What should I check when scanning a QR code for a swap deposit address

07 September 2026

The first thing to verify when scanning a QR code for a swap deposit address is that the decoded address exactly matches the one displayed on the exchange interface before you scan. Second, confirm the QR code was generated by the exchanger itself, not by a third-party site, browser extension, or screenshot that could have been tampered with. These checks matter because a QR code is simply a visual encoding of text - anyone who can alter the image or the source that produces it can substitute a different wallet address without changing what the code looks like to the naked eye.

A QR code encodes a string of characters, typically a cryptocurrency address and sometimes a memo or destination tag. When your mobile wallet scans it, the wallet reads that string and populates the recipient field. If the string has been replaced, you send coins to the wrong wallet. The human eye cannot distinguish a legitimate QR code from a fraudulent one by appearance alone. Both look like a square of black-and-white modules. The only way to catch a substitution is to compare the decoded address against the one you expect.

Start by opening the swap interface on the exchanger's website or app. The exchanger will display the deposit address in text, often alongside a QR code. Read that text address aloud or compare it character by character with the string your wallet shows after scanning. Do not rely on the fact that the QR code is on the same page - malware, browser extensions, or man-in-the-middle attacks can replace the QR image while leaving the text unchanged, or vice versa. Look for both to match.

On a mobile device, screen space is limited. Many wallets truncate the displayed address after scanning, showing only the first and last few characters. This is not sufficient. A truncated address can match a fraudulent one in those visible segments while differing in the middle. Expand the full address in your wallet app before confirming the transaction. If your wallet does not offer a way to view the complete address, manually copy the scanned address into a notes app and compare it side by side with the exchanger's text address.

Another risk specific to QR codes is that the code may encode more than an address. Some scammers embed a different cryptocurrency's address or a malicious contract call. For example, a QR code that looks like it is for a Bitcoin deposit might encode an Ethereum address. The wallet will attempt to send to that address, but the network will reject it, or worse, the wallet might interpret the string as a different token and complete a swap to a contract you did not intend. Always confirm that the address prefix and format match the coin you are swapping. Bitcoin addresses start with 1, 3, or bc1. Ethereum addresses begin with 0x. If the QR code produces a string that does not look like the right kind of address, do not proceed.

Finally, consider the source of the QR code. If you are viewing it on a public computer, a borrowed phone, or a screen that someone else controls, the risk increases. Even on your own device, browser extensions can inject or replace QR images. The safest practice is to generate the QR code yourself from a trusted source - ideally, the exchanger's official mobile app or a page you navigated to directly by typing the URL, not by clicking a link or scanning a code posted elsewhere. The hub page "Mobile wallet swap safety mistakes to avoid" covers broader pitfalls, including the fact that copying an address on a phone is riskier than on a desktop, because clipboard malware and address poisoning attacks are harder to spot on a small screen. That context reinforces why scanning a QR code without verification is one of the most common and costly errors in mobile swaps.

In short, scanning a QR code is convenient but not trustworthy by default. The code itself is just data. What matters is whether that data matches the exchanger's intended address. Verify the decoded string in full, confirm it matches the coin you are swapping, and ensure the code came from a source you control. If anything looks off, cancel the transaction and regenerate the deposit details.

Back to trezor