QR Code Scam Checker: Is This QR Safe to Scan?
Upload, paste or scan a QR code to see exactly what it does before your payment app opens it: who a UPI payment goes to and how much, which website a link really leads to, and the warning signs of a QR scam.
- Image stays on your device
- UPI, Bharat QR, links and WiFi
- No sign-up
Or paste the text inside a QR code
What this QR does
Warning signs
Raw QR content
How to test it
- Press cashback scam. It should warn that scanning sends ₹4,999 and that the UPI ID pretends to be Paytm.
- Press shop UPI. It should show the shop's UPI ID with no warning signs.
- Take a screenshot of any QR code, even your own UPI QR, and upload it. The UPI ID shown should match.
QR images are read in your browser and never uploaded. Link checks: 10 per hour.
How this QR code scam checker works
Reads the QR on your device
Your browser's built-in barcode reader, or a small open-source decoder, reads the code from your image or camera. Nothing opens, and no payment app starts.
Shows what scanning would do
For UPI and Bharat QR it shows the UPI ID, the name in the code, the amount and the note. For links it shows the real website address, even when the QR hides it behind a short link.
Flags the scam tricks
Refund and cashback promises, UPI IDs pretending to be companies, payment requests, lookalike bank websites, short links, outdated WiFi security and crypto payments are all flagged.
Check it yourself. Open your browser's developer tools (F12) and choose the Network tab, then check a QR image. No request carries your image: at most the page loads the open-source decoder once, and a link is sent only if you press Check link safety.
QR code scams in India
Each button loads a typical example into the checker.
| What happens | The truth | Action |
|---|---|---|
| A "buyer" on OLX sends a QR to pay you | Scanning and entering your PIN sends money to them. Receiving money never needs a QR or PIN. | |
| "Scan to get your refund or cashback" | Refunds go back automatically. A QR for a "refund" always takes money. | |
| A QR sticker on a parking meter, EV charger or poster | Fake stickers are pasted over real ones and lead to lookalike payment or login pages. | |
| An email says "Scan to re-verify your account" | QR codes in emails get past link filters. The page steals your password. | |
| Paying a shop by its counter QR | Usually fine. Check the name your UPI app shows matches the shop owner before entering your PIN. |
What a QR code can contain
A QR code is just text. What happens when you scan it depends on how that text starts: a UPI link opens your payment app, a web link opens a website, and a WiFi code joins a network.
UPI QR codes follow the NPCI format, with the payee's UPI ID (pa), name (pn), amount (am) and note (tn). Shop QR codes often use the Bharat QR format, which the checker also decodes to find the UPI ID and shop name.
The name inside a QR code is typed by whoever made it and can be anything. The name your UPI app shows before payment comes from the bank, so always compare the two.
Sources: NPCI: UPI, RBI Sachet, CERT-In.
QR code types and what scanning does
| Type | Starts with | Scanning it |
|---|---|---|
| UPI payment | upi://pay?pa=… | Sends money from your account after you enter your PIN. |
| Bharat QR (shop) | 000201… | A shop's payment code. Also sends money. |
| Payment request | upi://collect?… | Asks you to approve a payment. Approving takes money. |
| Website link | https://… | Opens a website that may ask for logins or card details. |
| WiFi | WIFI:S:…;P:… | Joins a WiFi network and shows its password. |
| Phone or SMS | tel: / smsto: | Calls or texts a number, sometimes a premium one. |
| Contact | BEGIN:VCARD | Adds a contact to your phone. |
| Crypto | bitcoin: / 0x… | Asks for a cryptocurrency payment, which can't be reversed. |
QR code mistakes that cost money
Scammers build their tricks around these.
There's no such thing. Every UPI QR payment moves money out of your account.
Anyone can print any name. Trust only the name your UPI app shows.
Look for a sticker on top of another, and type the website address yourself instead.
A payment request takes money when you approve it, whatever the message says.
Safe QR code habits
When paying
- Scan only QR codes shown by the person or shop you're paying.
- Check the payee name and amount before entering your PIN.
- Set a sensible daily UPI limit in your app.
- Keep the transaction ID and screenshot of every payment.
- Turn on payment alerts by SMS for your bank account.
For shop owners
- Check your counter QR daily for stickers pasted on top.
- Use a soundbox or payment alerts to confirm money received.
- Never show customers a QR to "refund" them. Send money instead.
- Use your bank's merchant QR, which shows the shop name.
- Replace worn or damaged QR prints.
Frequently asked questions
Short answers about privacy, UPI and QR scams.
Is the QR image uploaded to your server?
No. The QR code is read by code on this page, in your browser, and the image never leaves your device. Only if you press Check link safety is the link inside the QR sent to our server for a Google Safe Browsing and VirusTotal check.
Can I receive money by scanning a QR code?
No. Scanning a UPI QR and entering your PIN always sends money from your account. Anyone who asks you to scan a QR to receive a refund, prize or payment for something you're selling is trying to take your money.
The shop's QR shows a person's name, not the shop's. Is that a scam?
Not always, because many small shops use the owner's personal UPI ID. Check that the name your UPI app shows before payment matches the owner, and look for a sticker pasted over the original QR.
What is quishing?
Quishing is phishing through QR codes. Fake QR stickers on parking meters, EV chargers, posters or in emails lead to lookalike login or payment pages. This checker shows the real website before you open it.
The camera button doesn't work. What can I do?
Allow camera access when your browser asks, and make sure the page is open in Chrome, Edge, Safari or Firefox. You can also take a screenshot or photo of the QR and upload it, or paste an image with Ctrl+V.
Does it read Bharat QR and shop payment QR codes?
Yes. It reads UPI QR codes, Bharat QR merchant codes, website links, WiFi, phone, SMS, contact and crypto QR codes, and explains what scanning each one would do.
Can you tell me if a UPI ID belongs to a fraudster?
No website can look up who owns a UPI ID. The checker flags IDs and notes that pretend to be companies or promise refunds. If you've been cheated, report the UPI ID in your UPI app and at cybercrime.gov.in or 1930.