QR Code for UPI Payments: Setup Guide for Indian Merchants (2026)

A UPI QR code encodes your payment address and, sometimes, an amount. When a customer scans it with any UPI app, that app reads your details and initiates a transfer to your account.

The interoperability point, which matters a lot: UPI QR codes are interoperable. A customer can scan your QR with whichever UPI app they use, and it works. You do not need your customer to use the same app you do, and you do not need a separate QR for each app. One QR code accepts payment from any UPI-enabled app.

This is genuinely important and often misunderstood. Merchants sometimes display several QR codes for different apps, which is unnecessary clutter. A single UPI QR is sufficient.

What the code contains: At minimum, your UPI payment address (the identifier that routes money to your account) and usually your merchant name so the customer sees who they are paying. Dynamic versions can also carry a specific amount and a transaction reference.

What happens on scan: 1. The customer scans your QR with their UPI app 2. Their app reads your payment details 3. They confirm the amount (or it is pre-filled for dynamic codes) and authenticate 4. The transfer is initiated, and both sides get confirmation

Where the money goes: That depends on how you obtained the QR. A code tied to a personal UPI ID routes to that personal account. A merchant QR obtained through a payment provider routes according to that provider's settlement terms. This distinction matters for bookkeeping and tax, which is covered below.

This is the distinction merchants most often get wrong, and it is different from the static-vs-dynamic distinction used for marketing QR codes.

Best for: small retail, street vendors, cafes, salons, and anywhere the amount varies and the customer can reasonably enter it.

Downside: the customer entering the amount introduces error and slows checkout slightly. Reconciliation is also looser, since nothing ties a payment to a specific bill.

Best for: higher-value transactions, businesses with billing systems, restaurants issuing bills, and anywhere accuracy and reconciliation matter.

Downside: requires integration with a POS or payment provider, so there is setup involved.

How to choose: If your amounts are small and varied and you want zero setup, static is fine and is what most small merchants use. If you issue bills, handle larger amounts, or need clean reconciliation against invoices, dynamic is worth the integration.

Important terminology note: A "static" UPI QR is still reusable forever, unlike a static marketing QR code which is problematic precisely because it cannot be changed. The words mean different things in the two contexts. See dynamic vs static QR codes for the marketing sense.

There are a few routes, and the right one depends on your scale and whether you need proper merchant facilities.

Route 1: Through a UPI app's merchant offering. The major UPI apps offer merchant accounts with a printed QR standee. This is the most common route for small shops. You register as a merchant, verify your details, and receive a QR to display.

Route 2: Through a payment gateway or provider. Payment providers offer merchant QR solutions, usually with better reporting, settlement control, and integration options. Suitable if you need reconciliation, multiple payment methods, or an API.

Route 3: Through your bank. Most banks offer merchant UPI QR facilities tied directly to your current account. Sensible if you prefer keeping banking and payments with one institution.

Route 4: Personal UPI ID (use with caution). You can technically display a personal UPI QR. Many very small vendors do. But this mixes personal and business funds, complicates bookkeeping and tax, and may fall outside the terms intended for personal accounts at volume. If you are running an actual business, get a proper merchant QR.

What you will generally need: Business identity and bank details, and depending on the route, business registration documents. Requirements vary by provider, so check current requirements with whichever you choose.

On charges: Fee structures for UPI transactions vary by provider, transaction type, and current regulation, and they change. Confirm current charges directly with your chosen provider rather than relying on any article, including this one.

This is the most important security section in this guide, because it involves real money and it targets merchants directly.

The scam: A fraudster covers your displayed UPI QR with their own printed sticker. Customers scan what looks like your code, pay in good faith, and the money goes to the fraudster's account. You do not receive the payment, and the customer believes they have paid.

It works because a QR code is opaque. Nobody can tell by looking whether the code routes to you or to someone else. This has been documented at shops, fuel stations, and parking areas.

How to protect your business:

Check your QR physically, regularly. Make it a daily habit, ideally at opening. Look for a sticker layered over your original, edges that do not match, or a code that looks freshly applied. This single habit is the strongest defense.

Confirm payments rather than trusting the customer's screen. Verify against your own payment notification or app, not the customer's "payment successful" screen. A fraudulent payment shows as successful on the customer's phone because it genuinely succeeded, just to the wrong account.

Use tamper-evident or enclosed displays. A QR standee in a rigid enclosure, behind acrylic, or laminated and mounted flush is harder to cover convincingly than a paper sheet taped to a counter.

Position it where you can see it. A QR within your line of sight is far harder to tamper with than one on an outside wall or a pillar away from the counter.

Enable payment alerts. Real-time notifications let you confirm each payment as it lands, so a missing payment surfaces immediately rather than at end-of-day reconciliation.

If you find a tampered code: Remove it, preserve it if you can, report it to your payment provider and to the police, and inform affected customers. Prompt reporting protects both you and other merchants.

For the broader security picture, see our QR code security guide.

These are two different tools that happen to share a format, and conflating them causes real confusion.

Why the distinction matters practically: Merchants sometimes ask whether they can create their own UPI QR on a QR generator. You cannot meaningfully do that, because a payment QR must be issued through the payment system to route funds correctly and securely. Get it from your provider.

Equally, merchants sometimes only display a payment QR and miss the marketing opportunity entirely. The two work well together:

Keep them visually distinct and clearly labeled so customers do not scan the wrong one. Label the payment code clearly as payment, and the others by their benefit.

See our guides on Google review QR codes and WhatsApp Business QR codes for the marketing side.