JianweiAI-assisted funds analysis
Contact the team

Digital security & AI

QR phishing and swapped payment codes

A QR code is only a link or instruction; a replaced code can send you to a fake site or wrong payee.

See response steps Share this in a workshop
A woman using a smartphone beside books and printed material

If you have one minute

Pause, then verify independently.

A code appears pasted over another

Before paying

Check destination and payee before acting

See verification steps →

If you paid or shared details

Close the page and stop payment

See response steps →

Start with these three signs

  • A code appears pasted over another
  • The destination is unrelated to the service
  • The payee does not match the context

How the situation unfolds

  1. Contact

    Parking signs, parcel cards, or message images.

  2. The lure

    Scan to pay, claim a reward, or collect a parcel.

  3. The demand and outcome

    An overlaid code or fake service entry redirects scans to steal details or payments.

Verify these things before paying

  1. Check destination and payee before acting
  2. Verify with staff at the location
  3. Use the official app for payment checks

Already engaged or paid?

  1. Close the page and stop payment
  2. Contact your bank if card details were entered
  3. Photograph the altered code and notify the operator

Contact your payment provider and local police promptly. The responsible institution must confirm whether a payment can be stopped, disputed or returned.

Keep these records

Original QR image
Code location
Destination URL
Payee and payment details

Keep originals and organise working copies. Never give strangers verification codes, banking passwords, private keys or seed phrases.

Original references

  • Federal Trade Commission (FTC)Publisher location：United States · EnglishOpen the original reference ↗https://consumer.ftc.gov/consumer-alerts/2023/12/scammers-hide-harmful-links-qr-codes-steal-your-information
  • Federal Trade Commission (FTC)Publisher location：United States · EnglishOpen the original reference ↗https://consumer.ftc.gov/consumer-alerts/2025/01/scam-alert-qr-code-unexpected-package

This page summarises public prevention guidance to help recognise methods. It is not an enforcement conclusion about a particular incident. Check the source page for its original title. Procedures and reporting routes vary by jurisdiction. Compiled October 2026.

Related situations

Smishing and fake logins

Billing, rewards, or login alerts lead to fake pages that capture passwords and payment details.

Read the warning signs and checks

Fake tech support and virus pop-ups

Scare pop-ups claim an infection to sell fake repairs or obtain device access.

Read the warning signs and checks

Remote-access and screen-sharing theft

Fake support requests remote software or screen sharing, exposing your banking activity.

Read the warning signs and checks