Merchants and cafes
Use this checklist for countertop stands, cashier displays, menus, and printed signage that ask a customer to scan and pay.
QR payment safety
QR payment safety checklist for printed and in-person payment flows.
Use this anti-quishing checklist to spot tampered payment QR codes, verify recipients, and give customers a safer way to scan.
Finance and ops teams
Use it for invoices, billing reminders, branch materials, and any distributed print that can drift or be tampered with over time.
Customers and staff
Use it when a QR arrives through an unexpected message, a questionable invoice attachment, or a physical sign that looks altered.
Checklist before scanning or printing
Check the receiver name, merchant identity, or handle in the official app before confirming.
Look for sticker overlays, tampering, or mismatched branding on printed QR displays.
Do not trust urgency alone. Pause if the QR arrived through an unexpected attachment or message.
Re-scan your own printed payment signs regularly so you can spot changes early.
If a payment flow feels wrong, fall back to the bank or wallet app manually.
Keep a visible fallback URL or staff-assisted option so scanning is never the only path.
Common scam patterns
Countertop sticker swaps that redirect to a different receiver.
Invoice PDFs or screenshots with altered payment QR codes.
Messages pushing you to scan urgently before checking the payee or business identity.
Printed signs that still look official even after the destination or receiver has changed.
Safer rollout pattern
Before print
Verify the destination, payee details, and fallback URL. Scan the draft on real phones before you commit to a production run.
During rollout
Place the QR where staff can inspect it, keep tamper-evident materials in mind, and leave room for a visible safety reminder or fallback path.
After launch
Re-scan live signs, check for overlays or wear, and confirm the receiver details still match what customers expect to see.
Related guides
Payment QR guide
Compare payment rails, official references, and rollout patterns before you print.
Open resource
Why your QR code is not scanning
Separate actual scan failures from destination issues and weak print quality.
Open resource
QR code safety guide
Review broader scam patterns and trust cues beyond payment-specific flows.
Open resource
Safety FAQ
Can a QR code be replaced without changing the printed stand?
Yes. Sticker-over-sticker replacement is a common scam pattern, which is why physical verification matters for payment displays.
Should I trust a QR code from an invoice PDF or chat attachment?
Only after verifying the sender and receiver details independently. Unexpected invoice or chat QR codes deserve extra caution.
Does using a static payment prompt remove fraud risk?
No. Static prompts can still be tampered with or misread, which is why official-app confirmation and periodic self-checks matter.
What is quishing?
Quishing is phishing that uses QR codes as the delivery mechanism. The scam may appear on a sticker, invoice, email, poster, or chat message, but the goal is still to push you toward a malicious or misleading destination.
Should businesses provide a fallback besides the QR code?
Yes. A visible URL, verified handle, or staff-assisted payment option reduces pressure on the customer and gives them a safer path when a scan looks suspicious.