UPI isn't QR based it you can also use UPI ID, which is like email. For eg: example@provider
And most UPI are linked with phone number, so you can also pay via phone number if UPI is linked with it.
And most UPI are linked with phone number, so you can also pay via phone number if UPI is linked with it.
it's literally one of the least secure things you can have.