QR code payments are safe when you check two things before confirming: the recipient's name and the amount on your screen. Most QR payment fraud happens when someone skips that check — because a sticker covered the shop's real code, or a scammer sent a code that takes money out instead of putting money in. This guide explains how these payments work, what the common tricks look like, and a simple checklist for both customers and shop owners.
How QR code payments actually work
A QR code is just a square barcode that stores text. In payments, that text usually points to a payment request: it can contain a merchant identifier, a payment app link, or account details. When you scan it with your banking or payment app, the app reads the details and shows you a confirmation screen.
The key point: scanning does not pay anyone. Scanning only opens a draft of a transaction. The payment happens when you review the details and confirm — usually with a PIN, fingerprint, or face unlock. That confirmation screen is your chance to catch a problem, and it is the single most important moment in the whole process.
There are two common flows:
- Customer scans a merchant's code. You scan the code at a shop counter or on a stand, the app shows the merchant's name, you enter or confirm the amount, and you approve.
- Merchant scans the customer. Some systems let the shop scan a code in your app, then you approve the amount they entered. Here the shop controls the amount, so watch the screen they show you or the amount that appears in your own app.
Some codes are "static" — the same printed code is used every time, and you type the amount yourself. Others are "dynamic" — a screen or receipt shows a fresh code with the exact amount already included. Dynamic codes are harder to tamper with, but both types end at the same place: a confirmation screen showing who gets paid and how much.
Why QR payments are targeted
QR codes are convenient precisely because they are opaque. A human cannot read a QR code by looking at it. You have no idea what it contains until an app decodes it. That gap between what you see (a harmless-looking square) and what it does (starts a payment) is exactly what fraudsters exploit.
The second reason is habit. Once people scan codes a few times without problems, scanning becomes automatic — point, tap, confirm — sometimes in seconds, without reading the screen. Speed is good for queues, but it removes the one checkpoint that protects you.
The good news: because a QR payment always ends with a confirmation screen showing the recipient and amount, almost every common QR scam is visible at that moment. The tricks below all try to make you either skip that screen or misread it.
The sticker trick: a fake code pasted over a real one
This is the classic QR payment scam. A fraudster prints their own payment code — one that sends money to their account — and sticks it over the legitimate code at a parking meter, a small shop counter, a market stall, a bike rental point, or a poster advertising a donation.
You scan what looks like the normal code, the app shows a name you don't recognise (or you don't check), you type the amount, and you pay the wrong person. The shop never receives the money and may still treat your bill as unpaid, so you can lose twice.
Protecting yourself takes seconds:
- Look at the code itself before scanning. Is it a sticker sitting on top of something else? Are the edges lifted? Does it sit slightly crooked or on a different material than its surroundings? A code taped over a printed sign is a red flag.
- After scanning, read the recipient name on the confirmation screen. If you are paying "City Parking" and the screen shows a personal name, stop.
- If the code looks tampered with, tell the staff or the owner of the machine, and pay another way.
"Scan to receive money" — the reverse scam
This one catches people who assume every payment QR code works the same way. A scammer contacts you — posing as a buyer on a marketplace, a "refund agent" from a delivery company, or someone who claims they owe you money — and sends you a QR code to scan "so the money can reach you."
Here is the trap: scanning a code and confirming does not bring money in. In the flows most people use, scanning a payment code starts a payment from your account to someone else. The scammer's code is just a payment request to them. You confirm, and you have paid them — the opposite of what was promised.
The rule is simple and worth memorising: you never scan a code to receive money. Money coming to you does not require you to scan anything and confirm a payment. If someone insists that scanning their code is necessary to "release" funds, "verify your account," or "complete a refund," that is a scam. A genuine refund is initiated by the sender; at most you might receive a payment link in your own app's request feature — and even then, a real refund never needs you to enter a PIN or approve an outgoing payment.
Urgent messages and pressure
Many QR payment scams arrive by message: an SMS or chat app message that looks like it comes from a delivery company, a government office, your bank, or a marketplace buyer. The message creates urgency — "your parcel is held, scan to pay a small customs fee," "your account will be blocked, scan to verify," "I'm ready to buy your item, scan to receive the deposit" — and includes a QR code or a link to one.
Urgency is the tell. Real organisations do not demand payment or account verification through a QR code in an unsolicited message, and they do not give you minutes to act. When a message pushes you to scan now or lose something, the push itself is the warning.
Safe habits for unsolicited codes:
- Do not scan codes from messages you did not expect, even if the sender looks official. Sender names and logos are easy to fake.
- If the message claims to be from a company you actually deal with, contact that company through the number on your card, your app, or their official website — not through anything in the message.
- Never enter card details, passwords, or one-time codes on a website you reached by scanning a code in a message. A payment confirmation in your own app is one thing; a random webpage asking for credentials is another.
Edited amounts and screen-checking habits
In person-to-person payments and some merchant flows, the amount is typed in by a person: the seller enters it, or you do. Fraud in this space is usually crude — an inflated amount, a double charge, or a "deposit plus fee" structure that makes no sense.
Your defence is the confirmation screen. Before you approve any payment, read three things:
- The recipient's name. Does it match the person or business you intend to pay? If you are paying a friend, is it the right friend? Saved contacts and similar names cause honest mistakes too.
- The amount. Digit by digit, including decimals. "45.00" and "450.00" differ by one tap on many keyboards.
- The currency and any fee line, if your app shows one, especially for cross-border payments.
If someone is standing next you, guiding you to "just confirm quickly," slow down. Pressure at the confirmation screen — a seller grabbing your phone, a "helper" typing for you, a crowd hurrying you — is a pattern worth treating with suspicion. Take your phone back, read the screen, and if something is off, cancel. Cancelling a pending payment confirmation is always safe; the payment has not happened yet.
Checklist for customers
Before every QR payment, run through this short list. It takes longer to read than to do.
- Inspect the code's physical state. At a counter, machine, or poster: no stickers, no lifted edges, no code sitting oddly on top of another.
- Scan with your own trusted app, opened from your phone — not a camera app that opens unknown links, and not a scanner the seller hands you.
- Read the recipient name on the confirmation screen. Match it to who you intend to pay.
- Read the amount, digit by digit, before confirming.
- Never scan a code to receive money. Incoming money does not need your confirmation of an outgoing payment.
- Ignore urgent codes in unexpected messages. Verify through official channels instead.
- Use a private screen and a real PIN or biometric check. Don't approve payments while someone else holds or watches your phone closely.
- Keep the receipt or confirmation screenshot until you are sure the payment was correct. It is your evidence if something goes wrong.
- Report problems immediately. If you paid the wrong code or confirmed a fraudulent request, contact your bank or payment provider right away and ask what options exist. Speed matters; do not wait.
Checklist for shop owners
Shop owners protect themselves and their customers with a few habits.
- Check your printed codes daily. Look for stickers, overlays, or replaced cards at every counter, stand, and machine. Make it part of the opening routine.
- Mount codes where they can't be quietly swapped — behind the counter, laminated, or on a stand you can see from your working position. Keep the display or stand under your supervision; a code on an unattended table at the far end of the shop is an invitation.
- Use dynamic codes where your provider supports them — a fresh code per transaction with the amount included leaves nothing for a fraudster to overlay with a different amount.
- Confirm receipt before handing over goods. Check that the money actually arrived in your account — a screenshot from the customer is not proof; a notification in your own app or a look at your account statement is. This also catches the "I paid" bluff and the wrong-code accident where the customer paid someone else.
- Tell staff what to watch for: a customer asking to "fix" the code, a sticker you didn't put there, a customer who seems confused about the recipient name.
- Act fast if a code was tampered with. Replace it, tell your payment provider, and put up a short notice asking customers who paid a wrong code recently to contact you — you may be able to sort out who owes what, and your provider may be able to act on reports.
- Report fraud to your bank or payment provider even if the loss seems small. Reports help providers identify patterns and warn other merchants.
What to do if something goes wrong
Mistakes and fraud both happen. The response is the same:
- Stop. Do not send more money, and do not scan anything else the other party sends "to fix it." A common follow-up scam asks victims to pay a "recovery fee."
- Contact your bank or payment provider immediately through the official app or the number on your card. Explain what happened, when, and how much. Ask what options exist — some providers can freeze, reverse, or investigate transactions, and the odds are better the sooner you report.
- Keep the evidence. Screenshot the confirmation, the chat messages, and the code if you can. Do not delete the conversation.
- Warn the other side if it's a merchant. If you scanned a tampered code at a shop, the shop lost a sale and may not know its code was replaced. Telling them helps everyone.
- Report to the relevant authorities or consumer channels in your country if the provider directs you to do so.
No one can promise that a mistaken payment will be recovered — that depends on the provider, the timing, and the circumstances. But fast reporting is always better than slow reporting, and in many cases it is the difference between a recoverable error and a permanent loss.
Conclusion
QR payments are neither dangerous nor magic — they are a payment instruction that ends at a screen you control. The entire safety game lives in that screen. Check the recipient's name and the amount before you confirm, never scan a code in order to receive money, distrust urgent codes in unexpected messages, and if you run a shop, keep your printed codes where only you can change them. Do those four things every time, and the most common QR payment scams have nothing left to work with.