Could a QR code have been replaced or manipulated?¶

Yes. A payment QR code can be replaced, covered, altered or digitally substituted so that it directs payment somewhere else.

Avoid the dangerous assumption¶

The dangerous assumption is that the code displayed beside genuine branding belongs to the genuine merchant or organisation.

A physical sticker may be placed over the original code.

A digital image, invoice, website or message may be edited to contain a different code or destination.

The surrounding text can remain unchanged while the encoded payment destination is altered.

Preserve the physical item, original digital file, webpage or message where the code appeared.

Photograph the wider context and close detail, including signs of labels, damage or replacement.

Where possible, preserve the encoded data without making a payment or using an uncontrolled device.

Compare the code with the merchant’s genuine payment instructions, account details and other examples.

Ask the payment provider which account or request the code identified and when it was created.

A changed destination may indicate manipulation, but account updates, replacement posters or legitimate regenerated codes can also explain differences.

Do not assume that the person who placed or sent the code controlled the recipient account without further evidence.

CCTV, printing records, website access, account logs, communications and device evidence may assist.

When reporting, distinguish the physical or digital substitution, the encoded destination and the person proven to have carried it out.

Operational takeaway¶

Preserve the QR code in its full context and compare its encoded destination with genuine provider and merchant records before attributing manipulation or control.