What can go wrong when I scan a QR code to send a swap deposit

21 September 2026

Scanning a QR code to send a swap deposit can result in your funds going to the wrong address, a failed swap, or a complete loss of tokens. The risk is not in the scan itself but in what the QR code represents and how your wallet interprets it.

QR codes encode data, not trust. A code on a screen or printed sticker may contain a deposit address for a swap you intend to make. But it may also contain an address controlled by someone else, a malicious contract, or a string that your wallet misreads. Here is what actually goes wrong.

The QR code points to the wrong address. This is the most common failure. You copy a swap's deposit address from a website, then generate a QR code from a third-party tool or a previous screenshot. If that address is stale - belongs to an expired swap or a different token - your deposit arrives at a destination the exchanger does not monitor. The swap never proceeds. Retrieving funds from such an address often requires contacting support and proving ownership, which may take days or never succeed.

The QR code contains a malicious address. Attackers overlay their own QR stickers on legitimate deposit screens at cafes, ATMs, or public terminals. A code that looks like it belongs to the exchanger actually routes your tokens to a thief. This is a physical-world phishing attack. Your wallet shows the address before you confirm; if you do not check it character by character, you cannot know it is wrong.

Your wallet decodes the QR as a different token type. Some wallets treat QR data as a request to send a specific token on a specific network. If the QR encodes a Bitcoin address but you are swapping carbon credit tokens on a different chain, your wallet may still let you send - but the deposit lands on the wrong ledger. Carbon credit tokens often exist on multiple chains. A QR that worked for one chain may be meaningless on another.

The QR code is a contract interaction, not a simple send. Some swap platforms generate QR codes that call a smart contract function rather than a plain address. If your wallet does not support contract interactions, or if the gas limit encoded in the QR is wrong, the transaction fails. You pay fees for a failed attempt. Worse, if the contract is malicious, it can drain permissions from your wallet.

The QR code expires. Many swap deposit addresses are time-limited. Scanning a code from an old swap order sends funds to an address the exchanger no longer monitors. The tokens sit in a dead end. Carbon credit tokens may have additional metadata or registry requirements; an expired address may not accept them at all.

Your phone's clipboard or QR scanner adds invisible characters. Some scanners prepend or append text to the decoded address - a "bitcoin:" prefix, a "?amount=" parameter, or a trailing space. If your wallet does not strip these, the address becomes invalid. The transaction either fails or, in rare cases, sends to a truncated address.

What to do instead. Always generate the QR code from the exchanger's own interface, on the same device you are using to send. Never scan a code from a screenshot, a printed sticker, or a message. Before confirming, compare the first six and last six characters of the decoded address against the address shown in your swap order. If they do not match exactly, cancel. For mobile wallet swaps with carbon credit tokens, the same vigilance applies - but carbon credits add extra steps around registry verification and token standards, which are covered in the hub page titled "Mobile wallet swap mistakes with carbon credit tokens."

The scan is convenient. It is also the moment when a single pixel difference can cost you the entire deposit. Treat every QR code as a potential error until you verify the address it contains.

Back to carbon credits