QR-Code Payment Scams: Protect Your Accounts Payable and Checkout Controls

A QR code is only a picture, but it can send a rushed employee from an ordinary invoice or parking sign to a fraudulent payment page in seconds. Unlike a visible web address, the destination is hidden until someone scans it—often on a personal phone, outside the protections your business relies on for email and web browsing.

That makes QR-code phishing, often called quishing, a practical finance risk. A replacement code on a vendor invoice can steer a legitimate payment to the wrong account. A code pasted over a counter sign can capture a customer's card details. And a code in an urgent text can bypass the careful payment process you built for normal invoices.

The good news is that the most effective defenses are familiar bookkeeping disciplines: know who you are paying, preserve the supporting document, separate approval from payment, and reconcile quickly. The QR code is new; the control problem is not.

Why QR codes create a payment-control gap​

A QR code can hold a web address, payment link, account identifier, app deep link, or other data. Its convenience is precisely why it is useful in a shop, a restaurant, or an accounts-payable workflow. It also means the image can be swapped without changing the surrounding message.

The Federal Trade Commission has warned that codes in unexpected emails and texts can lead to spoofed sites that collect credentials or install malware. The FBI has also cautioned that a QR-code payment made through a malicious destination may be difficult to reverse. For a business, the impact can extend beyond one bad payment:

• A staff member may reveal a supplier-portal password or a multifactor authentication code.
• A payment may be redirected while the invoice still looks legitimate in the accounting system.
• A customer may dispute a charge after paying a fake table, parking, or pickup code.
• A compromised mobile device may expose email, banking, or payment-app access.

Treat a QR code as an unverified link, not as proof that a payment request is legitimate. The printed square does not establish who controls the destination.

Map every place your business uses a QR code​

Start with a short inventory. You cannot protect every code equally until you know where customers and employees encounter them.

Accounts payable and supplier invoices​

This is the highest-risk use case because an invoice is already expected and payment is already authorized in principle. A code may appear in a PDF, a supplier email, a mailed bill, or a reminder message. It can point to a genuine portal, but it can also bypass your approved vendor record and payment instructions.

List suppliers that use QR-enabled payment links, the payment methods your business permits for each supplier, and the independent contact route you will use to verify a change. Put the verified supplier URL or phone number in the vendor master record—not in the invoice attachment.

Customer-facing checkout​

Restaurants, salons, market stalls, event businesses, and service counters may use QR codes for menus, tips, invoices, deposits, or payment. A sticker placed over the real code can send a customer somewhere else while leaving your staff unaware.

For each location, assign an owner to inspect physical codes on a set schedule. Photograph the approved sign or keep a version-controlled design file so a replacement is easy to spot. If the code is dynamic, record who can change its destination and require a second person to approve changes.

Expense reimbursement and field work​

Employees may scan codes for parking, fuel, equipment rentals, deliveries, or travel. These transactions are often small enough to evade attention individually, but they are still company payments and sometimes involve personal-device logins.

Make the rule simple: a scanned code does not replace a receipt or expense explanation. The employee should submit the merchant name, amount, date, business purpose, and original receipt just as they would for any other card purchase.

Marketing, forms, and payment reminders​

QR codes on postcards, event materials, product packaging, and payment reminders can be useful. They also create a brand and customer-trust issue when they are stale, redirected, or spoofed. Maintain a register of externally published codes with the campaign, intended destination, owner, creation date, and retirement date.

Build a safer invoice-payment workflow​

The strongest control is not teaching people to inspect every pixel. It is ensuring that no one uses an untrusted route to change a payment.

1. Match the request to the vendor master​

Before approving a payment, compare the vendor name, remit-to details, payment method, and amount with the purchase order, contract, receiving record, and established vendor profile. A QR code should never be the source of truth for banking or portal details.

If the code takes someone to a page that asks for a new bank account, new wallet address, password, or verification code, stop the process. Verify through a known phone number or bookmarked supplier site. Do not use a phone number, email address, or chat link displayed after scanning.

2. Separate invoice approval from payment release​

An approver can confirm that goods or services were received. A different person—or a second approval step—should release the payment. This separation makes a rushed QR prompt less likely to turn into an immediate transfer.

For small teams where one person must do both jobs, use a compensating control: a daily payment report reviewed by the owner, an approval threshold, or a required callback for any new payment destination. The goal is an independent moment to notice that the route changed.

3. Use the browser destination, not the code, as the decision point​

Mobile cameras commonly preview the destination before opening it. Train staff to pause there. They should look for a familiar domain—not just a familiar logo—and close the page if the address is misspelled, unusually long, or unrelated to the vendor.

Better yet, direct employees to bookmarked supplier portals or links stored in the vendor master record. That turns a QR scan from a payment instruction into a convenience for locating information, while the actual payment still starts from a trusted destination.

4. Protect credentials and authentication codes​

A valid supplier account may use multifactor authentication. A legitimate code can prompt a login, but no vendor representative needs an employee to read an authentication code aloud or send it through chat. Treat a request for a password, one-time code, or device permission after an unexpected scan as an escalation, not a routine payment step.

Use unique passwords and multifactor authentication for financial accounts. Limit who can add payment methods, edit bank details, issue refunds, or access stored customer payment data. These controls reduce the damage if one employee's mobile session is compromised.

Protect customer-facing QR payments​

Customer trust depends on a payment flow that is obvious and verifiable. A customer should be able to confirm the merchant name and total before submitting payment.

Use these practical safeguards:

• Mount codes behind a clear protective surface instead of placing loose stickers over existing signs.
• Display the destination domain in plain text near the code so customers have another way to reach the page.
• Give customers a non-QR alternative, such as a card terminal, a short typed URL, or a staff-assisted payment option.
• Inspect signs at opening and closing, especially in public or unattended areas.
• Reconcile QR-payment platform deposits to sales records every day or shift, including processor fees, tips, refunds, and chargebacks.

If you operate more than one location, log each sign's location and code version. That makes it possible to isolate a compromised sign rather than taking every payment channel offline.

Keep records that make discrepancies visible​

A clean reconciliation will not prevent a malicious scan, but it can shorten the time between an error and discovery. The IRS recognizes credit-card receipts and statements as supporting documents, while also expecting records to identify the payee, amount, date, proof of payment, and business purpose. A card statement alone rarely explains an unusual payment well enough.

For each QR-enabled payment channel, retain:

• The original invoice, order, or customer transaction record.
• Evidence of approval and the approved payment method.
• The payment confirmation, processor settlement report, and any fee detail.
• The vendor or customer identifier that ties the transaction to your books.
• Notes of any changed payment instructions and how they were independently verified.

Reconcile outgoing payments to the accounts-payable aging and vendor statement, not only to the bank feed. Reconcile incoming QR payments to the point-of-sale or invoicing system, then record gross sales, fees, refunds, and taxes separately. This prevents a net deposit from hiding either a missing payment or an unexpected charge.

Here is a useful month-end question: can you trace every QR-related bank movement back to an approved invoice, customer sale, or documented expense? If the answer is no, flag it for review before the books are closed.

What to do after a suspicious scan or payment​

Speed matters, but so does preserving evidence. Do not delete the message, invoice, or screenshot that triggered the concern.

1. Stop the payment workflow and contact the bank, card issuer, processor, or payment platform through its known support channel. Ask what recovery or reversal options remain.
2. Preserve the invoice, QR image, destination URL, payment confirmation, related email headers, and timestamps. Record who scanned the code and what information was entered.
3. Reset credentials and revoke active sessions for any account accessed through the suspicious page. Review connected devices and permissions.
4. Review recent vendor-master changes, payment batches, refunds, and user-access logs for related activity.
5. Notify affected customers or suppliers with verified contact information when their data or payment instructions may be involved. Follow your incident-response and legal obligations for the jurisdictions you serve.
6. Report suspected fraud to the appropriate financial institution and, where relevant, to the FTC or FBI Internet Crime Complaint Center.

Afterward, document the root cause in your internal control log. Was the issue an unapproved code, a supplier-information change, a missing approval, a delayed reconciliation, or a training gap? A specific answer produces a better fix than a generic reminder to be careful.

A 10-minute team checklist​

Use this checklist in your next finance or operations meeting:

1. Identify every QR code used for vendor payments, customer checkout, expense reimbursement, or marketing.
2. Name an owner for each customer-facing code and a backup reviewer for payment-destination changes.
3. Store verified supplier contact routes and portal URLs in the vendor master record.
4. Require independent verification before changing bank, wallet, or payment-portal details.
5. Confirm that payment release has a second reviewer, threshold, or daily oversight report.
6. Give employees an approved non-QR route to common suppliers and expenses.
7. Reconcile payment-platform deposits and accounts payable promptly, with fees and refunds shown separately.
8. Practice the escalation path for a suspicious invoice, code, or authentication request.

The objective is not to ban every QR code. It is to keep an image from becoming an unreviewed instruction to move money.

Simplify Your Financial Management​

Clear records and timely reconciliations make payment anomalies easier to spot and investigate. Beancount.io offers plain-text accounting that is transparent, version-controlled, and AI-ready, so your financial history stays understandable when you need it most. Get started for free and build a reviewable system for every payment channel.