Shi Zha Tong visual guides 16 / Shopping and devices

QR codes: check what you are authorising

An apparent payment receipt or check may actually authorise a payment or withdrawal.

An apparent payment receipt or check may actually authorise a payment or withdrawal.
Conceptual illustration, not real people, a crime scene or investigative evidence.
  1. 1

    Receiving a code

    A stranger sends a QR code or screenshot.

  2. 2

    A false purpose

    They claim it receives money, verifies identity or removes a restriction.

  3. 3

    Authorising action

    You are asked to enter an amount, password or confirmation.

  4. 4

    Completing a transaction

    The action may actually authorise a payment or cash withdrawal.

Warning signs

Scanning a code does not verify the other party or the purpose.

Protective action

Read the recipient, amount and authorisation on the official screen before deciding.

Open sources and scope

Based on official advice and cases. The four stages are simplified for teaching; roles and order differ between cases and do not establish wrongdoing by any particular person or service.

Criminal Investigation Bureau: payment codes and cardless withdrawal QR codes (new tab)

Survey and livestream scenarios include risk analysis. Citations do not mean official approval of every statement. Edited: 1 October 2026.