Thanks for your comments @Raghunath18. Based on that, I had another chat with my friend and he thought again and confessed that he did enter the UPI code. So you were right about it being a payment request. I have updated my post accordingly.
I wasn't aware cloning a site was so easy. Btw, I vaguely recall reading somewhere that GOI increased the limit on contactless transactions to ₹5,000.
Appreciate your inputs.