8 Common QR Code Payment Mistakes and How to Avoid Them

Scanning a QR code to pay is one of the fastest things you can do with your phone — and one of the easiest ways to lose money if you're not paying attention. From tampered stickers placed over real merchant codes to confirmation screens people tap through without reading, QR payment fraud is growing across Nepal, India, and South Asia at the same pace as QR adoption itself. The good news: every single mistake on this list is avoidable with one or two extra seconds of attention.

All 8 QR payment mistakes at a glance — and the simple fix for each one

Mistake 1: Scanning QR Codes From Untrusted Sources

This is where most QR payment fraud begins. A QR code forwarded on WhatsApp, posted in a Facebook comment, or printed on a flyer you picked up from a table can redirect your payment to a completely different account — or worse, open a malicious link in your browser before your payment app even loads. Fraudsters design fake QR codes to look like legitimate merchant codes, and the average camera app won't flag anything suspicious before opening them.

The fix: Only scan QR codes you can physically see at the merchant's location, from a standee or printout that's clearly in the possession of the business. Never scan a QR code someone sends you digitally to "make a payment" — that's not how legitimate merchants work, and it's the most common setup for QR scams. If someone sends you a QR to scan for payment, stop and call them directly to verify.

Mistake 2: Not Verifying the Merchant Name Before Confirming

Every legitimate QR payment app — Khalti, eSewa, Fonepay, mobile banking apps — shows you the registered payee name on a confirmation screen before the payment is processed. This is your one clear opportunity to confirm that the money is actually going where you think it's going. Most people scroll past this screen and tap the confirm button on autopilot.

The fix: Before you tap Pay or Confirm, read the name. Does it match the shop you're standing in? Even a minor discrepancy — a different spelling, a completely unrelated name, or a personal account name at a business that should have a registered merchant account — is a signal to stop and ask before proceeding. This takes literally two seconds and catches a huge proportion of QR misdirection errors, both fraudulent and accidental.

Mistake 3: Trusting Static QR Codes to Handle the Amount

There are two types of merchant QR codes: static and dynamic. A dynamic QR code is generated per transaction and encodes the exact amount, so your app reads the correct figure automatically. A static QR code — the kind most small merchants use because it's cheaper and doesn't require special hardware — only contains the merchant's payment details, not the transaction amount. You enter the amount yourself.

The mistake people make is assuming the amount shown after scanning is the correct one, when in reality they may have mistyped it, or they're accepting an amount the merchant verbally stated without double-checking what they actually entered. Overpayments to static QR codes are surprisingly common and genuinely difficult to reverse once processed.

The fix: After entering the amount on a static QR payment, check the figure on the confirmation screen against what you owe before confirming. If the merchant gives you a number verbally and you're not sure you typed it correctly, ask them to confirm before you tap Pay.

Mistake 4: Ignoring Transaction Confirmation Screens

Payment apps are designed to show you a final summary screen — payee name, amount, and sometimes a transaction reference — before the payment executes. This screen exists precisely because once you confirm, the transaction is processed and reversals are rarely automatic. Yet many users, especially on crowded payment counters or when in a hurry, tap through this screen reflexively.

The fix: Make it a personal rule that you always read three things on the confirmation screen before tapping Pay: the name, the amount, and the currency/wallet being debited. This habit takes under five seconds and is your last line of defense against errors — both fraud and honest mistakes. A moment of attention before confirming is worth far more than hours spent trying to recover a wrong transfer after it's gone.

Mistake 5: Sharing QR-Linked Account Details

Your QR code shows your payment identity — but the real danger is your PIN, OTP, or wallet password. Fraudsters often combine QR-based scams with social engineering: they send you a QR code, then call pretending to be customer support to "help you complete the payment," asking for your OTP or PIN in the process. Once they have those, they don't need your QR at all.

The fix: Treat your wallet PIN and OTP with the same security as your ATM PIN. No legitimate payment app, bank, merchant, or customer service representative will ever call or message you asking for your OTP, PIN, or password. If anyone does — hang up. No exceptions, no matter how convincing the story.

Mistake 6: Not Checking for Tampered or Sticker-Over QR Codes

This is one of the most physically creative QR scams and it's increasingly reported across South Asia: a fraudster prints their own QR code on a sticker and places it directly over a legitimate merchant's QR standee. To the naked eye, the standee looks completely normal. The scan seems to work. But your payment goes to the fraudster's account, not the merchant — and the merchant often doesn't even know the sticker is there until multiple customers report the problem.

The fix: Before scanning any QR standee, give it a quick physical check. Run your fingernail along the edges of the QR code area — a sticker placed over another QR code will often have slightly raised edges or visible layering. If the QR code surface feels uneven, ask the merchant to show you an alternative payment method or a second copy of their QR. High-traffic merchants in tourist areas and markets are the most common targets for this type of attack.

Mistake 7: Skipping App Updates

Payment app developers release updates regularly, and a significant portion of those updates contain security patches — fixes for vulnerabilities that, if left unpatched, could allow attackers to intercept transaction data, bypass authentication, or exploit weaknesses in how QR codes are processed. Running an outdated version of Khalti, eSewa, or your mobile banking app is the equivalent of leaving your front door slightly open because you haven't gotten around to fixing the lock.

The fix: Enable automatic updates for all payment apps on your phone. If you prefer manual updates, set a reminder to check for updates at least once a week. When a payment app notifies you of a new version — especially one described as a security update — install it immediately, not "later." The few minutes of inconvenience are nothing compared to the exposure from a known vulnerability that attackers can actively exploit.

Mistake 8: Not Enabling Transaction Alerts

If your wallet or bank account is compromised, the speed at which you detect it determines how much damage is done. Most payment apps and banks offer real-time push notifications or SMS alerts for every transaction on your account. These alerts are often disabled by default or turned off by users who find them annoying. But without them, a fraudulent transaction on your account might sit undiscovered for days — long after the window for any rapid recovery action has closed.

The fix: Go into your payment app settings right now and confirm that transaction notifications are turned on. Do the same for your mobile banking app. If your bank also offers SMS alerts for account transactions, enable them as a secondary layer — SMS alerts arrive even when your phone has poor data connectivity. The goal is to know about every transaction the moment it happens, so that an unauthorized one triggers an immediate response rather than a delayed discovery.

Quick Checklist for Safe QR Payments

Before you scan, confirm, and walk away — run through this mental checklist:

• ✅ Is this QR code physically present at a known merchant location? If it came through a message or social media, don't scan it.
• ✅ Does the QR code surface look intact? Check for sticker edges or layering before scanning.
• ✅ Does the payee name match the merchant? Read the confirmation screen before tapping Pay.
• ✅ Is the amount exactly right? Verify the figure you entered against what you owe.
• ✅ Have you read the full confirmation screen? Name, amount, and debit account — all three.
• ✅ Is your payment app up to date? Check the app store for updates if you haven't recently.
• ✅ Are transaction alerts enabled? Confirm notifications are on in your app settings.
• ✅ Have you kept your PIN and OTP private? No one should ever ask for them — no exceptions.

What to Do If You've Already Sent Money to the Wrong Place

If you realize a QR payment has gone wrong — wrong merchant, wrong amount, or suspected fraud — act immediately:

1. Open your payment app and take a screenshot of the transaction details including the reference number, payee name, amount, and timestamp.
2. Contact your payment provider's customer support as quickly as possible — within the first hour dramatically increases the chance of any recovery action.
3. If fraud is suspected (tampered QR, scammer account), also report the payee account to the payment provider so it can be flagged and potentially blocked for other users.
4. For amounts above Rs 5,000 or any organized fraud, file a complaint with the Nepal Police Cyber Bureau — documented QR fraud cases are increasingly being pursued through formal channels.

Frequently Asked Questions

Can I get my money back after a wrong QR payment?

It depends on the payment provider and the speed of reporting. Many payment providers allow merchant payment reversals if reported quickly and the receiving account holder agrees, but there's no guarantee — digital payments are designed to be fast and final. Speed of reporting is the single biggest factor in how much recovery is possible.

How can I tell if a QR code is a scam before scanning?

You can't always tell from the visual appearance of the code itself — QR codes for legitimate and fraudulent destinations look identical to the eye. The safest heuristic is context: only scan codes that are physically present at a known merchant, on a surface that looks intact, and where you initiated the payment yourself rather than being directed to scan.

Is it safe to share my personal QR code with others?

Your personal QR code for receiving payments is generally safe to share with people you trust — it contains your payment identity, not your PIN or account credentials. The danger is sharing your QR in untrusted public forums where it could be combined with other account information to attempt account takeover, or where someone might try to misuse your payment identity.

What is a tampered QR sticker and how common is it?

A tampered QR sticker is a fraudster's QR code printed on a sticker and placed over a real merchant's QR standee, redirecting payments to the fraudster's account while looking identical to the original. This type of physical QR fraud is increasingly reported across Nepal, India, and South Asia, particularly at high-traffic locations like markets, tea stalls, and tourist areas.

Final Thoughts

QR payments are genuinely faster and more convenient than cash — and they're also genuinely safe when used correctly. Every mistake on this list has a simple, one-or-two-second fix. Read the name. Check the amount. Glance at the sticker. Update the app. Enable the alerts. None of these habits slow you down meaningfully, but each one closes a door that fraudsters are actively trying to walk through. Build the habit now, while QR payment fraud is growing but still preventable with basic awareness.