QR payment fraud: fake screenshots, QR scams and how to stay safe
Short answer: The two most common problems are fake payment screenshots sent to merchants and fraudsters tricking customers into scanning a QR that sends them money. Merchants should confirm payments from the payment system, not screenshots. Customers should remember that scanning a payment QR always sends money; it never receives it.
For merchants
Fake payment screenshots
A buyer sends a convincing screenshot of a transfer that never happened, or that was reversed, and asks you to dispatch. Edited screenshots are easy to make.
What stops it: confirm payment from your own system. With a dynamic QR, the confirmation comes by webhook or in your dashboard against the order reference. If it isn't there, it isn't paid.
Wrong amounts
With a static QR the customer types the amount, and underpayments slip through. A dynamic QR locks the amount, so the customer can't change it.
Swapped QR codes
Fraudsters sometimes cover a shop's printed QR with their own sticker. Check printed codes regularly, or show a fresh dynamic QR on a screen for each sale.
Reused codes
A static code can be paid again later with a disputed story attached. Single-use codes with expiry close that gap.
For customers
- Scanning a payment QR sends money. Anyone asking you to scan to "receive" a refund, prize or cashback is a scammer.
- Check the merchant name and amount on your app's confirmation screen before entering your PIN.
- Never share your PIN, OTP or CNIC details with anyone claiming to be a bank, wallet or delivery company.
- Be wary of QR codes from strangers, unexpected messages or stickers that look pasted over.
- Report problems through your bank's or wallet's official helpline.
Merchant checklist
- Never dispatch on a screenshot.
- Use amount-locked, single-use QR codes for online and chat sales.
- Turn on real-time payment notifications.
- Reconcile daily against your provider's report.
- Train staff to check the dashboard, not the customer's phone.
How Qrix helps
Qrix codes are amount-locked, single use and expire on your schedule. Payments are confirmed by signed webhook and in the dashboard, with transaction screening and AML controls on the Settlix side.
Frequently asked questions
How can I tell if a payment screenshot is fake?
You often can't by looking. Confirm the payment in your own payment dashboard or by webhook before releasing goods.
Can scanning a QR code take money from my account?
A payment QR asks you to send money, and you still have to approve it with your PIN. Never approve a payment you didn't intend, especially one described as a refund or prize.
Are dynamic QR codes safer than static ones?
They reduce several risks: the amount is locked, the code is single use, it expires, and payment is confirmed by the system rather than the customer.
What should I do if I paid the wrong merchant?
Contact your bank or wallet through its official helpline with the transaction ID as soon as possible.