QR code fraud: what merchant governance gaps are teams missing?

TL;DR: QR code fraud is being misframed as a scanning problem, but Feedzai argues the real exposure sits in merchant onboarding, sub-account governance, and payment flows that cannot be recalled once funds move. The control gap is upstream: institutions must govern who can create codes, how payees are scored, and how liability is assigned before settlement closes the window.

Editorial analysis by NHI Mgmt Group, based on content published by Feedzai: “QR Codes Aren’t the Problem. The Fraud Behind Them Is”.

Key questions

Q: What breaks when QR code fraud is treated as a scan problem instead of a governance problem?

A: The control model breaks because it places the burden on the victim while leaving merchant onboarding, sub-account permissions, and payee risk ungoverned.

Q: Why does real-time payment settlement make QR fraud harder to stop?

A: Real-time settlement shortens the detection window between code creation, authorisation, and fund movement.

Q: What are the signs that a merchant or sub-account is being abused for QR fraud?

A: Look for unusually high QR code generation, low conversion rates, repeated use of the same payout wallet, and timing patterns that do not match normal customer behaviour.

Practitioner guidance

• Harden merchant and sub-account onboarding Verify who is authorised to create payment artefacts, not just who owns the master account, and require stronger approval for any delegate that can generate QR payment codes.
• Monitor generation-to-payment patterns Flag merchants or sub-accounts that issue unusually high volumes of codes with low completion rates, long delays, or repeated concentration around the same payout wallet.
• Score the payee before settlement Use real-time recipient risk scoring so the payment flow can be blocked while the transaction is still reversible or before finality is reached.

Bottom line: QR code fraud is best treated as a governance failure in merchant onboarding and delegated permissions, not as a simple user error.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →