The Payer's QR Security Checklist: Verify Before You Tap Pay

Published: 19 October 2026

Category: how-to-guides | cardbuzz

Every QR payment has a single moment where fraud becomes impossible: the review screen between scanning and authenticating. This checklist turns those ten seconds into a habit that defeats the most common QR frauds.

1. Inspect the QR before you scan

Look at the sticker itself. Is it the merchant's original print, or is there a second sticker pasted on top? Are the edges lifting, does the print quality differ from the shop's other signage, is the QR oddly placed over another code? Pasted-over QRs are the classic redirection fraud — your money goes to whoever printed the top sticker. If anything looks layered or tampered with, ask the merchant to confirm, or pay another way.

For QRs shown on screens — billing terminals, phones, checkout pages — confirm the screen belongs to the merchant's system and the amount displayed matches your bill before you scan.

2. Match the payee name on the review screen

After scanning, your app shows the payee's registered name before you authenticate. This is your strongest signal. The name should recognisably match the merchant you are paying — the shop's name, the restaurant's name, the service provider.

A mismatch is a full stop, not a yellow flag. If you are at "Sharma General Store" and the payee reads as an individual's unfamiliar name, do not rationalise it ("maybe it's the owner's name") — ask the merchant to explain. Legitimate small merchants sometimes do use personal names, and if the explanation checks out, proceed. But the burden of explanation is on the mismatch, not on your suspicion.

3. Verify the amount — twice for static QRs

For dynamic QRs, confirm the pre-filled amount matches your bill to the rupee. For static QRs, where you type the amount yourself, verify twice: once as you type, once on the review screen. A single transposed digit can send ten times the intended amount, and while reversals are possible, they are slow and uncertain.

Also watch for fee lines on the review screen — platform or convenience fees added by the app. They are legitimate, but they change the debited total, and you should know the final number before authenticating.

4. Confirm you are on the intended rail and card

Check which funding source the app has selected. If you meant to pay with your RuPay credit card on UPI, confirm the app shows that card and a UPI PIN prompt — not your savings account, which the app may have defaulted to. Paying from the wrong source is not fraud, but it silently changes your rewards and your credit utilisation.

5. Never scan QRs from unsolicited messages

QR codes arrive over WhatsApp, SMS, and email — "scan to receive your refund", "scan to verify your KYC", "scan to claim your prize". The rule is absolute: you never need to scan a QR or enter your PIN to receive money. Any QR that asks for your PIN in a receive-money context is a payment QR in disguise, and authenticating it sends money out. Delete the message.

Similarly, never scan a QR during a phone call with a stranger — no bank, no courier company, and no government department collects payments or verifies identity this way.

6. Capture the receipt

After a successful payment, save the transaction reference — screenshot the confirmation or note the UTR/transaction ID. For credit-card QR payments, the transaction will also appear on your card statement, usually within a day or two. If the merchant claims non-receipt, the reference is your proof; without it, resolution becomes a slow he-said-she-said.

7. Keep the device and app hardened

The checklist above assumes your phone itself is trustworthy — make sure it is. Keep your UPI and banking apps updated, lock them behind biometrics or a strong device PIN, and never grant screen-sharing or remote-access apps the permissions they ask for during a "support" call. A large share of QR fraud is actually social engineering plus remote access: the victim scans the QR themselves while a fraudster watches the screen. No QR code can defeat a compromised phone, so treat device hygiene as item zero of this list.

Key takeaways

  • The review screen is your security checkpoint: payee name, amount, funding source — verify all three before authenticating.
  • Inspect physical stickers for pasting or tampering; mismatched payee names are a full stop.
  • You never scan a QR or enter a PIN to receive money — that request is always fraud.
  • Save every transaction reference; it is your proof if a payment is disputed.