How payment app QR codes work

Apps like Venmo, Cash App, and PayPal generate a personal QR code tied to your account — scanning it opens a pre-filled payment screen to that specific person or handle. This is different from the merchant payment terminals covered in our business QR safety guide: these are personal, peer-to-peer codes, usually shown on a phone screen rather than printed and displayed publicly.

The substitution risk

Because these codes are just an image, they're trivially easy to screenshot, save, and reshare. The real risk isn't the code's technical security — it's substitution: someone shows you a QR code claiming it's for splitting a bill or repaying a debt, but it's actually a different account entirely. Once you scan and confirm, the money is gone to whoever actually controls that code, not the person you thought you were paying.

The one habit that stops this

After scanning any payment QR code, always check the recipient name and username shown inside the app before confirming — not just the amount. If it doesn't match who you expect, cancel and ask the person directly.

Cryptocurrency wallet codes

Crypto wallet addresses are long, unmemorable strings, which is exactly why they're routinely shared as QR codes — and exactly why they're an attractive substitution target. The FBI's Internet Crime Complaint Center specifically flagged cryptocurrency kiosks and QR tampering in a January 2022 public service announcement, warning that scammers were replacing legitimate payment QR codes with ones directing funds to attacker-controlled wallets. Unlike a bank transfer, a cryptocurrency payment sent to the wrong address generally cannot be reversed or recovered — which makes this substitution risk meaningfully higher-stakes than with reversible payment apps.

A quick checklist before you pay

  • Does the name shown after scanning match who you expect to pay?
  • If someone showed you a printed or screenshotted code rather than opening their own app live, that's worth a second look.
  • For any crypto transaction, double-check the first and last few characters of the wallet address shown against what the recipient told you directly — never rely on the QR code alone.
  • If anything feels off, it's always fine to ask the person to send the request through the app directly instead of via a QR code.

Before you scan

Check any code's destination first

If a payment QR code contains a web link rather than an in-app payment request, CheckThisQR can verify the destination before you visit it.

Check a QR code →