QR code fraud is a merchant governance failure, not a scan error

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Feedzai's blog post: QR code fraud is a payment governance problem rooted in onboarding, sub-account control, and irreversibility of settlement rather than a simple user scanning mistake.

Why it matters: This matters to fraud, IAM, and platform teams because the weakest control is often delegated trust, not the QR code itself, so prevention has to move upstream into authorisation, monitoring, and liability management.

By the numbers:

• Forrester reports that fraud involving QR codes, SIM swaps, and fake payment apps rose 15% across APAC in the past year.

Context

QR code fraud is best understood as a trust and governance failure in payment ecosystems, not as a flaw in the square image itself. The risk emerges when onboarding, delegated permissions, and settlement rules allow bad actors to create believable payment paths faster than institutions can detect them.

The identity angle is real because merchant accounts, sub-accounts, and payment permissions function like governed identities inside a transaction network. When those identities are weakly verified or loosely monitored, a legitimate platform can become the fraud vector rather than the victim.

Key questions

Q: What breaks when QR code fraud is treated as a scan problem instead of a governance problem?

A: The control model breaks because it places the burden on the victim while leaving merchant onboarding, sub-account permissions, and payee risk ungoverned. Fraudsters exploit trusted creation paths, not just image recognition gaps. Once payment finality is reached, recovery becomes much harder, so the real loss is control over the upstream identity and authorisation layer.

Q: Why does real-time payment settlement make QR fraud harder to stop?

A: Real-time settlement shortens the detection window between code creation, authorisation, and fund movement. That leaves little time for manual review or retrospective intervention. If the institution does not score the recipient and the creation pattern in flight, the payment may clear before the fraud can be challenged or reversed.

Q: What are the signs that a merchant or sub-account is being abused for QR fraud?

A: Look for unusually high QR code generation, low conversion rates, repeated use of the same payout wallet, and timing patterns that do not match normal customer behaviour. Those signals suggest the trusted identity behind the code may be operating outside its intended purpose. The anomaly is often in the identity behaviour, not the QR image.

Q: Who is accountable when QR fraud crosses banks, telcos, and platforms?

A: Accountability increasingly sits with the institutions that control onboarding, monitoring, and fraud surveillance across the ecosystem. Regulators are moving away from consumer-blame models and toward shared responsibility, so each party needs clear ownership for its part of the payment chain. The practical test is whether the institution can prove it met its duty before the loss occurred.

Technical breakdown

Why QR codes are only the delivery mechanism

A QR code is simply an encoding format that directs a user into a payment flow. Fraud succeeds when the code inherits trust from a merchant, platform, or sub-account that should have been checked more carefully. Traditional anti-fraud controls often inspect text-based links or card-style signals, but QR abuse bypasses that mindset because the risky object is not the image itself. The operational problem is trust delegation: once a code is generated by an authorised account, downstream systems may treat it as legitimate even when the underlying actor should have been constrained.

Practical implication: Treat QR creation rights and merchant identity governance as the first control point, not the scan event.

Why sub-account governance creates the highest-risk path

Sub-accounts can inherit legitimacy from a larger platform while still being able to generate payment codes or advertising assets at scale. That makes them a high-risk abuse path when permissions are broad, offboarding is weak, or behaviour monitoring is absent. In identity terms, this is delegated authority without sufficient lifecycle control. The platform may be trusted, but the operational actor inside it may not be. This is why fraud campaigns can appear to come from a familiar brand while actually being driven by a narrower and less visible set of permissions. See the Workforce Identity Security Guide.

Practical implication: Constrain sub-account capabilities with least-privilege rules and continuous monitoring of who can mint payment identifiers.

Why settlement speed removes the usual recovery options

Real-time payment systems compress the decision window between code generation, authorisation, and transfer finality. That reduces the value of after-the-fact detection because once funds clear, traditional recall options may be unavailable or limited. In that model, the most important control is not post-transaction cleanup but in-flight risk scoring of the payee, the merchant, and the generation pattern. The governance challenge is that the institution may know enough to stop the payment only if it scores the receiving identity before settlement closes the window. See the Account Takeover Prevention Guide.

Practical implication: Move fraud controls earlier in the flow and score the recipient in real time before settlement finality is reached.

Threat narrative

Attacker objective: The attacker wants to convert legitimate platform trust into irreversible payments and then withdraw the value before coordinated response can occur.

1. Entry begins when fraudsters gain access to legitimate merchant or sub-account permissions that can generate QR payment codes.
2. Credential and trust abuse follows when those authorised identities are used to create believable payment paths or advertising assets.
3. Impact occurs once victims pay and the transaction settles, leaving little or no room for reversal or recovery.

Breaches seen in the wild

• Coupang Signing Key Breach: Unrevoked signing key credentials expose 33.7 million records after employee offboarding failure at Coupang.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

QR code fraud exposes a delegated-trust failure, not a consumer scanning failure. The most important control question is who was allowed to create the payment artefact in the first place. When institutions focus only on the scan event, they ignore the merchant and sub-account identities that actually make the fraud possible. Practitioners should treat code creation rights as governed access, not as a marketing convenience.

Merchant onboarding has become a fraud control surface. If onboarding does not validate who can act for a merchant, the rest of the payment chain inherits that weakness. That is especially true in ecosystems where legitimate brands can spawn sub-accounts or third-party delegates. Merchant onboarding is therefore not just an acquisition process but a fraud boundary. Practitioners should align onboarding checks, delegated permissions, and ongoing behavioural review.

Payee-risk scoring is the right control layer for real-time payment fraud. The article’s central point is that fraud can succeed even when the payer willingly authorises the transfer. That means the recipient and its activity pattern must be scored before settlement closes the window. The governance gap is not absence of user caution; it is absence of in-flight recipient control. Practitioners should move detection upstream of finality.

APAC regulators are shifting liability from individuals to institutions, and that changes the operating model. Singapore and Australia are already framing scam responsibility as a chain of institutional duties rather than a consumer mistake. That matters because control ownership, evidence collection, and response timing now need to be demonstrable across banks, telcos, and platforms. Practitioners should prepare for accountability to follow the ecosystem, not the victim.

Sub-account abuse is a broader platform identity problem, not a niche QR issue. Any trusted digital platform that lets secondary identities mint payment, advertising, or transactional artefacts inherits the same risk shape. The underlying failure is lifecycle governance over delegated identities that can outlive oversight or be repurposed for fraud. Practitioners should model sub-accounts as governed identities with explicit scope and monitoring.

From our research library:

• Nearly 60% of companies reported that fraud losses were still increasing in 2025.
• Read next: KYB and Business Identity Verification Guide

What this signals

Merchant identity is the real control plane for QR fraud. Once platforms let secondary identities create payment artefacts, the fraud problem becomes one of delegated authority and lifecycle governance. That makes onboarding quality, scope restriction, and behaviour monitoring more important than image filtering or user education alone.

Payee-risk governance will matter more as settlement gets faster. The faster funds move, the earlier the institution must decide whether a recipient is legitimate. Fraud teams should expect more pressure to demonstrate in-flight controls over the receiving side of the transaction, not just retrospective detection after loss.

For practitioners

• Harden merchant and sub-account onboarding Verify who is authorised to create payment artefacts, not just who owns the master account, and require stronger approval for any delegate that can generate QR payment codes.
• Monitor generation-to-payment patterns Flag merchants or sub-accounts that issue unusually high volumes of codes with low completion rates, long delays, or repeated concentration around the same payout wallet.
• Score the payee before settlement Use real-time recipient risk scoring so the payment flow can be blocked while the transaction is still reversible or before finality is reached.
• Tie liability controls to ecosystem roles Document which institution owns fraud surveillance, onboarding checks, and alert response across banks, telcos, and digital platforms so accountability does not stop at the consumer.

Key takeaways

• QR code fraud is best treated as a governance failure in merchant onboarding and delegated permissions, not as a simple user error.
• The article cites a 15% rise in APAC fraud involving QR codes, SIM swaps, and fake payment apps, which underlines how quickly the scam surface is expanding.
• Institutions need stronger onboarding, real-time payee scoring, and clearer liability ownership across the payment ecosystem.

Related NHI Mgmt Group resources: KYB and Business Identity Verification Guide · Account Takeover Prevention Guide · Workforce Identity Security Guide · Coupang Signing Key Breach

Key terms

• Merchant Onboarding: Merchant onboarding is the process of verifying a business before allowing it to use a payment platform. It usually combines identity proofing, ownership checks, risk review, and compliance validation so the provider can reduce fraud, meet regulatory obligations, and decide what level of access the merchant should receive.
• Connected Account Governance: The controls that track, review, and remove third-party accounts linked to an application. It covers who can connect, what scopes are granted, how refresh is handled, and how access is ended when a user, vendor, or business relationship changes.
• Payee Risk Scoring: An in-flight fraud control that evaluates the recipient of a payment before settlement finality. It shifts detection focus from the payer or the instrument to the receiving identity, which is critical when authorised users can still be manipulated into sending funds.
• Payment Finality: Payment finality is the point at which a transaction can no longer be reversed or returned. In ACH, finality arrives later than initial authorization, which means a payment may look valid before funds are actually secured. That gap creates operational risk for merchants that ship goods or deliver services too early.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore nhimg.org for resources that connect identity governance to the broader security disciplines your programme depends on.