires scanning a QR code or entering a PIN. In March 2022, the central bank also gathered the most common digital payment frauds in its BE(A)WARE booklet.

Where online commerce comes in

In a physical shop, the classic risk is a sticker pasted over the genuine QR code. Online, the equivalent is quieter. The QR code is generated by the merchant's or payment provider's system, but it is displayed in the buyer's browser, alongside everything else the page loads: plugins, marketing tools, chat widgets, third-party scripts. On mobile, many stores also offer a “pay with a UPI app” button that opens the app from the same upi://pay link.

If malicious code runs on that page, it can replace the QR image, the VPA shown as text or the button's destination. The buyer pays the right amount, sees a plausible name in the app and confirms. The store is not paid, the order stays pending and the customer is certain they paid. They did, just to someone else.

In the card world this weakness is already addressed by rules: PCI DSS requirements 6.4.3 and 11.6.1 call for authorising and inventorying payment page scripts and for detecting unauthorised changes to what reaches the customer's browser. In March 2025, the PCI Security Standards Council published dedicated guidance on these two requirements. The same logic applies to a UPI QR code: what matters is what the buyer actually sees.

A checklist for merchants accepting UPI

  1. Use a dynamic QR code per order, with a fixed amount and a unique reference, and reconcile each payment against that reference.
  2. Show the VPA and payee name as text next to the QR code, and ask customers to check that the name in their app is your company's.
  3. Never ask a customer to scan a QR code or approve a request to receive a refund. Say so in your returns policy, because fraudsters impersonate shops' customer service.
  4. Cut the scripts on your checkout and keep platform, theme and plugins up to date, removing anything unused.
  5. Monitor the live payment page, comparing the QR code, VPA and link on screen with what your system issued.
  6. Treat “I paid but my order wasn't approved” as a security signal, not just a support ticket.
  7. Know where to send victims: the Indian government runs the cybercrime.gov.in portal and the 1930 helpline for reporting financial fraud.

To see what can be swapped in a UPI charge, and what lies beyond the reach of any on-page protection, read about protection for UPI payments.

Proteside checks, in the buyer's browser, that the UPI QR code, VPA and link shown at checkout are exactly the ones your store issued, and blocks any swap before the payment is confirmed, alerting you and generating PCI DSS evidence. It works with any e-commerce platform and payment provider. Try it free for 14 days.

Back to blog

Read next