Reviewed October 17, 2026. This guide replaces an earlier general overview; the original publication date and URL are retained.
A printed QR code can connect a customer to payment, ordering or a website. Give each deployed sign an owner and verify its actual destination rather than treating every code as a wallet transaction.
Distinguish the code from the payment method
A QR symbol is an entry point. Record whether it opens a hosted checkout page, an ordering menu or a supported payment application. A website link does not by itself establish which payment rail processes the eventual transaction. EMVCo publishes specifications for merchant-presented and consumer-presented payment QR codes; that distinction helps frame provider questions but does not certify an individual sign or webpage.
Create a sign-to-destination register
For each counter, table or printed invoice, record the sign identifier, approved destination, business display name, provider account owner and replacement date. Keep an approved image of the sign in the register. Use a test device to inspect the destination and merchant identity without entering real card details into an unfamiliar page. If redirects are expected, have the provider document the approved sequence.
Test one physical substitution scenario
Imagine a cafe has ten table signs and one is covered by a different sticker. The owner’s check should discover which location changed, withdraw that sign and direct customers to another verified checkout method. Do not ask customers to test the questionable code. Preserve the altered sign and observation time for the responsible provider or security contact. An attractive logo or familiar-looking page is not sufficient verification.
Assign a check at opening and after replacement
Name who visually checks deployed signs and who can approve replacements. Repeat the destination check after a menu, domain or provider change. For a dynamic order QR, ask which order and amount the checkout displays and what happens when the code expires. The finished output is a small asset register plus a safe fallback, not an assumption that QR acceptance automatically reduces fraud.
Sources and related reading
Primary reference: EMVCo’s QR payment overview. Worked examples are illustrative analysis, not client results or provider quotes.
Continue with the AMS Florida merchant reading path and merchant technology decision worksheet.
