QR code payments for merchants: how they work and the risks

QR code payments let customers pay by scanning a square barcode instead of tapping or inserting a card. They work in two directions. You can display a code that the customer scans with their phone to open a payment page, or the customer can show a code from a payment app that you scan at the register. EMVCo, the standards body behind chip cards, publishes QR code specifications for both directions, which it calls merchant-presented mode and consumer-presented mode.

For many small businesses, the practical version is simpler than either spec: a QR code that opens a payment link. It's cheap to start and easy to get wrong. This guide covers how each setup works, what it costs next to a tap, how scammers abuse QR codes, and when a code is the right tool. Facts are current as of October 2026.

How do QR code payments work?

The code itself does very little. A QR code is a way of storing data, usually a web address, in a pattern a phone camera can read. What happens after the scan depends on who shows the code.

EMVCo compares the consumer-presented version to a chip transaction, except that the data only travels one way, from the code to the merchant. It also says its merchant-presented specification can support account-based payments as well as card-based ones. Whether any of that reaches your counter depends on what your payment provider supports, so ask before you buy a scanner.

Static and dynamic codes

A merchant-presented code is either static or dynamic. A static code never changes: one printed code that opens the same payment page for everyone, often with the customer typing in the amount. A dynamic code is created for one sale, with the amount already filled in.

Dynamic codes are safer and easier to reconcile, because each one matches one order. Static codes are quicker to set up, but they invite typos, and a code that sits in public for months is the easiest kind to cover with a fake.

How do payment links work behind a QR code?

This is the setup most small businesses can use today without new hardware. You create a payment link in your provider's dashboard or virtual terminal, turn the link into a QR code with a QR generator, and print or display it. The customer scans, lands on your provider's payment page, and pays by card. Our payment link guide covers how links themselves work.

Three things follow from that design:

• It's an online card payment. No terminal reads the card, so the sale is card-not-present, with card-not-present pricing and fraud rules.
• Card data stays off your systems. The customer types card details on your provider's hosted page. Merchants that fully outsource card handling to PCI DSS validated providers can qualify for SAQ A, the shortest PCI questionnaire, and PCI SSC's FAQ says the 2025 script-attack check applies to embedded payment forms, not to redirects or emailed payment links.
• The page is only as trustworthy as it looks. The customer decides whether to pay based on the web address and the business name on the page.

Clearo's virtual terminal includes payment links, which can sit behind a QR code on an invoice, a quote, or a counter sign.

What do QR code payments cost?

The same as any card-not-present card sale, which is more than a tap. On Visa's US interchange schedule effective April 18, 2026, a standard consumer credit card in the "all other products" group carries 1.89% + $0.10 in Visa's main card-not-present program, and 1.51% + $0.10 when the card is present (Visa). Your provider's markup comes on top.

Take a made-up coffee cart in Milwaukee that sells 1,500 drinks a month at $6 each, and assume every customer pays with one of those standard Visa credit cards.

The QR route costs $34.20 a month more in interchange alone, or $410.40 a year, and every customer has to type a card number into a phone to buy a coffee. If you already have a terminal, the tap is cheaper and faster. QR codes earn their keep where there's no terminal, or where the bill arrives on paper. For the full cost picture of online sales, see card-not-present transactions.

Are QR code payments safe?

For the card data, a hosted payment page is fine. The weak point is the code itself, because nobody can tell where a QR code goes by looking at it.

Two federal agencies have warned about this. In a January 2022 public service announcement, the FBI's Internet Crime Complaint Center said criminals tamper with digital and physical QR codes, replacing legitimate codes with malicious ones that send victims to sites built to steal login and financial information. It added that a malicious code can also carry malware.

The FTC has reported scammers covering QR codes on parking meters with their own, and it advises consumers to inspect a code's URL before opening it and to avoid scanning codes in emails or texts they weren't expecting. The FBI has also issued an alert on unsolicited packages containing QR codes used to initiate fraud schemes.

Those warnings are written for consumers, but your customers are the consumers in question. A fake sticker on your sign costs them money and costs you their trust. Here's what each risk looks like from your side:

The open-amount row deserves a second look. Visa notes that enumeration attack transactions are often under $10 (Visa), and a public page where anyone can enter any amount is an easy place to run them. Our guide to card testing fraud covers the defenses. Clearo's online payments screen card payments for fraud with three tools: AVS, CVV checks, and velocity rules.

When do QR code payments make sense?

When there's no terminal handy, or the bill is on paper. Here's how we'd sort the common cases:

Take a made-up restaurant in San Diego that prints a code on each check. The code opens a payment link for that table's bill, so the amount is fixed, it expires once paid, and there's no static code on the table for anyone to cover. That's the safest shape QR payments take. Our page for restaurants covers the rest of the setup.

For market stalls, compare the code with tapping. Clearo's mobile payments include tap to pay and mobile card readers, and our guide to tap to pay on iPhone explains how a phone can take card-present payments. If the customer is standing in front of you, that's usually the better deal.

How do you set up QR code payments safely?

Set up the code like you'd set up a checkout page, because that's what it is:

1. Use a payment link or hosted page from your payment provider, never a homemade form.
2. Use one code per invoice, check, or order wherever you can.
3. Make sure the payment page shows the business name your customers know, matching your card statement descriptor.
4. Print the page's short web address under the code.
5. Turn on address and security code checks and velocity limits for link payments.
6. Inspect printed codes every day, and replace any that look stuck on, peeled, or crooked.
7. Set codes for quotes and events to expire when the quote or event ends.
8. Match QR payments against your invoices every week.
9. Keep another way to pay. Some customers won't want to type a card number on a phone.

A made-up landscaping company in Salt Lake City puts a code on every paper invoice, each one tied to that invoice's payment link. Nothing is posted in public, every code has a fixed amount, and payments match invoices one to one. Our page for home services businesses covers similar setups.

What should you do if you find a fake QR code on your sign?

Treat it as fraud, because it is. In order:

1. Take a photo of the fake code where you found it, then remove it.
2. Don't scan it on a phone or computer you use for the business.
3. Compare your QR payments over the past few days with what you'd expect. A sudden dip can mean customers paid the scammer instead of you.
4. Tell customers. A note at the counter and on your website saying which code is genuine, and what your payment page address looks like, helps anyone who paid the wrong page realize it and call their bank.
5. Report it to your local police and to the FBI's Internet Crime Complaint Center, and tell your payment provider.
6. Replace the code with one in a tamper-evident holder, and add it to your daily opening checklist.

The customer who paid a fake page didn't pay you, so there's no sale to refund. What you can do is help them spot it fast, because the sooner they call their bank, the better their chances.

Common QR code payment mistakes

• Taping one static code to the counter and never checking it.
• Sending in-person customers to a QR code when a terminal is right there.
• Leaving open-amount pages with no minimum and no velocity limits.
• A payment page whose name doesn't match your business.
• Asking customers to text card details when a code won't scan.

Your next step

If you take payments by link or QR code alongside a terminal, your statement shows what each channel costs. Send us a recent one for a free statement review, and we'll show you where a tap would have been cheaper. If you're setting up invoices with payment links for the first time, contact us and we'll walk you through the virtual terminal.