QR codes appear on shop counters, tickets, menus and payment receipts. The same visual format can represent very different actions. A safe workflow identifies what the code is asking the device to do, verifies the destination and confirms the transaction through the relevant provider. This guide gives a practical cross-country method without claiming that any logo makes a code inherently trustworthy.
Identify the action before granting it
Scanning a code can open a website, populate a payment or offer an application download. Do not treat those actions as equivalent. The SPF and CSA advisory explains risks from malicious codes and untrusted downloads. Read the destination and proposed action before proceeding. For a payment, use the trusted provider application and inspect the recipient and amount. For an information link, check the address before entering personal details. A code’s placement at a busy venue does not itself authenticate the website or account behind it.
Understand what a standard does and does not prove
The Bank Indonesia QRIS reference and the NBC Bakong and KHQR information describe national payment ecosystems and standards. Interoperability helps participating systems exchange payment information; it does not prove that the person displaying a code is the seller you intended to pay. Keep the technical format separate from the recipient’s identity. If a displayed name is unexpected, ask the business to clarify and choose another verified method if necessary. Do not assume an unfamiliar account is legitimate merely because the scan is technically accepted.
A code can ask for several different actions
| Item | What the evidence says | Practical check |
|---|---|---|
| Merchant payment | An outgoing financial authorisation | Read recipient, amount and currency |
| Website visit | Navigation to a web address | Check the domain before disclosing information |
| Application download | Installation of software | Use the verified official store or provider route |
| Receipt verification | A claim about a completed transaction | Check the supported provider process and matching record |
| Account recovery | A request affecting access | Initiate recovery independently through the institution |
Check both the payer and recipient records
A successful-looking screen can be copied, altered or unrelated to the purchase. The payer should retain the reference from their own account; the recipient should confirm the matching credit in their own records. Match amount, currency and time, and distinguish pending from completed status. If the two sides disagree, contact the relevant provider with the references rather than exchanging passwords or asking a stranger to log in. Before repeating a payment after a network problem, check history so that a delayed first instruction does not become a duplicate.
Watch for a change in the requested transaction
A refund should not silently become a new outgoing payment, and a request to receive money should not require handing over authentication codes. Read the final confirmation screen even when the earlier conversation sounded legitimate. If a support caller asks you to install remote-control software, grant broad accessibility permissions or move money to a supposed safe account, stop and verify the claim independently. A familiar brand or a compromised friend’s messaging account can be used as a pretext. The exact action requested matters more than the reassurance around it.
Use a short verification routine in public places
At a café, stadium or transport counter, take a moment to compare the code’s recipient with the business. Ask staff if a sticker looks replaced or the account name is unexplained. Avoid exposing the screen’s authentication code to bystanders. Keep the receipt and check the amount before leaving. For an online purchase, return to the seller or provider through a known route instead of following an unexpected replacement payment link. These steps are modest, but they introduce a check at the point where a rushed decision could authorise the wrong destination.
Respond to suspected fraud through the relevant country route
Contact the institution controlling the account and explain the action taken, transaction reference and time. Ask about available restrictions and investigation steps. Preserve relevant messages privately and secure associated device or email access as advised. The technical guidance cited here includes Singapore sources, but local reporting and legal processes vary across Asia. Use the appropriate national or provider route rather than assuming one regional authority handles every case. Do not pay an unsolicited recovery service that promises certainty; an actual institution must assess the specific incident.
A six-step QR verification habit
- Identify whether the scan proposes a payment, website visit, download or access change.
- Read the exact recipient, amount and currency before authorising any financial action.
- Check domains independently before entering credentials and avoid unexpected software installations.
- Confirm receipt through your own account record, not only another person’s screenshot.
- Review history before retrying an uncertain payment.
- Report suspected fraud through verified provider and local channels, retaining the original evidence.
Frequently asked questions
Does a national QR logo guarantee the recipient is genuine?
No. The payment format and the identity of the person displaying it are separate checks.
Is a scan itself always a payment?
No. It may open a website or trigger another proposed action; read what the device is asking you to do.
Can I rely only on a screenshot to confirm receipt?
No. Verify the matching credit or supported receipt check through your own provider.
Sources and verification
- Protecting yourself from malicious QR codes — Singapore Police Force / CSA — 2026-10-23
- Quick Response Code Indonesian Standard — Bank Indonesia — 2026-10-23
- Bakong and KHQR official system information — National Bank of Cambodia — 2026-10-23