QR Code Security Best Practices for Merchants and Users
Practical security guidance for payment and utility QR codes: verify merchant codes, avoid tampered stickers, validate payloads, and reduce social-engineering risk.
Threat model in plain language
Attackers may replace merchant stickers, encode phishing URLs in utility QR codes, or trick users into confirming unexpected payees. Payment QR security is both a technical and operational problem.
Merchant controls
Print codes from trusted generators, laminate or secure counter placements, periodically inspect stickers for overlays, and regenerate codes if merchant account details change. Prefer dynamic QR at checkout when amount binding reduces dispute risk.
Consumer habits
Confirm merchant name and amount in the wallet before paying. Be cautious with QR codes from unknown posters or messages. For non-payment QR, preview URLs before opening.
Technical validation
CRC validation detects accidental corruption but does not prove a merchant is legitimate. Still validate structure and currency encoding so broken payloads do not reach customers.
Privacy-minded tooling
Prefer local browser or offline decoding for sensitive payloads so raw payment strings are not uploaded to unnecessary third parties. EMV QR Hub processes generation and parsing locally in the browser for this reason.