How to tell if a payment QR code is fake before you pay

A fake payment QR code looks exactly like a real one. The only difference is who gets the money. Before you pay, read the recipient's name, in the eThorns QR reader or on your payment app's confirmation screen, and pay only if it matches the shop or person you mean to pay. If the name is different, missing or strange, don't confirm: ask first.

How fake payment QR codes work

A sticker over the shop's code

Someone prints their own payment QR and sticks it over the real one: on a shop counter, a parking meter, a stand at a market. Customers scan it, their app says the payment went through, and the money lands in the scammer's account. The shop often only notices when the payments it expected never arrive. Look for a code that sits on top of another, has raised edges, looks newer than the sign around it, or is slightly crooked.

A QR sent by chat

A "buyer" on a marketplace sends you a QR "so you can receive the payment". A "seller" sends one for the deposit on something that doesn't exist. A message that claims to come from a company asks you to scan a code to pay a fine or unlock an account. One rule covers the first case: to receive money you never need to scan a code, enter your PIN or approve anything in your app.

A QR that opens a web page

Some codes contain a link instead of payment data. If a QR opens a page that asks for your card number, your bank password or a code sent to your phone, close it. That is a fake website, not a payment.

What's inside a payment QR

Many payment QR codes used by banks and wallets follow an international format called EMVCo. The code isn't a secret: it's short text split into fixed fields that any reader can show.

Field	What it tells you
Merchant name	Who receives the money, as registered with the bank or wallet
City and country	Where that merchant is registered
Amount and currency	The amount is only there in codes made for one payment. A code printed on a counter usually has none, and you type it.
Network and account	Which payment network or app handles it, and the account or ID the money goes to
Checksum	A control number calculated from the rest of the code. If someone edits the content without recalculating it, it stops matching.

The weak point is obvious: a scammer doesn't need to edit anyone's code. They can create a perfectly valid QR for their own account and print it. That's why the name is what you check.

Check it with the eThorns QR reader

1. Open the QR code reader. Take a photo of the code, or a screenshot of the one you received by chat, and drop it in. You can also press "Scan with camera". The image is decoded on your device and never uploaded.
2. If it's a payment QR in the EMVCo format, the first line, in large letters, says "This QR pays:" followed by the merchant name and city. Compare it with the name of the shop, or the person you expect to pay. If it says "(no merchant name)", treat that as a warning.
3. Below it, a table shows the amount if there is one, the currency, the country, the payment network or app, and the account or ID.
4. Read the checksum line. "Valid" only means the code isn't damaged: a scammer's own QR passes this check too. If it says the checksum is missing or doesn't match, or that the data is malformed, don't pay with it.
5. If the QR contains a link, the reader shows it as plain text and never opens it. It offers to check the link with the short link expander, which shows where it really leads. If the QR came with a message, paste the message into the scam checker, which spots common scam scripts; the text stays in your browser and only its links go to our server.
6. If the code uses another format, the reader shows its raw content. In that case, rely on the name your payment app shows.

Always compare the name in your payment app

The reader is an extra check. The last one happens in your bank or wallet app, just before you confirm.

1. Scan the code with your payment app as usual.
2. Before you press confirm, read the recipient's name on the screen. Some apps show it partly hidden, with some letters replaced. In Colombia, for example, when you pay through Bre-B, the Banco de la República's instant payment system, with a key (a llave) or a QR code, your app shows the recipient's masked name for you to check before confirming.
3. Check the amount too, especially if the code filled it in.
4. If the name doesn't match the shop, ask the cashier before paying. A small shop may receive payments in the owner's personal account, so a person's name isn't automatically a scam, but the cashier should be able to tell you that name.
5. If you can't confirm who it is, pay another way: cash, card, or details the shop gives you in person.

If you run a shop

• Look at your QR stickers every day, especially outdoors or where no one is watching.
• Write your business name, exactly as the payment app shows it, next to the code, so customers can compare.
• Scan your own code with the reader from time to time and check that it still pays you.

If you already paid

1. Call your bank or wallet right away, using the number in its app or on your card. Say it was a fraudulent payment and give the date, time, amount and the recipient name the app showed. There's no guarantee, but the first hours matter most.
2. Keep the evidence: a photo of the QR and of the sticker, the receipt in your app, and any chat.
3. Tell the shop, so it removes the fake code before more people pay.
4. Report it. The "scammed or hacked? what now" tool gives you steps by situation (choose "money you sent") and the official places to report in your country. For more detail, read where to report a scam.
5. Be wary of anyone who offers to recover your money for a fee. That's a second scam.

Quick checklist

• The QR isn't a sticker on top of another code.
• The reader shows a merchant name that matches the shop, and the checksum is valid.
• My payment app shows the same name before I confirm.
• The amount is right.
• Nobody asked me to scan a code to receive money.
• If a QR opened a web page, I didn't type any card details or passwords.

Frequently asked questions

Can scanning a QR code hack my phone?

A QR code only contains text: payment data, a link, a Wi-Fi network. The risk is what happens next, such as opening a fake page and typing a password, or paying the wrong account. The eThorns reader never opens the content.

The checksum is valid. Does that mean the QR is safe?

No. It only means the code wasn't damaged or edited. A scammer can create a valid code for their own account. The name is what tells you who gets paid.

Why does my app show the name with letters hidden?

To protect the recipient's privacy. You can still compare the visible letters with the shop's name or the owner's name the cashier gives you.

Can I get my money back?

Sometimes, especially if you tell your bank within minutes or hours. It isn't guaranteed, so checking the name before you confirm is what really protects you.

Try it

• 4.8QR code readerRead a QR code from a photo, screenshot or camera and see what it contains, including who a payment QR pays.
• 1.1Is it a scam?Paste a message or link you received and see its warning signs: brand look-alikes, new domains, short links, scam wording.

For your team

• US$19Phishing awareness kit for small businessesA 30-minute session on fake messages, ready to give to your team: a facilitator guide, 12 example messages, a poster, a policy and a quiz.