A caller sends a QR code for payment or verification

Establish the underlying task

Check which real order or account the code concerns. Calling it identity verification does not make a payment safe. If the issue can be handled inside an existing app, open that app independently rather than using an unexpected destination supplied by a caller.

Inspect a refund example

Someone promises an incoming refund, while your real bank shows a transfer to a specific recipient. Stop and read the amount and direction. Do not approve merely to see whether money returns. For a website, inspect the full address: a logo and HTTPS do not establish ownership. Avoid installing apps or configuration profiles from an unexpected code.

Respond to the completed action

Scanning, entering a password and approving a payment are different events. Record what occurred. Secure the account if you signed into an unrelated site; contact the payment provider if funds moved. Preserve the code and destination privately for support without publishing potentially active access or payment information.

Quick checklist

• Verify the real task.
• Read amount, recipient and direction.
• Inspect the complete website address.
• Respond to the action actually completed.