The system in my country is that the QR code is meant to be public, and contains either your mobile number, or if you want to hide that, a UPI ID (which you can set and can be a random alphanumeric string). But having access to a person's QR only lets you send money to them. The payment verification happens between the sender and the central database, on behalf of the sender's bank, and can be done using a PIN / OTP.

For example, I go to a shop and buy sweets. The shopkeeper would have their QR code displayed prominently throughout the shop. I scan it to get their phone number / UPI ID, and then tell the app to send them so many rupees. The central database asks me to verify the payment. Once I verify, both I and the shopkeeper get an SMS saying x rupees was debited / credited. The app can also store transaction history in case there is any confusion later.

If I'm sending money to a friend, I already know their mobile number, so I can bypass the whole QR business and tell the app to just send money to their number.