Could a QR code have been replaced or manipulated?¶

Yes. A physical code can be covered or replaced, and a code in an invoice, webpage or message can be digitally substituted while the surrounding branding remains genuine.

Manipulation changes the encoded route¶

A replacement sticker or edited image can direct payment to a different account or request. A mismatch is important, but legitimate poster replacement, account updates or regenerated dynamic codes can also explain differences.

The changed destination establishes neither who made the substitution nor who controlled the recipient account.

Compare artefact, payload and provider history¶

Preserve the physical item or original digital file and its wider context. Record labels, damage, page or message source and the encoded data using a safe, authorised method.

Compare with genuine merchant examples and obtain provider records for destination, creation time and account. CCTV, print or web access records, communications and endpoint evidence may address attribution.

Report the substitution, encoded destination and attributed actor as separate conclusions.