GOBLIXO
Identify what the scan opened
A QR code is a way to encode information. In a crypto workflow, it may represent receiving details or open a website. Those are different situations with different checks. A neatly printed square does not identify who controls the destination or establish that a request is legitimate.
After scanning, stop before the next action. Read the browser address or wallet preview. A code supplied by a stranger, pasted over another code or delivered in an unexpected message deserves independent verification. The FTC warns that QR links can lead to spoofed sites that imitate familiar services.
For a payment, verify the receiving instructions
Ask the recipient for the asset, network, address and any required memo or tag through a trusted channel. Compare those details with the wallet's decoded request. Phantom provides receive addresses and QR displays by network; the sender still needs to choose a supported receiving route.
Do not assume that scanning sets every field correctly or that every app interprets a code in the same way. Review the selected account, actual destination, amount and fee before approving the payment. A successful scan only shows that software read the code, not that the resulting payment is appropriate.
Use a two-person check in a fictional example
Imagine a seller asks for 25 units of token A on network B. A code fills a wallet preview with an address. The buyer should still compare that full address with the seller's independently confirmed instructions, confirm B and check the amount. The square itself cannot answer those questions.
Now imagine the same-looking code opens a website asking to connect a wallet. That is no longer simply an address-entry shortcut. Treat it as a new interaction and understand each requested permission. These examples illustrate the checking process; they are not live payment instructions.
For a website, inspect the domain and the request
Read the full domain before entering credentials or downloading anything. Do not rely only on the logo, page colors or a reassuring message. If an unexpected code claims to come from a known service, reach that service through its official app or a trusted bookmark instead of using the supplied route.
Urgency is not evidence. A page promising to restore a wallet or release a reward can pressure someone into overlooking the actual request. Do not provide a recovery phrase or private key to a page claiming it must validate an account. Public receiving details and recovery credentials serve completely different purposes.
If you scanned but have not approved anything
Separate the steps that happened: opening a link, entering information, connecting a wallet, signing a message and submitting a transaction are not interchangeable events. Close an untrusted page and review what you actually authorized. Do not assume that merely closing it reverses a signature or transaction already submitted.
If credentials were entered or an unfamiliar approval was granted, use the provider's official incident guidance for that specific problem. Keep a private record of the page and action. Avoid following a second unsolicited helper who claims to undo everything in one click.
Make the final preview the real checkpoint
Before sending, confirm the full recipient, supported network, exact asset, amount, required identifier and fee. Compare the decoded request with trusted receiving instructions rather than with the design of the QR graphic. If a field is unclear, ask the recipient or provider before proceeding.
For repeat payments, obtain updated instructions when necessary and do not treat an old screenshot as permanent authority. QR codes are useful for reducing manual typing errors. The verification routine supplies the trust decision the code itself cannot make.
If the code is a payment label, check for another label placed over it. Physical familiarity does not authenticate the final recipient. Verify through the recipient's trusted channel.
