What is happening here
A clipboard hijack happens when a page you reach from a QR code replaces something you copied, such as a wallet address or payment reference, with an attacker address. You paste what you think you copied and send money or data to the wrong place.
This pattern targets people copying long addresses or reference numbers. The page may ask you to copy a value, then silently substitute its own when you paste it elsewhere.
Red flags to check before you scan
- A page asks you to copy an address, code, or reference and then paste it into another app.
- The pasted value looks different from the one you copied, even by a few characters.
- The page keeps focus, refreshes, or asks you to copy again after you already copied.
- The destination app shows a recipient or reference you do not recognise.
- The page came from a QR code you did not verify before scanning.
Verify before you trust it
1. Before you confirm any paste, compare the pasted value with the original character by character.
2. Check the first and last characters of long addresses, and a few in the middle, rather than trusting the shape.
3. If the pasted value differs, delete it and re-copy from the original source.
4. Do not confirm a payment when the recipient does not match what you expected.
Putting this into practice
Build a habit you can use in seconds. Pause before every unexpected scan, read the destination preview, and check the domain against what you already know. If the code is printed in public, look for sticker edges and compare it with nearby signs. If the code arrived in a message, verify it through a separate channel you trust. The pause costs almost nothing, and it is the step that catches most of these scams.
Common mistakes to avoid
The most common mistake is scanning to find out whether a code is safe. A scan that opens a page can already expose you to a fake login or a payment trap. Another mistake is trusting a familiar logo, since logos are easy to copy. A third is acting under urgency, which is exactly what the message is designed to create. Slow down, verify through a channel you control, and treat any request for credentials or payment as a reason to stop.
Quick checklist
- Pause before you scan any unexpected code.
- Read the full destination preview, not just the first hop.
- Compare the domain with the official one you already know.
- Check printed codes for sticker edges and mismatched print.
- Never enter passwords, codes, or card details from a surprise scan.
- Verify through a separate, trusted channel before you act.
Related tools and guides
- Run the destination through the [QR tamper evidence planner](/qr-tamper-evidence-planner) before you trust a code you did not expect.
- Inspect the code with the [QR consent note builder](/qr-consent-note-builder) before you trust a code you did not expect.
- Check the address with the [QR phishing pattern trainer](/qr-phishing-pattern-trainer) before you trust a code you did not expect.
- Practise spotting patterns with the [QR safety checker](/qr-safety-checker) before you trust a code you did not expect.
- Review the chain with the [QR size calculator](/qr-size-calculator) before you trust a code you did not expect.
- Keep a record with the [bulk generator](/bulk-generator) before you trust a code you did not expect.
- Plan protection with the [QR placement guide](/qr-placement-guide) before you trust a code you did not expect.
