100% private — QR and UPI ID never leave your browser
UPI ID & QR Code Safety Checker
Check a UPI ID or QR
Safety verdict
Paste a UPI ID on the left, or scan a QR. The 8-point safety check and the risk score land on this sheet.
How UPI QR Scams Work
The "Scan to Receive" Trap
A stranger says "I'm sending you ₹5,000, just scan this QR to accept it." The QR is actually a upi://pay collect request. Scanning it and entering your PIN sends money OUT of your account — UPI never needs your PIN to receive money.
Fake Refund / Customer Care QR
"Your order was cancelled, scan this QR to get your refund" or "Your electricity bill is overdue, scan to pay and avoid disconnection." Both use urgency to rush you into scanning and paying without checking the payee name.
Fake Marketplace / Army Deal
A too-good-to-be-true OLX listing, often claiming to be an army/defence seller, asks for an "advance payment" QR before shipping. The item never arrives, and the seller's UPI ID has no real connection to any defence institution.
Golden Rules of UPI Safety
- Your UPI PIN is only ever needed to SEND money — never to receive it. If entering a PIN is required to "get" a refund, cashback, or prize, it is a scam.
- Always check the payee name shown inside your UPI app (GPay/PhonePe/Paytm) before entering your PIN — this checker helps you decide, but your app shows the final, real-time name.
- If a deal, prize, or refund sounds too good to be true — free money, a stranger paying you first, a way-below-market price — it almost always is.
Why check a UPI ID or QR code before paying?
Almost every UPI scam in India today is QR-based. A scammer messages you saying "I'm sending you ₹5,000, just scan this QR and enter your PIN to accept it" — but the QR actually encodes a upi://pay link, which makes you pay them. This tool parses the UPI ID or QR entirely in your browser and runs an 8-point safety check — including the pay-vs-receive trap, brand impersonation, and known scam keywords — before you tap "Pay" or scan anything.
What the 8 checks look for
- UPI ID format — does it match the standard name@bankhandle pattern?
- Bank/PSP handle — is the part after @ a recognised bank or app handle?
- Pay vs Receive trap — does a "receive money" message hide an actual payment request?
- Brand impersonation — does the payee name claim to be Amazon, PhonePe, the Army, etc. without the matching official handle?
- Scam keyword scan — lottery, KBC, KYC, army, OLX, cashback, and other common scam-bait words
- Amount check — ₹1/₹2/₹5 "test payments" and unusually large amounts
- Linked website — if the QR encodes a web link instead of a direct UPI request, it's checked for phishing too
- Merchant identity — is this a verified-looking business, or an unverified personal account?
Read the guide
Frequently Asked Questions
Does this tool send my UPI ID or QR code to a server?
No. The QR image is decoded and the UPI ID is analysed entirely inside your browser — nothing is uploaded, logged, or sent anywhere, ever.
What is the "scan to receive" scam?
A scammer asks you to scan a QR code to "receive" a payment, refund, or prize. In UPI, receiving money never requires your PIN — but the QR is actually a payment (collect) request, so entering your PIN sends money out of your account instead.
Is it safe to scan any UPI QR code?
Scanning is safe — your risk starts only when you enter your UPI PIN. Always read what your UPI app shows (payee name and amount) before confirming, and use this checker first if anything feels off.
What should I do if I already paid a scammer?
Immediately report it on the National Cybercrime Helpline (call 1930 or visit cybercrime.gov.in) and inform your bank/UPI app's support to attempt a transaction freeze. Do not scan or pay anything else from the same source.