Crypto QR code safety — the address is the attack surface

Why crypto changes the QR threat model

Scanning a malicious URL QR costs you a phishing attempt you can still refuse. A crypto payment QR is different for one reason: a confirmed transaction is final. No chargeback, no fraud department, no support line that can claw it back. Irreversibility multiplies every other risk — a mistake that would be an inconvenience with a card is a total loss here.

And the entire attack surface is one string: the address. Every crypto QR scam is ultimately the same scam — you intended to pay address A and the system fed you address B.

The three swap attacks

• Clipboard hijackers. Malware that watches the clipboard for strings shaped like crypto addresses and silently replaces them with the attacker's. This is exactly why QR codes help: a scanned BIP21 or EIP-681 payload goes camera-to-wallet without transiting the clipboard, closing the classic infection point. The QR is the countermeasure — provided the code itself is genuine.
• Overlay stickers. A printed code on a donation poster or payment sign is replaced by a sticker carrying the attacker's address — the same dominant fraud every payment QR scheme faces, worse here because no confirmation screen shows a registered account name. An address is anonymous by construction; nothing on screen says "this is not the charity".
• Malicious generators. A dishonest QR generator can encode its own address instead of yours — you would not notice by looking at the code. Generate crypto codes with client-side, open-source tools where the payload provably comes from your input (UseQR's bitcoin and ethereum builders run entirely in your browser), then verify the output independently.

The verification ritual

Before confirming any crypto payment from a scanned code:

1. Compare the first four and last four characters of the address in your wallet against the address the payee shows you through a second channel — their website, an invoice, a message. Check both ends: attackers can grind vanity addresses that match a few leading characters, so the trailing characters are the stronger check.
2. Send a test amount first for any transfer that would hurt to lose. Confirm the payee received it, then send the balance. Two transaction fees are trivial insurance against an unrecoverable loss.
3. Prefer amount-carrying payloads. A bitcoin:addr?amount=0.015 URI or its Ethereum equivalent prefills the amount, removing the fat-finger-a-decimal failure alongside the copy-paste one.

If you made the code, verify from the other side: decode your own printed code with /validate and diff the address character-by-character against your wallet before anything is published — and periodically re-check public codes for overlay stickers.

For Lightning payments the string is an invoice rather than an address, and expiry changes the mechanics — see Lightning invoice QR codes — but the discipline is identical: verify out-of-band, test small.

What a QR code cannot protect you from

Honesty about the limits: verifying the address proves you are paying the address you were given. It cannot prove the person who gave it to you is who they claim — a scammer's genuine address verifies perfectly. Address verification defeats swapping; it does nothing against a fraudulent counterparty. That judgement stays with you, and no QR tooling, including ours, changes it.

FAQ

Can a QR code steal my crypto?

Not by being scanned. The risk is a swapped address — via overlay sticker, clipboard malware, or a dishonest generator — so that your wallet pays the attacker. Scanning itself moves nothing; confirmation in your wallet does.

Why check the last characters of an address, not just the first?

Attackers can generate vanity addresses matching a few leading characters of a target address cheaply. Matching the trailing characters as well makes a convincing swap exponentially harder, so always compare both ends.

Is it safer to scan a QR code than copy-paste an address?

Yes, against clipboard hijackers — the scanned payload bypasses the clipboard entirely. But it moves trust to the code itself, so the printed or displayed code must be verified and protected against overlay stickers.

Should I really send a test transaction first?

For any amount that would hurt to lose, yes. Send a small amount, confirm receipt with the payee, then send the rest. The extra fee is negligible compared with an irreversible mistake.