Original topic illustration: ChainView BTC866 original topic diagram · ChainView BTC866 Editorial · CC BY 4.0
A QR code is only a container
It can encode an address, payment URI, amount, network parameter or web link. Scanning does not authenticate the sender. Printed stickers, chat images and web codes can all be replaced.
A QR can open a website, fill a destination or prepare a contract call. Those are different actions. Inspect the result rather than trusting a paper invoice: a physical sticker can also be replaced with a hostile request.
A QR code is a data container and can hold a plain address, a payment URI or a web link; scanning it does not authenticate the sender.
Read every request field
Check asset, network, address, amount and unit. Bitcoin URIs and EVM payment requests are different formats, and a wallet's ability to parse text does not certify a receiving contract.
Amounts may use decimal or raw units. Verify the parsed value in the wallet. If a field is unsupported, do not guess from an unrelated conversion tutorial; confirm a replacement request through a previously known channel.
Payment-request schemes can encode an amount and network-specific fields, while wallets may interpret unsupported parameters differently.
Use the final wallet preview
Treat the scan as a draft. Recheck the full destination, chain, contract and amount on the final confirmation page. A displayed name is not an on-chain identity. If the name and address conflict, verify independently.
For contract assets, inspect chain and token contract as well as recipient. Identical symbols can mislead. Stop on a mismatch instead of paying a support test account. A successful small payment does not ensure a later larger request remains unchanged.
Inspect the destination, network, asset contract, amount and unit on the wallet's final confirmation screen, and obtain a replacement request through an independent channel if unclear.
Resist urgent replacement requests
A nearly expired invoice or a support agent requesting a personal QR code adds risk. Never enter a recovery phrase or send a validation fee to complete a payment. Use a known contract channel or directory to confirm a change.
A changed invoice should trigger an independent check, such as calling the number in an existing contract. Replying within a compromised email thread is not independent verification. Standard payment instructions help legitimate recipients resist urgent ad hoc code changes.
Treat stickers placed over printed codes and urgent invoice changes as separate verification events; never enter a recovery phrase to complete a requested payment.
Keep the payment evidence
Record the QR source, confirmation view, transaction hash and receiving party. Distinguish not broadcast, pending and confirmed states. Scanning again cannot undo a transfer; stop subsequent payments when the destination is inconsistent.
Save the actual confirmed fields, not only the QR image, which may not explain a wallet's interpretation later. Avoid publishing personal order data. The QR is not a cancellable payment receipt; the transaction status remains the evidence of what happened.
For an organisation, agree in advance how a changed payment request is approved and who performs the independent callback. Two people looking at the same altered email are not two independent sources. Record the trusted contact used, not just a note saying verified. This process applies even to a small test payment because the request itself can change later. A verification policy should therefore cover the final amount and destination immediately before authorisation, rather than relying forever on one previously successful scan.
A response card can use qr content, request fields, wallet preview and final verification as checkpoints for observed symptoms, trusted verification, stop conditions and responsibility. Confirm facts before any action that changes permissions or moves funds. An urgent support message does not justify revealing secrets. Prefer read-only inspection, then document and recheck settings when a real change is necessary. After containment, repair the underlying recovery or access weakness rather than only dismissing the visible warning. Retain evidence without exposing identity material publicly. The aim is a controlled decision that reduces risk, not a hurried series of signatures prompted by fear or a stranger offering assistance.
