QR codes and payment links: verify the destination underneath

The idea in plain English

A QR code is a way to encode information, not a security endorsement. It can contain an address, payment request or website link. A sticker replacement, altered image or misleading message can change the encoded destination while leaving the surrounding brand familiar.

The distinction that matters

After scanning, review the actual recipient, network, asset and amount in the trusted payment or signing interface. If a code opens a website, verify its domain before taking further action. Payment requests can also include parameters you did not expect, so inspect the whole task rather than only the visible amount.

A practical example

At a fictional merchant counter, a new sticker covers an old QR code. Scanning is fast, but the displayed recipient no longer matches the merchant’s verified payment details. Asking the merchant to confirm through another trusted method is more useful than trusting the printed logo.

Try this without moving money

• Inspect a sample code’s decoded destination before following it.
• Compare recipient details with an independently verified source.
• Reject unexpected website redirects or signing requests after a simple payment scan.

A mistake to avoid

Do not assume a QR code is safer than copy-and-paste. Both methods can point to the wrong destination and both need verification.

Before you act

Matching an address format is not enough. The receiving service must support the exact asset and network, and any required memo or tag. Fees, minimum deposits and confirmation policies can change. The practice exercises here are simulations: they neither validate a real address nor send a transaction.