QR Codes for Payments

The Attack Is a Sticker

Somebody prints their own code and puts it over yours. Every payment goes to them, the poster looks exactly right, and nothing tells you until the money does not arrive. It works because a QR code is unreadable to a human, so nobody looks at it, and because a collection point is often unattended for hours.

Three habits handle most of it. Fix the code down or laminate it so a sticker over the top is visible. Print the destination as text beside the code so a payer can compare it against their own screen. And scan your own codes when you walk past them, on a phone that is not the one you designed them on.

Tell payers what to check too: the name on the payment screen before they confirm. That single check defeats the whole attack.