What is happening here
A fake invoice QR code arrives inside a bill that looks like it came from a supplier, utility, or service you use. The invoice may carry your name and a plausible amount, but the QR code routes payment to someone else.
These invoices reach businesses and households by email or post. The attacker counts on accounts staff or a busy homeowner paying a familiar-looking bill without checking the payment destination.
Red flags to check before you scan
- The invoice uses a new bank account, payment link, or QR destination that differs from your usual payment details for that supplier.
- The invoice pressures immediate payment, threatens service cut-off, or mentions a changed payment method.
- Line items, dates, or reference numbers do not match your records or your contract.
- The sender address, letterhead, or logo looks slightly off, or the layout differs from earlier invoices.
- The QR code is the only payment route offered, with no matching details in your supplier records.
Verify before you trust it
1. Compare the invoice against your purchase order, contract, or previous invoices from the same supplier.
2. Call the supplier on a number you already have, not one printed on the invoice, and confirm the amount and payment details.
3. Check whether the payment destination matches the one you have on file before any money moves.
4. Ask a second person to review any invoice that changes payment instructions.
Putting this into practice
Build a habit you can use in seconds. Pause before every unexpected scan, read the destination preview, and check the domain against what you already know. If the code is printed in public, look for sticker edges and compare it with nearby signs. If the code arrived in a message, verify it through a separate channel you trust. The pause costs almost nothing, and it is the step that catches most of these scams.
Common mistakes to avoid
The most common mistake is scanning to find out whether a code is safe. A scan that opens a page can already expose you to a fake login or a payment trap. Another mistake is trusting a familiar logo, since logos are easy to copy. A third is acting under urgency, which is exactly what the message is designed to create. Slow down, verify through a channel you control, and treat any request for credentials or payment as a reason to stop.
Quick checklist
- Pause before you scan any unexpected code.
- Read the full destination preview, not just the first hop.
- Compare the domain with the official one you already know.
- Check printed codes for sticker edges and mismatched print.
- Never enter passwords, codes, or card details from a surprise scan.
- Verify through a separate, trusted channel before you act.
Related tools and guides
- Run the destination through the [QR payload inspector](/qr-payload-inspector) before you trust a code you did not expect.
- Inspect the code with the [QR offline verifier](/qr-offline-verifier) before you trust a code you did not expect.
- Check the address with the [QR batch validator](/qr-batch-validator) before you trust a code you did not expect.
- Practise spotting patterns with the [QR safety checker](/qr-safety-checker) before you trust a code you did not expect.
- Review the chain with the [QR size calculator](/qr-size-calculator) before you trust a code you did not expect.
- Keep a record with the [bulk generator](/bulk-generator) before you trust a code you did not expect.
- Plan protection with the [QR placement guide](/qr-placement-guide) before you trust a code you did not expect.
