Phone cameras open QR links the moment they read them. Check the code here first: you'll see the real destination, the real UPI payee, and anything that looks staged to deceive.
A QR code is just text your eye can't read. Two codes that look identical can lead to completely different places — which is why stickers get pasted over real payment codes at shops, petrol pumps and parking meters.
The dangerous moment is the scan itself: your camera reads the link and offers to open it, or your UPI app fills in a payee you never chose. Reading the code here first removes that moment. The image is decoded inside this browser tab and never sent anywhere — necessary, since these are often payment and KYC codes.