QR Code Substitution
A physical attack on a digital system. Replace the sticker, receive the payments.
Priya Raman · 2 min read
QR codes encode an address. Nobody reads the encoded string; that is the point of the format. It is also the vulnerability.
The physical version
A merchant displays a printed code for payments. Someone covers it with a sticker showing their own address.
Payments go to the attacker. The merchant discovers it when reconciling, which may be days later, and the customers believe they have paid.
This has happened repeatedly with parking meters, charity collections and market stalls, in both crypto and conventional payment systems.
The digital version
A code displayed on a compromised web page, or an image sent in a message, encoding an attacker’s address rather than the intended one.
A user who scans without checking the decoded address has no opportunity to notice.
Why scanning feels safe
It removes typing, which removes typos, which is where most people locate the risk in sending funds.
It also removes verification. A typed address can be checked against a source. A scanned one is trusted because the scan felt like a mechanical operation rather than a decision.
The defences
Check the decoded address after scanning, before sending. Every wallet displays it. Compare against a source you trust, checking characters from the middle rather than only the ends.
Send a test transaction for anything of consequence, and confirm receipt with the recipient before sending the rest.
For merchants, inspect displayed codes regularly. Physical tampering is the easiest attack in this category and the easiest to detect if anyone looks.
Prefer dynamic codes generated per transaction where the payment system supports it. A code that expires cannot be usefully replaced with a sticker.
Verify on a hardware wallet screen for larger amounts. The device shows the destination independently of the computer or phone that decoded the image.
The variant worth knowing
Some attacks encode an address that differs only in a few characters from the legitimate one, so that a casual comparison passes.
This is the same principle as address poisoning and the same defence applies: check the middle, not the ends.
The general point
Every convenience in address handling removes a verification step. Copy and paste removes typing. QR removes copying. Address books remove scanning.
Each of those is a genuine improvement and each one transfers the risk somewhere the user is not looking. Clipboard hijacking attacks the paste. Sticker substitution attacks the scan. Address poisoning attacks the history.
The one defence that covers all of them is the test transaction, which verifies the destination empirically rather than visually. For funds moving from an account at platforms with a real complaints process to a wallet, that means sending ten dollars, confirming arrival, and then sending the rest.
Move any remaining funds to a wallet with a newly generated seed phrase before anything else. Then revoke token approvals, and report the incident to your local authorities and the exchange involved. Do not pay anyone who promises to "recover" your coins. That is a second scam, aimed at victims of the first.