# Crypto QR code safety: the address is the attack surface

> Crypto QR risks concentrate in one place: the address. Malware swaps addresses on clipboards, fake codes get pasted over genuine ones, and a confirmed transfer cannot be reversed. Verify the first and last four characters on the receiving device, send a small test amount first, then send the balance.

Source: https://useqr.app/docs/payments/crypto-qr-code-safety · Last reviewed 2026-08-21 · UseQR is free forever, no signup.

---

## Why crypto changes the QR threat model

Scanning a malicious URL QR costs you a phishing attempt you can still refuse. A crypto
payment QR is different for one reason: **a confirmed transaction is final**. No chargeback,
no fraud department, no support line that can claw it back. Irreversibility multiplies every
other risk: a mistake that would be an inconvenience with a card is a total loss here.

And the entire attack surface is one string: the address. Every crypto QR scam is ultimately
the same scam. You intended to pay address A and the system fed you address B.

## The three swap attacks

- **Clipboard hijackers.** Malware that watches the clipboard for strings shaped like crypto
  addresses and silently replaces them with the attacker's. This is exactly why QR codes
  *help*: a scanned [BIP21](/glossary/bip21) or [EIP-681](/glossary/eip-681) payload goes
  camera-to-wallet without transiting the clipboard, closing the classic infection point.
  The QR is the countermeasure, provided the code itself is genuine.
- **Overlay stickers.** A printed code on a donation poster or payment sign is replaced by
  [a sticker carrying the attacker's address](/docs/security/qr-code-stickers-placed-over-real-ones):
  the same dominant fraud every
  [payment QR scheme](/docs/payments/qr-payment-standards-compared) faces, worse here
  because no confirmation screen shows a registered account name. An address is anonymous
  by construction; nothing on screen says "this is not the charity".
- **Malicious generators.** A dishonest QR generator can encode its own address instead of
  yours. You would not notice by looking at the code. Generate crypto codes with
  [client-side tools](/docs/security/client-side-vs-server-side-qr-generation)
  where the payload provably comes from your input (UseQR's
  [bitcoin](/bitcoin-qr-code) and [ethereum](/ethereum-qr-code) builders run entirely in
  your browser), then verify the output independently.

## The verification ritual

Before confirming any crypto payment from a scanned code:

1. **Compare the first four and last four characters** of the address in your wallet
   against the address the payee shows you through a second channel: their website, an
   invoice, a message. Check *both* ends: attackers can grind vanity addresses that match a
   few leading characters, so the trailing characters are the stronger check.
2. **Send a test amount first** for any transfer that would hurt to lose. Confirm the payee
   received it, then send the balance. Two transaction fees are trivial insurance against an
   unrecoverable loss.
3. **Prefer amount-carrying payloads.** A `bitcoin:addr?amount=0.015` URI or its
   [Ethereum equivalent](/glossary/eip-681) prefills the amount, removing the
   fat-finger-a-decimal failure alongside the copy-paste one.

If you *made* the code, verify from the other side: decode your own printed code with
[/validate](/validate) and diff the address character-by-character against your wallet
before anything is published, and periodically re-check public codes for overlay stickers.

For Lightning payments the string is an invoice rather than an address, and expiry changes
the mechanics: see [Lightning invoice QR codes](/docs/payments/lightning-invoice-qr), but
the discipline is identical: verify out-of-band, test small.

## What a QR code cannot protect you from

Honesty about the limits: verifying the address proves you are paying *the address you were
given*. It cannot prove the person who gave it to you is who they claim, a scammer's
genuine address verifies perfectly. Address verification defeats swapping; it does nothing
against a fraudulent counterparty. That judgement stays with you, and no QR tooling,
including ours, changes it.

## FAQ

### Can a QR code steal my crypto?
Not by being scanned. The risk is a swapped address (via overlay sticker, clipboard
malware, or a dishonest generator), so that your wallet pays the attacker. Scanning itself
moves nothing; confirmation in your wallet does.

### Why check the last characters of an address, not just the first?
Attackers can generate vanity addresses matching a few leading characters of a target
address cheaply. Matching the trailing characters as well makes a convincing swap
exponentially harder, so always compare both ends.

### Is it safer to scan a QR code than copy-paste an address?
Yes, against clipboard hijackers, the scanned payload bypasses the clipboard entirely.
But it moves trust to the code itself, so the printed or displayed code must be verified
and protected against overlay stickers.

### Should I really send a test transaction first?
For any amount that would hurt to lose, yes. Send a small amount, confirm receipt with the
payee, then send the rest. The extra fee is negligible compared with an irreversible
mistake.

## Try it

- https://useqr.app/bitcoin
- https://useqr.app/ethereum
- https://useqr.app/validate