Bitcoin payment links and QR codes are standardized payment requests, not scams by themselves. But the "standard" only guarantees the format is correct—it does not guarantee that the recipient is who you think they are. Scanning a code or clicking a link hands your wallet the "recipient address + amount + recipient label" to fill in automatically. The moment you confirm, your money moves according to that request. On-chain transfers are irreversible, so the key question is never "Is the link safe?" but rather: Is the address and amount you see exactly what you intend to pay?
A leading global cryptocurrency platform,suitable for both beginners and experienced traders.
New user benefit: 20% off trading fees upon registration!！
What a Standard Payment Link Looks Like
Bitcoin payment links follow the standard format defined by BIP 21 (and the newer BIP 321). A typical link looks like this:
bitcoin:bc1q...address...?amount=0.001&label=Merchant Name&message=Order 123
After bitcoin: comes the recipient address, and after the question mark are optional parameters. amount specifies the BTC amount, label is the recipient's name, and message is a note. A QR code simply encodes this text into a pattern that your wallet scans and parses automatically.
The standard also defines several rules that protect you. A wallet cannot send payment without your authorization—it must let you manually confirm. Amounts can only be denominated in BTC, so formats like amount=50,000 with commas are not supported. If a link contains parameters with the req- prefix that your wallet does not support, the entire link should be treated as invalid and the wallet should not initiate payment. This means a compliant wallet will not "make do" with a payment request it cannot fully understand.
Three Things You Must Verify
Whether you scan a code or click a link, once the payment confirmation page appears, check the following three items in order. If any one of them does not match, stop the payment.
First, is the address the one you intend to pay? This is the most critical step. If the address has been tampered with, nothing else matters. If you received the link from a chat message, an email, or an unfamiliar webpage, do not simply look at the auto-filled address and hit confirm. Use a different communication channel to confirm the address with the recipient—such as text message, email, or showing it in person, rather than the same chat window. If you are scanning a code on a merchant's official checkout page, the address should theoretically come from the merchant's system, but you should still verify that the first and last characters of the address match what is displayed on the page.
Second, is the amount the BTC amount you owe? The amount parameter is denominated in BTC. If your wallet also shows a fiat conversion, make sure the conversion is reasonable. If the amount field is empty after scanning, it means the request only contains an address and no specified amount, so you need to enter it manually. If the amount after scanning is not what you expected, or if you never agreed to that amount, cancel immediately.
Third, is the recipient label reasonable? The label field is a name the recipient gives themselves, not an identity verified on-chain. A label that says "Some Exchange" does not mean the address actually belongs to that exchange. The label only helps you judge whether the payment request matches the current context.
Scanning vs Clicking a Link: What Is the Real Difference?
Scanning a QR code and clicking a link are essentially the same in terms of security—both parse the same bitcoin: text. The difference lies in the usage scenario and the risk exposure.
Scanning is better for in-person payments or getting an address from a physical medium. Scanning avoids the risk of clipboard malware replacing the address during manual entry or copy-paste. But scanning requires you to trust the source of the QR code—codes displayed at a merchant counter or generated on your wallet's "Receive" page are fine to scan. Codes sent by strangers in private messages or shown in webpage pop-ups should not be scanned.
Clicking a link is better for desktop use. When a desktop browser handles a bitcoin: link, it opens the Bitcoin wallet application registered on your system. The risk is that you do not know what the link points to before clicking. A payment link embedded in a webpage may be generated by a script only at the moment you click, with the address fully controlled by the page. So before clicking a link, first make sure it comes from the official page you are using, not a shortened link forwarded by a third party.
Amount and Protocol Verification: What the Wallet Should Do, What You Should Do
A standard wallet should show a confirmation page after scanning or clicking a link, presenting the address, amount, and label for you to approve manually. This is your window for verification, not a step to skip.
Protocol-level verification is the wallet's job. It needs to correctly parse the bitcoin: URI, recognize the address type (Base58, bech32, or bech32m), parse the amount field, and reject malformed links. If a link contains req- parameters the wallet does not support, the wallet should not proceed.
Your verification happens in the few seconds after the confirmation page appears. Ledger's advice is to assume your computer or phone may be compromised and not fully trust the address shown on the screen. Use the address displayed on your hardware wallet screen for cross-verification. If you do not have a hardware wallet, at least compare the address using a second device or a second channel.
Common Abnormal Situations
The address after scanning does not match what you saw. If the QR code itself comes from a trusted source but the wallet parses a different address than what the source page displays, the wallet app may have been tampered with, or the QR code was replaced during display or transmission. Stop the operation, re-download the wallet from an official channel, or abandon the payment.
The amount in the link is 0 or empty. Some payment requests only contain an address and no amount, so you need to enter it manually. This is not an anomaly, but it means you have no "requested amount" to compare against, so you must confirm on your own how much you owe.
You scanned a code but the wallet did not respond, or a webpage opened. A proper bitcoin: link should open the wallet app, not a browser. If a webpage opens, the link format may be wrong, or the QR code you scanned encodes a URL starting with https:// rather than the bitcoin: protocol. Do not continue operating on that webpage.
You already confirmed the send, but the amount or address is wrong. Once a transaction is broadcast and confirmed, it cannot be reversed. If the recipient address belongs to someone you can contact, you can only ask them to return the funds. If the address belongs to an exchange, some platforms offer a "self-recovery" process, but it is expensive, conditional, and not guaranteed to succeed. If the address belongs to an unknown individual or an uncontrolled contract, the funds usually cannot be recovered.
If You Want to Generate a Payment Link or QR Code for Someone
In your wallet's "Receive" page, fill in the amount and note, then generate a QR code or link to send to the other party. The standard recommends using a new address for each transaction, so do not reuse the same receiving QR code for a long time. The cost is that you need to regenerate for each order; the benefit is reduced risk of address correlation and tracking.
A leading global cryptocurrency platform,suitable for both beginners and experienced traders.
New user benefit: 20% off trading fees upon registration!！
References
- Bitcoin.org·BIP 321: URI Scheme, page published or updated: 2024-11-14; verified: 2026-10-07.
- Bitcoin.org·BIP 21: URI Scheme, page published or updated: 2012-01-28; verified: 2026-10-07.
- CoinMarketCap·What Happens When You Send Crypto on the Wrong Network?, page published or updated: 2026-09-12; verified: 2026-10-07.
- Mercuryo·I have accidentally sent crypto to an incorrect blockchain address. What can I do?, page undated; verified: 2026-10-07.
- Gate.com·What is a Bitcoin QR Code? Definition, Principles, and Usage Guide, page published or updated: 2026-01-03; verified: 2026-10-07.
- Ledger·Verify transaction details, page published or updated: 2026-05-12; verified: 2026-10-07.
- GitHub·BIP 321 URI Scheme (bitcoin-bips-book), page undated; verified: 2026-10-07.
- KuCoin·How to Self-Recover Deposits on Unsupported Networks or Tokens, page published or updated: 2025-03-26; verified: 2026-10-07.
