UPI QR Code Tampering Prevention Checklist for Merchants

A UPI QR is an instruction containing merchant payment information. If somebody replaces a physical sticker or causes a website to render an unauthorized beneficiary, customers can be directed to the wrong account while believing they paid the merchant.

NPCI explains that QR and Intent are supported merchant modes and that merchant information is stored in the QR. NPCI’s fraud-awareness guidance also reminds users that scanning a QR and entering a UPI PIN is for making a payment, not receiving one. Merchants should turn that customer guidance into operational controls. Sources: NPCI UPI FAQ and NPCI fraud awareness.

How QR Substitution Happens

Common exposure points include:

• A fraudulent sticker placed over a legitimate counter QR
• A standee replaced during a busy shift
• An old QR reused after merchant-account changes
• A compromised content-management account changing an image
• Client-side checkout code accepting an untrusted UPI ID
• A staff member sharing an unapproved personal QR

The control objective is consistent: customers see only a beneficiary approved by the business, and fulfilment follows server-verified payment evidence.

Physical Store Controls

Use a simple opening and handover checklist:

1. Match the visible merchant name and masked UPI ID against an approved register.
2. Inspect edges for an overlay sticker or altered print.
3. Use a tamper-evident holder or sealed frame where practical.
4. Give every display an asset ID and assigned location.
5. Restrict replacement printing to authorized staff.
6. Remove old displays immediately after account or provider changes.

For high-volume counters, a screen-generated order QR reduces dependence on a permanent print. It still needs beneficiary controls: the application must derive merchant configuration from a protected backend, not browser input.

Train staff to verify payment in the merchant system. A customer’s phone screen or audio notification is not the merchant’s source of truth.

Website and Screen Controls

For online checkout:

• Generate payment sessions from the backend.
• Keep merchant-provider configuration out of editable page content.
• Use a strict Content Security Policy and protected deployment access.
• Never accept the payee UPI ID or amount from the browser.
• Display the merchant name and expected amount next to the QR.
• Record which approved provider connection created the order.
• Monitor unexpected changes to checkout assets and configuration.

Developers can use the Dynamic UPI QR API guide for the backend boundary. The QR is presentation; the stored order and verified payment result are authoritative.

Verify Payment, Not Screenshots

A secure fulfilment decision checks:

Evidence	Use
client_txn_id	Links the checkout to your website order
Gateway order ID	Identifies the payment session
Verified amount	Must equal the server-priced order
Final payment state	Must follow an allowed state transition
Event ID	Prevents repeated business effects
Provider/UTR reference	Supports reconciliation when available

If the customer claims payment but the order remains pending, do not ask for a UPI PIN, OTP, secret, or complete financial credentials. Use the order reference to check authenticated records. The UTR matching guide explains a tenant-scoped investigation.

Incident Response

If you discover a substituted or unauthorized QR:

1. Stop using the display or checkout immediately.
2. Preserve photographs, timestamps, asset IDs, access logs, and affected order references.
3. Replace the QR from the approved merchant configuration.
4. Identify the exposure window and review unmatched payments.
5. Notify the connected acquiring bank or merchant provider through its official support process.
6. Give affected customers a safe support channel.
7. Rotate related application credentials if the website or deployment was compromised.
8. Record the root cause and control change before reopening.

Do not publish complete customer references or payer details while investigating. Limit access to staff who need the evidence.

QR security is not solved by a better-looking sticker. It requires controlled generation, regular inspection, approved beneficiary data, server-side payment verification, and an incident process that finance and support can execute under pressure.