How a UPI QR code is actually built

There is no magic in a UPI code. Scan one with any text scanner and you get a single line that starts with upi://pay? followed by ordinary URL parameters.

The fields

• pa — the payee address, meaning the UPI ID that receives the money
• pn — the payee name shown in the payer's app
• am — the amount; leave it out to let the payer type their own
• cu — the currency, always INR for domestic payments
• tn — a transaction note, useful for an order or invoice number

So a shop collecting ₹499 produces something like upi://pay?pa=shop@okhdfcbank&pn=Shop&am=499&cu=INR. That is the entire code.

Why this matters for security

QR fraud at counters almost always works the same way: someone pastes their own code over yours. Because the payer's app shows the payee name from the pn field, a fraudster can set that to your shop name and the screen will look right.

The defence is the UPI ID itself, not the name. Scan your own counter code once a week with a plain text scanner and read the pa field. If it is not your ID, the code has been swapped.

Amount or no amount

Leave the amount out for a general counter code, so one printed code serves every sale. Put the amount in for a specific invoice, table bill or order — it removes typing errors and speeds up reconciliation.

Print quality

UPI strings are short, so the resulting code has few modules and stays readable even when printed small. Quartile error correction is enough for a counter sticker. Move to High only if you are placing a logo in the middle.