Fake QR Code Scam¶
A QR code is a link you cannot read, and an attacker can cover a real code with a sticker, print a new one, or send one in a chat. Preview the URL and verify the address on the confirmation screen before you approve anything.
Who this is for¶
Anyone who pays by scanning a code at a shop, on an invoice, at a parking meter, or from a message.
How the scam works¶
In person, the attack is physical. A sticker with the attacker's code is placed over the merchant's printed code, or a code is added to a poster, a table, or a bill where no code belongs. The payment page that opens looks ordinary, so the only visible difference is the address, which most people never read.
Remote codes work the same way with a different payload. A code in a DM, an email, or a group arrives with a reason — a refund, a delivery, a verification — and scanning it opens a wallet-connect prompt or a site that asks for a signature or an approval. The QR exists to move you to a URL without showing it to you first.
Inside the wallet, a scanned payment code fills in the recipient and the amount, and you still confirm. The attacker relies on that confirmation happening fast. Some codes encode a contract call or a connection request rather than a plain transfer, so what you approve is not what the code appeared to be.
You can check before and after the scan. Preview the decoded link when the scanner offers it, and read the domain before the page loads. After scanning, compare the address on the wallet's confirmation screen with the merchant's published address or the one on their own screen; that screen is the last place where the mistake is still reversible.
Warning signs¶
- The code is a sticker, a loose printout, or a card sitting on top of another surface, and its edges lift.
- The scanner preview shows a shortener, a bare IP address, or a domain that is not the merchant's.
- Scanning opens a connect-wallet or signature request for what should be a plain payment.
- The address on the wallet screen differs from the one on the merchant's screen or receipt.
- The code arrives unsolicited with an urgent reason: a refund, a failed delivery, an account check.
- The amount is already filled in and someone is rushing you to confirm.
If it happens to you¶
- Cancel the request in the wallet before you approve it. Closing the scanner is enough at this stage.
- If you already paid, save the transaction hash, the code, and a photo of where it was posted, then report it to the merchant and the venue.
- If you signed or approved, revoke the approval and move the remaining assets to a new wallet.
- Look up the address on the explorer so you have a record of where the funds went.
- Do not scan a corrected code from the same sender.
Next steps¶
- Be Aware of Phishing Addresses — why the address, not the code, is the thing to check.
- DApp Approval Scam — the request behind a code that opens a site.
- Theft Prevention — first response when funds have already moved.
Self-check¶
- Do I preview a code's URL before I approve anything?
- Do I compare the full address on the confirmation screen with a trusted source?
- Do I refuse to scan codes that arrive in unsolicited messages?
- Do I know that a payment QR should never open a signing or approval request?