# Crypto QR code safety — the address is the attack surface

> Crypto QR risks concentrate in one place — the address. Malware swaps addresses on clipboards, fake codes get pasted over genuine ones, and a confirmed transfer cannot be reversed. Verify the first and last four characters on the receiving device, send a small test amount first, then send the balance.

Source: https://useqr.app/docs/payments/crypto-qr-code-safety · Last reviewed 2026-08-21 · UseQR is free forever, MIT licensed, no signup.

---

## Why crypto changes the QR threat model

Scanning a malicious URL QR costs you a phishing attempt you can still refuse. A crypto
payment QR is different for one reason: **a confirmed transaction is final**. No chargeback,
no fraud department, no support line that can claw it back. Irreversibility multiplies every
other risk — a mistake that would be an inconvenience with a card is a total loss here.

And the entire attack surface is one string: the address. Every crypto QR scam is ultimately
the same scam — you intended to pay address A and the system fed you address B.

## The three swap attacks

- **Clipboard hijackers.** Malware that watches the clipboard for strings shaped like crypto
  addresses and silently replaces them with the attacker's. This is exactly why QR codes
  *help*: a scanned [BIP21](/glossary/bip21) or [EIP-681](/glossary/eip-681) payload goes
  camera-to-wallet without transiting the clipboard, closing the classic infection point.
  The QR is the countermeasure — provided the code itself is genuine.
- **Overlay stickers.** A printed code on a donation poster or payment sign is replaced by
  [a sticker carrying the attacker's address](/docs/security/qr-code-stickers-placed-over-real-ones)
  — the same dominant fraud every
  [payment QR scheme](/docs/payments/qr-payment-standards-compared) faces, worse here
  because no confirmation screen shows a registered account name. An address is anonymous
  by construction; nothing on screen says "this is not the charity".
- **Malicious generators.** A dishonest QR generator can encode its own address instead of
  yours — you would not notice by looking at the code. Generate crypto codes with
  [client-side, open-source tools](/docs/security/client-side-vs-server-side-qr-generation)
  where the payload provably comes from your input (UseQR's
  [bitcoin](/bitcoin-qr-code) and [ethereum](/ethereum-qr-code) builders run entirely in
  your browser), then verify the output independently.

## The verification ritual

Before confirming any crypto payment from a scanned code:

1. **Compare the first four and last four characters** of the address in your wallet
   against the address the payee shows you through a second channel — their website, an
   invoice, a message. Check *both* ends: attackers can grind vanity addresses that match a
   few leading characters, so the trailing characters are the stronger check.
2. **Send a test amount first** for any transfer that would hurt to lose. Confirm the payee
   received it, then send the balance. Two transaction fees are trivial insurance against an
   unrecoverable loss.
3. **Prefer amount-carrying payloads.** A `bitcoin:addr?amount=0.015` URI or its
   [Ethereum equivalent](/glossary/eip-681) prefills the amount, removing the
   fat-finger-a-decimal failure alongside the copy-paste one.

If you *made* the code, verify from the other side: decode your own printed code with
[/validate](/validate) and diff the address character-by-character against your wallet
before anything is published — and periodically re-check public codes for overlay stickers.

For Lightning payments the string is an invoice rather than an address, and expiry changes
the mechanics — see [Lightning invoice QR codes](/docs/payments/lightning-invoice-qr) — but
the discipline is identical: verify out-of-band, test small.

## What a QR code cannot protect you from

Honesty about the limits: verifying the address proves you are paying *the address you were
given*. It cannot prove the person who gave it to you is who they claim — a scammer's
genuine address verifies perfectly. Address verification defeats swapping; it does nothing
against a fraudulent counterparty. That judgement stays with you, and no QR tooling,
including ours, changes it.

## FAQ

### Can a QR code steal my crypto?
Not by being scanned. The risk is a swapped address — via overlay sticker, clipboard
malware, or a dishonest generator — so that your wallet pays the attacker. Scanning itself
moves nothing; confirmation in your wallet does.

### Why check the last characters of an address, not just the first?
Attackers can generate vanity addresses matching a few leading characters of a target
address cheaply. Matching the trailing characters as well makes a convincing swap
exponentially harder, so always compare both ends.

### Is it safer to scan a QR code than copy-paste an address?
Yes, against clipboard hijackers — the scanned payload bypasses the clipboard entirely.
But it moves trust to the code itself, so the printed or displayed code must be verified
and protected against overlay stickers.

### Should I really send a test transaction first?
For any amount that would hurt to lose, yes. Send a small amount, confirm receipt with the
payee, then send the rest. The extra fee is negligible compared with an irreversible
mistake.

## Try it

- https://useqr.app/bitcoin
- https://useqr.app/ethereum
- https://useqr.app/validate