Payment QR codes: inspect the destination before approving
A printed code is not proof of trust: verify the website, recipient and amount before paying.
Guidance reviewed on 11 November 2026.
QR codes make it convenient to open a page or populate payment details, but they can conceal the destination until a phone scans them. A criminal may place a sticker over a legitimate code, send one in a supposed parcel notice or redirect a customer to an imitation payment page. FTC guidance during 2026 again warned consumers about fraudulent codes.
Before scanning, consider the context. Were you expecting the request? Does the sticker appear to cover another sign? After scanning, inspect the link preview where available instead of immediately entering information. If something seems wrong, open the official website or application independently, or check with staff through a clear, trusted channel.
For a payment, verify the recipient, amount and currency before approval. If the code opens a cryptocurrency wallet, also review the destination and network. Automatically preparing a transaction does not establish that the beneficiary is correct. Reject codes supplied by an unexpected caller who says money must be moved for protection, and do not let urgency replace checking.
If payment details were entered on a suspicious page, contact the provider promptly through a verified channel and ask about appropriate protection and dispute steps. Preserve the code, location, link and time without continuing to interact with the page. Reporting can help prevent further targeting, but does not guarantee reimbursement in every case.