How Pay by Bank Protects You From QR Code and Payment Link Scams
QR codes and payment links make paying quick and easy, and that is exactly why scammers try to fake them. Here is how these scams work, why paying by bank is safer by design, and how to check you have scanned a genuine SSV SmartPay code before you pay.
QR codes and payment links are safe to use, but scammers try to trick you with fake ones, so the golden rule is to check before you pay. The most important thing is to make sure you are on the genuine page before you enter anything. A genuine SSV SmartPay code opens a page on the ssvsmartpay.co address (for example app.ssvsmartpay.co) and shows the business name and the amount for you to confirm before you pay.
How QR Code and Payment Link Scams Work
First, the reassuring part: scanning a QR code cannot “hack” your phone. A QR code simply opens a page for you, and a payment link does exactly the same thing. The risk is never the code or the link itself, it is the page it takes you to, and what you do once you are there.
Scammers exploit that in a few predictable ways. Knowing them is most of the battle.
Fake QR stickers (“quishing”)
A scammer prints a fake QR and sticks it over a real one on a sign, poster, or stand. You think you are paying a business, but the code sends you to their fraudulent site instead.
Parking signs, tables, donation standsFake payment links
An unexpected text, email, or message contains a link to “pay” or “confirm details”. It leads to a convincing copy of a real site, built only to capture your card or banking details.
Texts, emails, social messagesPressure and urgency
Whatever the channel, scams lean on urgency: a fine to pay now, an account to unlock, a delivery to release. The rush is designed to stop you checking. Slowing down is your best defence.
“Act now”, “final notice”, “you owe”In almost every case, the scam only works if you enter your details on a fake page you reached from the code or link. So the single most important habit is simple: before you type anything, make sure you are on the genuine page. That one check stops most of these scams.
How Pay by Bank Keeps Your Payment Secure
Pay by Bank, the open banking method SSV SmartPay uses, is built on your own bank’s security rather than on card details that can be copied and reused.
When you pay a business this way, the payment has to be approved through your own bank using Strong Customer Authentication, the same secure login and confirmation you use for your normal banking. A scammer cannot complete a payment without that approval, and you confirm the exact business and amount as part of it.
The one habit that matters most: before you enter any details or approve anything, make sure you are on the genuine SSV SmartPay page. Everything else follows from that one check.
It does not make you invincible, no payment method does, but it ties every payment to your own bank’s security and to a clear confirmation of who you are paying and how much.
How to Check a Genuine SSV SmartPay QR or Link
Before you pay, a few quick checks confirm an SSV SmartPay code or link is genuine. Each one only takes a moment.
Check the web address
After scanning, a genuine SSV SmartPay payment page sits on the ssvsmartpay.co domain, for example a link beginning app.ssvsmartpay.co. If the address is something else, or looks misspelled or odd, stop and do not continue.
Only log in once you have checked the address
A genuine SSV SmartPay payment is approved through your bank’s secure login. Only enter your banking details or approve a payment once you have confirmed the web address is the real SSV SmartPay one.
Check the business name and the amount to confirm
Before you confirm, the business name and the amount should match who you meant to pay, both on the payment page and when your bank asks you to approve. If either looks wrong, stop.
Check the physical sign
On a stand or poster, look for a sticker stuck over the original code, peeling edges, or a mismatched design. A genuine SSV SmartPay sign carries the SSV SmartPay branding and the major UK bank logos.
Trust that instinct. Close the page without entering anything. Then contact the business yourself, using a phone number or website you already trust, and ask them to confirm their real QR code or to send you a payment request directly. A genuine business will always be glad to help you pay safely.
Simple Rules to Stay Safe
These few habits protect you across almost every payment scam, not just QR codes and links.
Slow down
Urgency is the scammer’s favourite tool. A real payment is never so urgent that you cannot pause to check the address, who you are paying, and the amount.
Verify the source
Got an unexpected text, email, or QR? Check with the business using contact details you already trust, from their official website or a receipt, not the details in the message.
Only enter details on a page you have checked
Before entering any details or logging in, make sure the web address is genuine and that you started this payment yourself. If a message pushed you to a page unexpectedly, stop and check first.
Report it
If you have paid a scammer or shared details, contact your bank straight away. In the UK you can report fraud and attempts to Action Fraud, and telling the business helps them protect others.
“You do not need to be a security expert. Check the address, check who you are paying and how much, and only enter your details on a genuine page you opened yourself.”
Frequently Asked Questions
What is a QR code scam (quishing)?
Quishing is when a scammer uses a fake QR code to send you to a fraudulent website, usually to steal card details or banking logins. The code itself is harmless; the danger is where it takes you. A common trick is sticking a fake QR over a real one on a sign.
How can I tell if a QR code is safe to scan?
After scanning, check the web address matches the company you expect and is not misspelled, and only enter details once you are sure the page is genuine. On a physical sign, check no sticker has been placed over the original code.
How do I know a payment link is genuine?
Be cautious with links in unexpected messages. Check the address points to the real company’s domain, watch for urgency and spelling mistakes, and if unsure contact the business using details you already trust rather than replying to the message.
How do I know I scanned the real SSV SmartPay QR?
A genuine SSV SmartPay code opens a secure page on the ssvsmartpay.co address (for example app.ssvsmartpay.co), shows the business name and the amount, and is approved through your bank’s secure login. Check the address, the business name, and the amount, and only enter details once you are sure the page is genuine. Also make sure any physical sign has not been covered with a sticker.
What is the most important check before I pay?
The web address. A genuine SSV SmartPay payment page is on the ssvsmartpay.co address, for example app.ssvsmartpay.co, and shows the business you are paying and the amount. Only enter details or approve once you have confirmed the address is right, the business is correct, and the amount matches.
What should I do if I think a QR code or link is a scam?
Do not enter any details. If it is a physical sign, tell the business so they can check it. If you have already paid or shared details, contact your bank immediately. In the UK you can report fraud and attempted fraud to Action Fraud.
Continue exploring SSV SmartPay
References
- Action Fraud (UK national fraud and cybercrime reporting centre). Available at: https://www.actionfraud.police.uk/
- Take Five to Stop Fraud. Available at: https://takefive-stopfraud.org.uk/
- Financial Conduct Authority. Open banking. Available at: https://www.fca.org.uk/firms/open-banking
Important information
General guidance, not a guarantee. The checks in this article greatly reduce the risk of QR code and payment link fraud, but no single step makes any payment method completely fraud-proof. Stay alert and use your judgment.
Check the genuine web address. This article states that genuine SSV SmartPay payment pages sit on the ssvsmartpay.co domain. Always confirm the exact current address with SSV SmartPay, as domains and links can change over time.
Reporting fraud. If you have lost money or shared details, contact your bank immediately. In the UK, report fraud and attempted fraud to Action Fraud.
SSV SmartPay terms. Full pricing, terms, and conditions are available at ssvsmartpay.co/our-pricing. SSV SmartPay Limited is registered in England and Wales (CRN 15424021). SSV SmartPay is not directly FCA-regulated; payment initiation services are provided by FCA-authorised Payment Institution partners.
T&Cs Applied
Pay with confidence, straight from your bank
SSV SmartPay lets you pay and get paid by bank, with approval in your own banking app. Sign up in minutes, typically approved within 24 hours.
Start free trial Download the app Or get in touch with the team →Frequently Asked Questions
What is a QR code payment scam?
A QR code payment scam, also known as quishing, uses a fake QR code to redirect you to a fraudulent website designed to steal payment or banking details.
How can I tell if a QR code is safe?
After scanning, check that the web address is genuine and correctly spelled. Before paying, confirm the business name and payment amount, and check that a physical QR code has not been covered with a fake sticker.
Are QR codes safe to use for payments?
Yes, QR codes themselves are safe. The main risk is being redirected to a fraudulent website, so always check the destination before entering details or approving a payment.
How do I know if an SSV SmartPay payment link is genuine?
A genuine SSV SmartPay payment page uses the ssvsmartpay.co domain, shows the business name and payment amount, and allows you to approve the payment through your bank's secure authentication.
Is Pay by Bank safer than paying by card?
Pay by Bank uses your own bank's security and authentication rather than requiring you to enter card details on a payment page. However, no payment method is completely fraud-proof, so you should always verify the payment page before approving a transaction.
What should I do if I think a QR code is a scam?
Do not enter any personal or banking details. Close the page, contact the business using trusted contact information, and if you have already shared details or made a payment, contact your bank immediately.
What is the most important thing to check before making a QR payment?
Check the web address first. Then confirm that the business name and payment amount match what you intended to pay before approving the transaction.
