Is it safe to share your UPI QR code?

Yes, sharing your UPI QR code or UPI ID is safe. It's an address for receiving money: anyone who has it can pay you, and nobody can take money out of your account with it, because every payment out has to be approved by you, on your own phone, usually with your UPI PIN. What it does reveal is your UPI ID, which may include your phone number, and, when someone starts a payment, your bank-registered name. The real risks aren't in sharing the code; they're in being tricked into paying, and in someone covering your counter QR with theirs.

What your QR reveals, and what it doesn't

About your phone number. If you'd rather customers didn't see it, check whether your UPI app lets you use a UPI ID without your number, or use one linked to a business account.

About your name. Since 30 June 2025, UPI apps show the payer only the account holder's name from the bank's records. That's a safety feature: it lets customers confirm they're paying you and not someone who pasted a QR over yours.

What someone can and can't do with it

They can: pay you, see your UPI ID, and see your bank-registered name when they start a payment.

They can't: take money from your account, see your balance, or move money without your approval on your own phone.

They can't send you a "collect request" any more. Person-to-person collect requests, the pop-ups that asked you to "approve" a payment and then took your money, were switched off on 1 October 2025. Requests from verified businesses still exist, so read any request carefully.

The tricks to watch for

The danger is never in showing your QR. It's in being talked into paying.

"Scan this to receive money." Scanning any UPI QR sets up a payment from you. Nobody needs you to scan a code, or enter your PIN, to send you money.

"I sent too much, please return it." A fake credit SMS followed by a call. Check your actual balance in your bank app. If nothing arrived, there's nothing to return.

A fake payment screenshot. A spoof app shows "payment successful" for money that never moved. Check your own account, not their screen.

→Spotting fake payment screenshots

Someone asking for an OTP or your PIN "to verify" or "to complete a refund". No genuine person or company needs either.

A QR pasted over yours. Your customers' money goes to a stranger until you notice. In January 2025, codes at 10 to 12 shops in Khajuraho were swapped overnight; it came to light when a customer said the name on screen had changed.

Is it safe to scan an unknown QR code?

Scanning is safe; paying is the decision. When you scan a UPI QR, your app shows who you'd be paying and asks for your PIN. Before you enter it:

• Read the name on your screen. It comes from the bank and can't be faked by a sticker.
• Check any amount that's filled in.
• If the code opens a website instead, don't enter bank details, card numbers or your PIN there.

To see what's inside a code before you open it in your UPI app, read it with the QR decoder, which runs on your device.

→How UPI scams work now

Is it safe to share a UPI transaction ID?

Yes. The 12-digit UPI reference number (UTR) only identifies a payment that already happened, so you can share it to prove you paid, or ask for it to check a payment you received. It can't be used to take money.

How to keep your counter QR safe

Scan it every morning when you open. If it ever shows a name that isn't yours, someone has covered it.

Laminate it with matte film and keep it where you can see it, so a stuck-on sticker stands out.

Print your UPI ID under the code and write the name customers will see, so they can spot a difference.

Replace a damaged card straight away rather than leaving a scuffed code that invites a "fix".

→Print a QR that's hard to tamper with

If something goes wrong

Money taken by fraud: report it straight away on 1930, the national cyber crime helpline (24 hours), or at cybercrime.gov.in, and call your bank, ideally within the hour. Money reported quickly can sometimes be held before it moves on.

A suspicious call, SMS or WhatsApp message with no money lost: report it on Chakshu, the Department of Telecommunications' facility on sancharsaathi.gov.in.