Does scanning a QR code prove that a payment was made?¶

No. Scanning a payment QR code normally opens a payment page or application; it does not by itself prove that money moved.

Avoid the dangerous assumption¶

The dangerous assumption is that a scan event is the same as authorisation or completion of payment.

After scanning, the user may review the recipient, amount and reference.

They may cancel, change details, fail authentication, receive a decline or abandon the process.

The provider may record that the code or link was opened without recording a successful transaction. A scan may also generate only a browser or application access event.

A completed payment should have separate transaction, authorisation or settlement records.

Preserve the QR code, encoded destination, scan context, payment-request ID and any screen or message showing the result.

Obtain records from the payment application, provider, bank, card issuer or wallet involved.

Look for transaction status, amount, recipient, timestamp, authentication and reference.

Do not assume that the device that scanned the code belonged to the payer.

A shared, borrowed or compromised device may have been used.

Likewise, a successful payment may have been completed through a different device after the code was scanned.

Where provider access logs exist, compare them with the payment transaction and device records.

When reporting, state whether the evidence shows a scan, an opened request, an attempted payment or a completed transfer.

Do not collapse those events into one.

Operational takeaway¶

Treat scanning as the opening of a payment route and prove actual payment through the separate authorisation, transaction and settlement records.