What is a payment QR code?¶

A payment QR code is a machine-readable image that contains payment information or a link to a payment service.

Avoid the dangerous assumption¶

The dangerous assumption is that the visible code proves the identity of the intended recipient or that scanning it automatically transfers money.

The code may contain a payment address, merchant identifier, account handle, amount, currency, reference or web link.

Some QR codes contain fixed details. Others are generated for a specific transaction and may expire or change status.

Scanning normally opens a payment application or webpage for the user to review and approve.

The code itself is therefore an instruction or route into a payment process, not proof that payment occurred.

Preserve the original image, document, message, poster or device screen containing the code.

Record where it was found, the date, time and surrounding text or branding.

Do not rely only on a later photograph if the original digital image or file can be preserved.

Where examination is needed, avoid using a personal or operational device without considering the risks of opening the destination.

Ask the relevant provider which account, merchant or payment request the encoded data identified.

Compare the code with transaction records, recipient details, messages and any physical location evidence.

A genuine provider QR code can still be used fraudulently if it directs payment to an offender-controlled account.

When reporting, distinguish the QR code, encoded data, payment request and completed transaction.

Operational takeaway¶

Treat a payment QR code as encoded payment instructions and preserve both the image and underlying data before tracing the provider account and any completed transaction.