UPIIndia

Protection for UPI payments

UPI processes billions of transactions a month in India, and scams using tampered QR codes and VPAs have grown right alongside it. The screen that displays the charge is the link the infrastructure doesn’t cover.

See pricing

The payer is about to scan the UPI QR code.

Illustrative animation

UPI · India

With UPI (Unified Payments Interface), the payer uses a QR code or a VPA (a payment address such as name@bank) to transfer money instantly. What appears on screen decides where the money goes.

How the attack happens without anyone noticing

UPI QR code swapped
The QR code on the page is replaced with another one, for the same amount, pointing to the scammer’s account. The payment app confirms as usual. It’s the destination that’s wrong.
Tampered VPA
The payment address shown or copied is swapped for a similar VPA, with a name that resembles the merchant’s.
Manipulated amount
The displayed charge is changed to a higher amount and the difference is diverted, which is common with dynamic charges.

How it works

Four layers between the scam and your payment

1
Record what’s legitimate
Proteside records the legitimate QR code, VPA and amount of every UPI charge your page generates.
2
On-screen check
In the payer’s browser, it checks the QR code on screen and the VPA shown or copied.
3
Block before confirmation
Any mismatch is blocked before the payer opens their app, on a rail where settlement is instant.
4
Alert and evidence
An alert and a record of the attempt for your team.

The technical details of detection and blocking are Proteside’s proprietary technology and are shown in a demo, using your real scenario. How it works

Protection scope

What’s covered

The UPI QR code shown on your checkout, payment links and logged-in web areas
VPA and amount shown to the payer
Content copied with the “copy code” button
Scripts and extensions that try to alter the payment page

Out of scope

Printed QR codes or stickers displayed in physical stores
Scams that happen outside your page (messages, phone calls or fake profiles)
Settlement between institutions, which is already protected by the payment scheme’s infrastructure

Also protected by the same installation

One installation, every payment method in your checkout.

Frequently asked questions

Does the protection work with any UPI app?

Yes. Proteside works on the page that displays the charge, before the payer opens their app. With the QR code and VPA intact, any app settles to the right destination.

My business is outside India. Is this relevant to me?

Yes, if you sell to the Indian market or run an international checkout that accepts UPI: the same installation covers UPI and every other payment method on the page.