What UPI Actually Is and Why It Matters for a Small Property
Most homestays, hotels and resorts in India already accept UPI without thinking much about it: a guest scans a QR code at checkout, or sends money to a phone number written on a WhatsApp message, and the payment lands in a bank account a few seconds later. That everyday routine is UPI, the Unified Payments Interface built and operated by the National Payments Corporation of India (NPCI) under the Reserve Bank of India’s oversight. Guests use it because it is instant, free for them, and works with whichever bank app they already have installed.
For a small property owner, though, UPI payments for homestays and hotels involve a few decisions that are easy to get wrong: which account to link, whether to use a QR code or a payment link, how to tell a genuine payment from a fake one, how to reconcile dozens of small UPI credits against a calendar of bookings, and what to do when a guest disputes a charge or asks for a refund. None of this is complicated once it is laid out clearly, but almost none of it is taught anywhere, and the gap between “I accept UPI” and “I accept UPI safely and can account for every rupee” is where most of the actual problems in this guide come from.
This guide covers UPI and digital payments for homestays, hotels and resorts specifically from the property owner’s side: setting up UPI correctly, choosing between QR codes, payment links and collect requests, recognising the scams that specifically target hosts (not the generic consumer scams you may have already heard about), collecting advance payments and security deposits safely, reconciling transactions against bookings, handling refunds and disputes, and understanding how UPI interacts with your GST invoicing.
Setting Up UPI to Accept Guest Payments
The single most common mistake small properties make with UPI is running the entire business through a personal UPI ID, the same one linked to a personal savings account and used for splitting dinner bills with friends. It works, technically, but it creates real problems once bookings pick up: personal savings accounts have lower daily transaction ceilings on some banks, personal UPI apps are not built for reconciling dozens of payments against guest names and dates, and mixing guest payments with personal spending makes GST filing and income tax reporting far harder than it needs to be at return time.
Use a Current Account, Not a Savings Account
A current account in the property’s or business’s name, linked to a UPI ID through a business-oriented app (PhonePe for Business, Google Pay for Business, Paytm for Business, or a payment gateway like Razorpay or Cashfree that offers a UPI collection link), is the right foundation. Setting one up typically takes one to three working days and needs PAN and standard KYC (Know Your Customer) documents for the account holder, business registration proof where the property has one (GSTIN or Udyam registration), and standard bank KYC documents. Once the account is linked, the app generates a merchant UPI ID and QR code tied to the business name, so guests see the property’s registered name (not a personal name) when they scan to pay.
Properties using OpenStays do not need to set this up separately: OpenStays is an official Razorpay Platform Partner, and during onboarding it helps connect an existing Razorpay account or create a new one, so UPI, card and net banking collection is ready from the first booking.
Why the Business Name Showing Up Matters
When a guest’s UPI app shows an unfamiliar personal name at the payment confirmation screen, right before checkout, it is a legitimate moment of doubt for them, and a certain number of guests will hesitate or ask questions at exactly the moment you want the transaction to be quick. A UPI ID that resolves to the property’s actual business name removes that friction and also gives the property a small amount of protection against the QR-code-swap scam described later in this guide, since a guest who is used to seeing the correct business name is more likely to notice when a QR code resolves to something else.
One UPI ID for the Property, Not Several Staff Phones
In a small operation it is tempting to just let whichever staff member is on shift accept payment on their own personal UPI ID and settle up later. This is worth avoiding once a property has more than one or two people handling checkout: payments scattered across several personal accounts are close to impossible to reconcile properly against bookings, disappear into personal transaction history where an owner cannot see them, and create disputes about who collected what if a staff member leaves. One current account, one UPI ID (or one UPI ID per payment channel, such as one for the front desk QR code and one for advance-payment links), with staff trained to always direct guests to that ID, keeps the books clean from day one.
QR Codes, Payment Links and Collect Requests: Which to Use When
UPI gives a property three different ways to actually collect a payment from a guest, and they are not interchangeable. Using the wrong one in the wrong situation is where a lot of avoidable friction, and a fair amount of the fraud risk covered in the next section, actually comes from.
| Method | How it works | Best used for |
|---|---|---|
| Static QR code | A fixed code, usually printed and displayed at the front desk, that resolves to the property’s UPI ID. The guest scans it and types in the amount themselves. | In-person payment at check-in or checkout, where the guest is physically present and can be shown the confirmation screen before paying. |
| Payment link | A one-time link generated with a specific, pre-filled amount, sent to the guest by WhatsApp, SMS or email. The guest taps it and their UPI app opens with the amount already set. | Remote payments: booking deposits, advance payments before arrival, or balance amounts for a guest who has already checked out. |
| Collect request | The property sends a request through a UPI app asking the guest to approve and pay a specific amount. The guest gets a notification and approves it in their own app. | Rarely, and only when the guest has explicitly asked for one, because collect requests are also the exact mechanism scammers use to trick people into authorising payments. See the caution below. |
A UPI collect request and a UPI refund can look identical to a guest who is not paying close attention, because both show up as a notification asking them to enter their PIN. This is precisely the mechanic that scammers exploit (see the next section), so property staff sending a legitimate collect request should always follow it up with a WhatsApp message confirming the exact amount and purpose in plain text, so the guest has something to cross-check the request against before approving it.
For most day-to-day operations, a static QR code at the front desk covers in-person payments, and a payment link covers remote ones. That combination handles the large majority of situations a homestay, hotel or resort will run into, and avoids collect requests almost entirely, which is the safer default.
On OpenStays, this payment link is generated automatically: when a guest confirms a stay over WhatsApp, OpenStays sends a Razorpay payment link for the exact amount in the same conversation, so no one has to switch apps to create one by hand.
Static QR Code Versus Dynamic QR Code
A static QR code is fixed and reusable: it always resolves to the same UPI ID, and the guest types in the amount at their end. A dynamic QR code is generated fresh for each transaction with the amount already embedded, similar to what a supermarket checkout counter generates for each bill. For a small property, a printed static QR code at the front desk is almost always the practical choice: it costs nothing to produce, does not depend on a POS (point-of-sale) terminal or app being open at the exact moment of payment, and works even with a slow internet connection. A dynamic QR code removes the small risk of a guest mistyping the amount, but requires a device and staff member actively generating a new code for every single transaction, which is more overhead than most small properties need for the marginal benefit.
The UPI Scams That Specifically Target Hosts
Most UPI fraud advice online is written for the person paying, not the person getting paid, and warns guests about scams that happen to them. A homestay, hotel or resort sits on the other side of the transaction, and the scams that target that side work differently. These four are the ones worth actually training staff on, because each one has shown up repeatedly in reports from small merchants and hospitality businesses.
A fraudster visits the property (or a similar public-facing counter) and quietly places a sticker with their own UPI QR code directly over the property’s printed QR code, usually timed for when the front desk is unattended. Guests who scan it are shown a payment screen, and because the app shows a UPI ID rather than a business name they may not recognise, some pay without noticing anything is wrong. The property only discovers the theft when expected payments do not show up in the linked bank account. Prevention: check that any printed QR code sits flush against its surface and has not been overlaid with a second sticker, inspect it at the start of each shift, and prefer a QR code that is laminated into a stand or fixed to a wall rather than a loose card that is easy to swap. When in doubt, always confirm out loud with the guest which business name appeared on their payment confirmation screen before treating the payment as received.
This one specifically targets the refund and cancellation moments covered later in this guide. A person posing as a guest (or, less often, an actual guest acting in bad faith) says they were overcharged, double-charged, or need a deposit returned, and asks the property to “approve a request so the refund can be sent.” What actually arrives is a UPI collect request, worded to look like a refund, which if approved and PIN-entered authorises an outgoing payment FROM the property’s account TO the scammer, not the other way around. A property can never receive money by approving a request and entering its own PIN; PIN entry only ever authorises an outgoing payment. Prevention: refunds are always sent by the property choosing to pay the guest, never by the property approving an incoming-looking request; train every staff member who might handle a refund conversation on this one fact.
A guest, or someone posing as one, shows a screenshot or plays a fabricated voice message claiming a payment has been sent, and asks to be let into a room, given a key, or allowed to leave before the property has actually confirmed the money landed in its own account. Screenshots are trivially easy to fake or edit. Prevention: never treat a screenshot, a UPI reference number read aloud, or a “payment successful” message shown on someone else’s phone as proof of payment. Confirm every payment by checking the property’s own linked bank account or business app, where the credit will actually appear, before releasing a room, a key or a deposit.
Less a scam and more a costly mistake: a guest manually types a UPI ID from memory or a handwritten note instead of scanning the QR code, gets a digit or character wrong, and the payment goes to an unrelated stranger’s account rather than to the property. Because UPI IDs often look similar to each other (a property name plus a bank handle, for instance), a small typo is enough. Prevention: always have the guest scan the printed QR code directly rather than typing a UPI ID from a written note, and if a UPI ID must be shared in text (over WhatsApp for a remote booking, for example), send it as a tappable payment link rather than as plain text the guest has to retype by hand.
Collecting Advance Payments and Security Deposits via UPI
Asking a guest to pay something before arrival, whether a booking deposit to hold the dates or a refundable security deposit against damage, is normal practice across homestays, hotels and resorts in India. UPI makes this easy to collect, but a few habits make it easy to manage cleanly as well.
Send a Payment Link, Not a Bare UPI ID
For any advance payment collected before the guest physically arrives, a payment link with the exact amount pre-filled is safer and clearer than sending a UPI ID and asking the guest to type in an amount themselves. It removes the chance of the guest sending the wrong amount, and it gives both sides a specific, timestamped record of what was requested and for what.
OpenStays’ WhatsApp AI can send this link itself as part of the booking conversation, for either an advance or the full amount, which takes this step off a staff member’s task list entirely.
Say Exactly What the Deposit Is For, in Writing, Before Asking for It
A message that just says “please pay ₹2,000 deposit” invites a dispute later about what the deposit covers and when it gets returned. A message that says “₹2,000 refundable security deposit, to be returned by UPI within 24 hours of checkout provided there is no damage to the room” leaves no room for confusion on either side, and gives the property something specific to point back to if a guest disputes the deposit later. Put this in writing over WhatsApp or email before the payment link goes out, not verbally at check-in.
Track Every Deposit Separately From Regular Booking Revenue
A refundable deposit is not revenue, and treating it as part of the day’s takings makes it easy to lose track of which deposits are still owed back to which guest. A simple running list (guest name, dates, deposit amount, date received, date due back, date actually returned) prevents deposits from quietly turning into overdue refunds that guests eventually have to chase, which is a fast way to damage an otherwise good review.
Refundable Deposits and UPI’s Per-Transaction Limits
Standard UPI transactions are capped at ₹1,00,000 per transaction and, on most banks, ₹1,00,000 in aggregate across a rolling 24-hour window (not a calendar day). A small handful of banks set their own lower or higher ceilings, so it is worth checking the specific limit on whichever current account the property uses. For the vast majority of homestay, hotel and resort bookings, both the advance payment and the security deposit sit comfortably under this limit; it only becomes relevant for very high-value resort bookings or long-stay group bookings, where splitting a single large payment across more than one UPI transaction, or falling back to NEFT/RTGS (India’s standard interbank bank transfer methods) for that one payment, may be necessary.
Reconciling UPI Payments Against Bookings
This is the part of digital payments that rarely gets written about, and it is where a lot of small properties quietly lose money, not to fraud, but to their own bookkeeping gaps. A current account fed by dozens of small UPI credits every week, each showing only a UPI reference number and a payer name that may or may not match the guest’s name on the booking, is genuinely difficult to reconcile by memory once a property is running more than a handful of bookings a month.
Why UPI Reconciliation Breaks Down Without a System
A few things make this harder than it sounds: the name shown against a UPI credit is often the account holder’s name, not the guest’s name, if a guest pays from a family member’s account or a shared account. A guest who booked through an online travel agency (OTA) and also pays a balance amount directly by UPI creates two separate money trails for one stay. And a property with more than one payment channel (a QR code at the desk, a payment link for advances, occasionally cash) ends up with fragmented records across several places instead of one.
A Simple Reconciliation Habit That Scales
The fix does not need to be complicated: log every UPI payment against the booking it belongs to at the moment it is received, not at the end of the week from memory. A basic spreadsheet or booking register with columns for guest name, booking dates, amount due, amount received, UPI reference number and date received is enough for a small property, and turns reconciliation from a monthly guessing exercise into something that takes a few seconds per booking. Ask the guest’s UPI app for the transaction reference number (visible on both sides’ payment confirmation screens) whenever there is any ambiguity about which payment belongs to which booking, and note it down immediately.
This is the exact gap a connected booking-and-payment system closes automatically: on OpenStays, every Razorpay payment is tied to its booking the moment it is made, so the calendar itself shows what is paid, pending or refunded without a separate spreadsheet. Properties not using a system like this still need the manual habit described above.
Matching Advance Payments to the Final Bill
When a guest has already paid an advance or deposit by UPI before arrival, make sure the final bill presented at checkout clearly shows that amount as already paid, with its own UPI reference number, rather than asking the guest to pay the full amount again and sorting out the advance afterward. This single habit prevents more disputes than almost anything else in this section, because it removes any ambiguity at exactly the moment money is changing hands in person.
Refunds, Cancellations and UPI Disputes
Refunds are where UPI’s speed cuts both ways: sending money back to a guest takes seconds, but it also means a mistaken or fraudulent refund is just as fast to send and much harder to undo. A clear process here protects both the property and the guest.
Issuing a Genuine Refund
A property issues a refund by actively sending a payment to the guest’s UPI ID, the same way it would pay anyone else, never by “approving” an incoming-looking request (see the fake refund collect request scam covered earlier in this guide). Confirm the guest’s UPI ID directly with them, in writing, before sending anything back, since a refund sent to the wrong ID is very difficult to reverse once it lands.
OpenStays’ Razorpay integration supports one-click refunds back to the guest’s original payment source, logged automatically against the same booking, which removes this manual confirm-the-UPI-ID step for properties collecting payment that way.
When a Payment Fails or Goes Missing
Occasionally a guest’s account is debited but the payment never actually reaches the property’s account, usually because of a timeout or a bank-side technical failure rather than anything either side did wrong. NPCI runs a formal dispute mechanism for exactly this called UDIR (UPI Dispute and Issue Resolution), accessible through the same UPI app either side used, without any extra paperwork or fee.
| Situation | Typical resolution time |
|---|---|
| Payment failed outright (no debit completed) | Usually resolves itself; no dispute needed |
| Amount debited from guest but not credited to property | Auto-reversal to the guest, typically within 1 to 3 working days |
| Wrong beneficiary or incorrect account credited | Investigation and resolution typically within 5 to 7 working days |
| Suspected fraud or unauthorised transaction | Investigation typically within 10 to 15 working days; report within 3 days of noticing it for the strongest protection |
These timelines are typical ranges reported by banks and payment apps rather than a fixed legal guarantee, and can run longer for a genuinely complex case. To raise a dispute: open the transaction in the UPI app it was made through, select the specific payment, choose “raise a complaint” or “report an issue,” and provide the transaction reference number along with a short description of what went wrong. If the bank or app does not resolve it within a reasonable time, the complaint can be escalated to NPCI directly, and from there to the RBI’s ombudsman for digital transactions if it still remains unresolved.
If the Property Suspects It Has Been Defrauded
Report it immediately, both to the bank that holds the linked current account and, for anything above a token amount, to India’s national cybercrime portal or the 1930 cybercrime helpline. Speed matters more than almost anything else here: banks have a real chance of freezing a fraudulent transfer before it is withdrawn if it is reported within hours, and almost no chance once a few days have passed.
UPI Payments and Your GST Invoicing
A common point of confusion: GST does not apply to the UPI transaction itself. Money moving from a guest’s account to the property’s account is not, on its own, a taxable supply of goods or services, so there is no GST charged on the act of paying or receiving by UPI, and no Merchant Discount Rate either, which is one of the reasons UPI has become the default payment method for small businesses across India.
What still applies, exactly as it would if the guest paid by cash or card, is GST on the underlying stay itself, for any property registered under GST (see the full breakdown of thresholds and rates on the GST for Homestays page). The payment method a guest chooses has no bearing on whether GST applies to the booking, what rate applies, or how it gets reported.
What to Do at the Time of Payment
Issue the same GST-compliant invoice for a UPI-paid booking as for any other: a sequential invoice number, the property’s GSTIN, the guest’s name and address where required, the room rate, the applicable GST rate and amount, and the total. Note the UPI reference number on the invoice or in the property’s booking register purely as a payment record, not as a tax field. Report the sale normally in GSTR-1 and GSTR-3B, exactly as it would be reported for a cash or card payment. UPI payments simply show up as ordinary business income in the current account, the same as any other payment method, when the property’s books are prepared.
UPI Transaction Limits Worth Knowing
UPI’s standard per-transaction and daily limits are set by NPCI, but the account-holding bank can set its own lower ceiling, so the limit that actually applies depends on which bank holds the property’s current account.
| Bank or account type | Typical daily UPI limit |
|---|---|
| Most major banks (SBI, HDFC Bank, ICICI Bank, Axis Bank) | ₹1,00,000, in a rolling 24-hour window from the first transaction of the day |
| Punjab National Bank | ₹50,000 |
| Union Bank of India | ₹2,00,000 |
| Regional rural banks | ₹5,000 to ₹25,000 per transaction, varies by bank |
| Co-operative banks | ₹25,000 to ₹1,00,000, varies by bank |
A small number of specific merchant categories, such as hospital bills, insurance premiums and education fees, are permitted higher per-transaction ceilings of up to ₹5,00,000 by NPCI, but hospitality bookings are not currently one of them, so the standard limit is the one that applies. For the overwhelming majority of homestay, hotel and resort bookings this is not a practical constraint; it only becomes relevant for very high-value or long-stay resort bookings, where a payment can be split across more than one UPI transaction, or collected via NEFT/RTGS instead for that specific amount.
Where Cards, Net Banking and Other Digital Payments Fit In
UPI has become the default for a reason: it is instant, free to accept, and works for almost every domestic guest. It is not, however, the only digital payment method a homestay, hotel or resort needs, and a property that only accepts UPI can find itself unable to collect payment in a few specific situations.
Cards
Credit and debit cards still matter for two groups: foreign guests who have not set up UPI One World or a similar option (see the FAQ later in this guide), and Indian guests who prefer to pay by card for the reward points or the ability to dispute a charge through their card network rather than through UPI. Accepting cards means either a physical POS machine or a payment-link/gateway option that supports card payments alongside UPI, and, unlike UPI, card payments do carry a Merchant Discount Rate, typically charged by the bank or payment gateway providing the POS terminal or gateway service, with 18% GST applied to that MDR fee itself, not to the underlying room charge.
Net Banking and Bank Transfers (NEFT/RTGS)
For a booking that exceeds UPI’s standard ₹1,00,000 transaction limit, such as a large resort booking, a long corporate stay, or a wedding/event block booking, a direct NEFT or RTGS bank transfer remains the straightforward option, since these do not carry the same per-transaction ceiling. Corporate guests in particular may also prefer net banking or a bank transfer over UPI simply because it fits their own company’s expense and approval workflow better.
OTA-Collected Payments
When a guest books and pays through an online travel agency, that payment never touches the property’s own UPI ID at all; the OTA collects it and pays the property out separately, usually on a delay and after deducting its commission. This is worth keeping distinct in the property’s own records from any UPI or card payment collected directly, since mixing the two makes it easy to double-count or undercount revenue for a given booking (see the reconciliation section earlier in this guide, and the real-world scenario further ahead covering an OTA guest who also pays a balance directly).
None of this changes the core recommendation of this guide: UPI should be the default for the large majority of domestic, in-person and remote-advance payments, with cards and bank transfers kept available as a fallback for the guests and booking sizes where UPI genuinely does not fit.
Scaling This to the Size of Your Property
One printed static QR code at the entrance or handed to the guest at arrival covers nearly everything. A single owner-operator UPI ID linked to a personal-but-dedicated or basic current account is usually enough; a full business app with staff logins is more than a one-person operation typically needs. Keep the reconciliation spreadsheet simple: a booking date, guest name and UPI reference number is enough at this scale.
This is the point where a shared front-desk device and a business UPI app with a fixed QR code stand at the check-in counter earns its keep, along with a habit of every shift logging payments at the time they are received rather than at shift-end. It is also the point where more than one staff member is likely to be handling payments, which makes the “one UPI ID for the whole property” rule and the staff training on the collect-request scam genuinely necessary rather than optional.
At this size, a payment gateway (Razorpay, Cashfree or similar) that combines UPI, cards and net banking into a single collection link is usually worth the modest setup effort, since it gives one dashboard to reconcile against instead of several separate payment channels. High-value bookings that exceed UPI’s standard transaction limit, and advance payments for large group or event bookings, are also more common at this scale, so having NEFT/RTGS set up as a routine fallback (not an exception to figure out on the day) matters more here than at a small homestay. Properties on OpenStays get this without extra setup: Razorpay (OpenStays’ payment partner) already handles packages, part-payments and large group bookings for weddings, retreats and long stays.
Real Scenarios: Applying This at the Front Desk
The rules above are straightforward on their own; the trouble usually shows up in a specific, slightly awkward moment at check-in or checkout. Here is how the guidance covered earlier in this guide actually plays out in a few of the situations that come up most often.
A guest arrives right as one staff member is handing off to the next, and wants to pay the full stay upfront by scanning the front desk QR code.
Show the guest the amount to confirm before they scan, so there is no ambiguity about what is being paid for.
After the guest pays, check the property’s own banking app for the credit rather than accepting a screenshot from the guest’s phone as proof.
Log the payment against the booking immediately, with the UPI reference number, before the next guest or task takes over attention.
A guest booking a stay two weeks out asks how to pay the ₹3,000 refundable deposit mentioned in the booking confirmation.
In the same message, restate in writing what the deposit is for and when it will be returned (see the deposits section earlier in this guide).
Once paid, note the amount, date and UPI reference number against the booking in the property’s tracking sheet, marked clearly as a deposit rather than as stay revenue.
Set a reminder for the deposit return date so it does not quietly become an overdue refund.
A guest at checkout insists the balance amount has been paid and shows a screenshot of a “payment successful” message.
Check the property’s own banking or business app for a matching credit around the time the guest says they paid.
If nothing has arrived, ask the guest for the UPI reference number from their side and check whether the payment might be pending or was sent to a mistyped UPI ID rather than the printed QR code.
If the money genuinely has not moved, ask the guest to retry using the printed QR code directly rather than a saved or remembered UPI ID.
A guest arrives having booked and part-paid through an online travel agency, and offers to pay the remaining balance by UPI at checkout.
Collect only the genuine balance owed directly to the property by UPI, and note both the OTA-collected portion and the directly-collected portion separately in the booking record.
Issue the guest a clear final bill showing both amounts, so there is no confusion later about what was paid where.
Someone claiming to be a recent guest messages saying they were accidentally overcharged and asks the property to “approve the refund request” that is about to arrive.
Check the actual booking and payment record for that guest’s stay before agreeing anything was overcharged in the first place.
If a refund is genuinely owed, send it by actively initiating a payment to the guest’s confirmed UPI ID, never by responding to an inbound request.
If the request still arrives, decline it and do not enter a UPI PIN at any point in the process.
Common Mistakes Homestays and Hotels Make With UPI
- Running all guest payments through a personal UPI ID on a personal savings account instead of a business current account, making reconciliation and GST filing far harder than necessary.
- Approving a UPI collect request that arrives framed as a refund, without checking that a property can never receive money by entering its own PIN.
- Accepting a screenshot or a verbally-read reference number as proof of payment instead of checking the property’s own bank account for the actual credit.
- Leaving a printed QR code unattended and unchecked for long stretches, making it an easy target for the sticker-swap scam.
- Sending a bare UPI ID by WhatsApp for a remote advance payment instead of a payment link with the amount pre-filled, leaving room for the guest to send the wrong amount.
- Not logging UPI payments against specific bookings at the time they are received, leaving a backlog of unmatched credits to sort out later from memory.
- Treating a refundable security deposit as ordinary revenue instead of tracking it separately until it is returned.
- Asking a guest to pay a balance amount again at checkout without first checking what portion an OTA may already have collected on the property’s behalf.
Quick-Reference: UPI Payment Message Templates
A few ready-to-use WhatsApp message templates for the payment moments covered in this guide. These follow the same style as the templates on the WhatsApp Guest Communication Templates page and can be copied directly, with the bracketed details filled in for each booking.
Send when requesting a booking deposit or advance
Hi [Guest Name], thank you for booking [Property Name] for [Dates]. To confirm your reservation, please pay a [refundable/non-refundable] advance of ₹[Amount] using this link: [Payment Link]. This covers [what it covers]. Let us know once it’s done and we’ll send a confirmation.
Send immediately after a payment is confirmed in the bank account
Hi [Guest Name], we’ve received your payment of ₹[Amount] (reference [UPI Ref Number]). Your booking for [Dates] is confirmed. Looking forward to hosting you!
Send along with or before the deposit payment link
Hi [Guest Name], as mentioned in your booking, we collect a refundable security deposit of ₹[Amount], which will be returned by UPI within [Timeframe] of checkout provided there is no damage to the room or missing items. You can pay it here: [Payment Link].
Send when returning a security deposit after checkout
Hi [Guest Name], thank you for staying with us. Your security deposit of ₹[Amount] has been refunded to your UPI ID (reference [UPI Ref Number]). It should reflect in your account shortly. We hope to host you again!
Keep this as a standing reminder near the front desk, not a guest-facing message
Reminder: we never receive money by approving an incoming UPI request or entering our PIN. Refunds are only ever sent by us actively paying the guest. If anyone claiming to be a guest or vendor asks you to “approve a request” to receive a refund or payment, decline and flag it to the owner immediately.
How OpenStays Fits Into This
OpenStays is an official Razorpay Platform Partner, so the payment side of everything covered in this guide is built in rather than bolted on. Guest payments run on Razorpay’s own infrastructure (RBI-authorised, PCI DSS Level 1 certified) whether a guest pays on an OpenStays booking page or taps a payment link sent inside a WhatsApp conversation, and the money settles directly into the property’s own bank account on Razorpay’s normal settlement cycle. OpenStays is never in between; it does not hold guest funds at any stage, and it does not take a commission on bookings, so there is no markup on top of Razorpay’s standard processing fees.
During onboarding, OpenStays helps a property connect an existing Razorpay account or open a new one, which covers the setup step described earlier in this guide. From there, the WhatsApp AI can generate and send a Razorpay payment link itself, for an advance or a full amount, in the same conversation where the booking gets confirmed, and every payment is tied automatically to its booking, so the property’s calendar shows what is paid, pending or refunded without a separate reconciliation spreadsheet. Refunds work the same way in reverse: one click, sent back to the guest’s original payment source, logged against the same booking.
None of this replaces the judgement calls covered throughout this guide. OpenStays and Razorpay do not check whether a printed QR code has been swapped, and a payment routed through Razorpay is still worth confirming the same way as any other payment before a room key changes hands. What the integration does remove is the manual, error-prone parts: creating a payment link by hand, matching a UPI reference number to a booking after the fact, and issuing a refund without a record tying it back to the original charge.
Regulatory Backdrop: Who Actually Runs UPI
UPI is built and operated by the National Payments Corporation of India (NPCI), the umbrella organisation for retail payments in the country, and functions under the regulatory oversight of the Reserve Bank of India. Neither body sets rules specific to homestays or hotels; UPI works identically for a resort accepting a booking payment and a street vendor accepting payment for tea, and every rule covered in this guide, from the ₹1,00,000 standard transaction limit to the UDIR dispute mechanism, applies the same way to any business accepting UPI. NPCI publishes its own transaction volume and value data monthly, which is where the statistics cited earlier in this guide come from. See NPCI’s UPI product statistics page for the latest figures.
- NPCI (National Payments Corporation of India): builds and operates UPI, sets the standard transaction limits and the UDIR dispute mechanism.
- Reserve Bank of India (RBI): regulates UPI as part of the broader payment and settlement systems framework, and its ombudsman for digital transactions is the final escalation point for an unresolved dispute.
- The property’s own bank: holds the linked current account, applies its own daily limit (which may be lower than the NPCI standard), and is the first point of contact for a fraud report or a failed-transaction dispute.
Frequently Asked Questions
Is UPI safe enough to be a homestay or hotel’s main payment method?
Yes, UPI itself is a secure, RBI-regulated payment rail, and the vast majority of transactions go through without any issue. The risk in practice does not come from UPI as a system, it comes from the specific scams covered earlier in this guide, like a swapped QR code or a fake refund request, which target the humans handling the transaction rather than the system itself. A property that trains staff on those specific patterns, uses a business current account, and confirms every payment in its own bank account before releasing a room is on solid footing.
Does GST apply to UPI payments?
No, GST does not apply to the UPI transaction itself, and there is no fee (Merchant Discount Rate) charged on a standard UPI payment to a bank account. GST still applies to the underlying stay, at whatever rate applies to the property, exactly the same as if the guest paid by cash or card. See the GST for Homestays page for the full rate and threshold breakdown.
A guest says their payment was deducted but I never received it. What do I do?
This is usually a technical failure rather than fraud, and NPCI’s UDIR (UPI Dispute and Issue Resolution) mechanism exists specifically for it. Ask the guest for the UPI transaction reference number, check the property’s own bank account for a delayed credit first, and if it genuinely never arrived, raise a dispute through the UPI app the payment was made through. Amounts debited but not credited are typically auto-reversed to the guest within 1 to 3 working days, so in most cases the simplest fix is for the guest to check their own account for the reversal and pay again.
Can I ask a guest to pay a security deposit by UPI?
Yes, this is common practice. State the exact amount, what it covers, and exactly when it will be returned in writing before sending the payment link, and track it separately from ordinary booking revenue until it is actually refunded. See the deposits section earlier in this guide for the full process.
What is the UPI transaction limit for a homestay, hotel or resort?
The NPCI standard is ₹1,00,000 per transaction and ₹1,00,000 in aggregate across a rolling 24-hour window, though the property’s specific bank may set a different ceiling (see the transaction limits table earlier in this guide). This comfortably covers the large majority of bookings; a very high-value or long-stay booking may need to be split across more than one transaction or collected via NEFT/RTGS instead.
How do I know if a QR code has been tampered with?
Check that it sits flush against its surface rather than looking like a sticker placed on top of another one, inspect it at the start of each shift, and confirm out loud which business name appears on the guest’s payment confirmation screen before treating a payment as received. A laminated or wall-fixed QR code is harder to swap than a loose printed card.
Should I use my personal UPI ID or set up a business one?
A business current account linked to a UPI ID through a business app is the better choice once a property is taking more than a handful of bookings, because it keeps guest payments separate from personal spending, shows the property’s registered business name to guests at the point of payment, and makes reconciliation and GST filing considerably easier. See the setup section earlier in this guide for what is needed to open one.
What if a guest disputes a UPI payment after checking out?
Pull up the booking record, the invoice, and the UPI reference number for the payment in question first, since most disputes resolve quickly once both sides can see the same transaction reference. If the guest genuinely was overcharged, refund the difference by actively sending a payment to their confirmed UPI ID, never by approving an inbound-looking request. If the dispute cannot be resolved directly, either side can raise it formally through UDIR in the relevant UPI app.
Is there any fee for accepting UPI payments?
No. Standard UPI payments to a bank account carry a 0% Merchant Discount Rate (MDR), unlike credit or debit card payments, which do involve a fee charged by the card network and acquiring bank. This is one of the reasons UPI has become the default payment method for small businesses across India rather than card machines.
Can foreign guests pay by UPI?
Increasingly, yes. NPCI’s “UPI One World” is a prepaid wallet linked to UPI that lets foreign visitors complete passport-based KYC and load funds, then scan the same UPI QR codes any domestic guest would use, without needing an Indian bank account. From the property’s side, receiving the payment works exactly the same as any other UPI payment; the only difference is on the traveller’s end during setup. Guests who have not set this up will typically pay by card or cash instead.
In Summary
UPI has already become the default way guests pay homestays, hotels and resorts across India, and most of it works without any real effort from the property. The parts that need actual attention are narrow and specific: link a business current account instead of a personal one, use a static QR code for in-person payments and a payment link for remote ones, and treat any inbound-looking payment request, especially one framed as a refund, with the same caution covered earlier in this guide. Confirm every payment in the property’s own bank account rather than trusting a screenshot, log each UPI payment against its booking as it comes in, and keep security deposits tracked separately until they are actually returned.
None of this requires new equipment or ongoing cost. A printed QR code, a business UPI app, and a short training conversation with front-desk staff cover almost everything in this guide, and the return on that small amount of setup is a payment process that is fast for guests, easy to reconcile at month-end, and considerably harder to defraud.
This guide is for general informational purposes and reflects UPI rules, NPCI processes and typical bank practices as understood at the time of writing. It is not financial, legal or security advice. For guidance specific to your property’s bank, payment provider or a suspected fraud incident, consult your bank, a qualified professional, or India’s national cybercrime helpline (1930) directly.