Improve method of generating QR codes, perhaps use a secret key (per-event?) and hash that with the user's UPI, so forged QR codes can't be generated.