What is happening here
A payment QR swap happens when a merchant real QR code is covered or replaced with one that sends money to someone else. The customer believes they paid the shop, the shop never receives the money, and the attacker walks away with the payment.
Swaps target market stalls, cafes, donation boxes, and any counter where a printed payment code sits in the open. The attacker only needs a printed sticker and a short moment alone.
Red flags to check before you scan
- The payment code is a sticker placed over the original print, with raised or peeling edges.
- The payee name shown in your payment app does not match the business name.
- The amount or account details look different from what the seller quoted.
- The code sits on a loose card that can be picked up and swapped, rather than fixed signage.
- Staff cannot confirm the code, or the code does not match one shown elsewhere in the shop.
Verify before you trust it
1. Read the payee name and details in your payment app before you confirm the payment.
2. Ask the seller to confirm the payee name out loud before you send money.
3. Compare the code with another display in the shop, or with the code in the business official app.
4. Stop the payment if the payee name does not match the business.
Putting this into practice
Build a habit you can use in seconds. Pause before every unexpected scan, read the destination preview, and check the domain against what you already know. If the code is printed in public, look for sticker edges and compare it with nearby signs. If the code arrived in a message, verify it through a separate channel you trust. The pause costs almost nothing, and it is the step that catches most of these scams.
Common mistakes to avoid
The most common mistake is scanning to find out whether a code is safe. A scan that opens a page can already expose you to a fake login or a payment trap. Another mistake is trusting a familiar logo, since logos are easy to copy. A third is acting under urgency, which is exactly what the message is designed to create. Slow down, verify through a channel you control, and treat any request for credentials or payment as a reason to stop.
Quick checklist
- Pause before you scan any unexpected code.
- Read the full destination preview, not just the first hop.
- Compare the domain with the official one you already know.
- Check printed codes for sticker edges and mismatched print.
- Never enter passwords, codes, or card details from a surprise scan.
- Verify through a separate, trusted channel before you act.
Related tools and guides
- Run the destination through the [QR allowlist builder](/qr-allowlist-builder) before you trust a code you did not expect.
- Inspect the code with the [QR expiry checker](/qr-expiry-checker) before you trust a code you did not expect.
- Check the address with the [QR print proof checklist](/qr-print-proof-checklist) before you trust a code you did not expect.
- Practise spotting patterns with the [QR size calculator](/qr-size-calculator) before you trust a code you did not expect.
- Review the chain with the [bulk generator](/bulk-generator) before you trust a code you did not expect.
- Keep a record with the [QR placement guide](/qr-placement-guide) before you trust a code you did not expect.
- Plan protection with the [QR safety checker](/qr-safety-checker) before you trust a code you did not expect.
