Czech QR Payment Scam: How Fake QR platba Codes Steal Your Money

QR platba has become a standard payment method in the Czech Republic. You scan a QR code with your banking app, verify the amount and recipient, and confirm the transaction. It is fast, convenient, and integrated into every major Czech bank — George, ČSOB Smart, My KB, and others. But that convenience has created a new attack vector: fake QR codes placed in locations where you expect to pay.

Czech police have documented growing numbers of QR payment fraud cases at restaurants, parking facilities, street vendors, and even charity collection points. Here is how the scam works and how to protect your money.

How QR platba Works (and Where It Goes Wrong)

A legitimate QR platba code contains encoded payment information: the recipient's bank account number (IBAN), the payment amount, and an optional message. When you scan it with your banking app, this information auto-fills in a new payment order. You review it and confirm.

The vulnerability is straightforward: anyone can generate a QR platba code. There is no verification that the code was placed there by the legitimate business. A scammer can print a QR code linked to their own bank account and stick it over the real one. You scan it, see what looks like a normal payment, confirm it, and your money goes to the scammer instead of the business.

Common QR Payment Scam Scenarios in the Czech Republic

1. Restaurant Table QR Codes

Many Czech restaurants have adopted table-side QR codes for payment. A scammer visits the restaurant, places a sticker with their own QR code over the real one, and leaves. Every customer who scans that code sends their payment to the scammer's account.

2. Parking Meter Sticker Scams

Parking meters and payment kiosks in Prague, Brno, and other cities increasingly display QR codes for quick payment. Scammers place fraudulent QR stickers on or near these machines. The amount looks right, the context makes sense, and drivers pay without suspecting anything.

3. Fake Charity Collection

Scammers create professional-looking charity stands or posters with QR codes for "donations." The charity is fictitious, and the money goes straight to the scammer. This is especially common during holidays and around tourist areas.

4. Modified Invoice QR Codes

Businesses send invoices with QR platba codes by email. If the email is intercepted or if the invoice is viewed on a compromised device, the QR code can be replaced with one pointing to the attacker's account.

5. Shared Space QR Codes

Coworking spaces, laundromats, and other shared facilities using QR codes for payment are vulnerable. Scammers replace the QR code on the machine, and every user pays into the wrong account.

How to Verify a QR platba Code Before Paying

Verification Step	What to Check
Recipient name	Does the account name match the business you are paying?
Account number/IBAN	Does it look legitimate for a Czech business?
Amount	Is it exactly what you expected?
Physical QR code	Is it a sticker placed over another code? Does it look tampered with?
Context	Were you expecting to pay here? Did anyone ask you to scan this specific code?

Most important: Your banking app shows the recipient account name before you confirm. Always read it. If the name does not match the business, do not confirm the payment.

QR Payment Safety Checklist

1. Always check the recipient name in your banking app before confirming any QR platba transaction. If it says a personal name instead of a business name, stop.
2. Look for tampered QR codes. If a QR code looks like a sticker placed over another code, peel it back or ask the business staff.
3. Verify the amount. If the QR code requests a different amount than expected, do not pay.
4. At restaurants, ask the staff to verify the QR code if you are unsure. They should know the correct payment account.
5. For invoices, verify the IBAN independently. If you receive an invoice by email, call the sender and confirm the account number before paying.
6. Be extra cautious in tourist areas. Prague's tourist zones are prime targets for QR code sticker scams.
7. Report suspicious QR codes to the business owner and to Policie ČR.

What to Do If You Paid a Fake QR Code

1. Contact your bank immediately. Request a payment recall. Time is critical — if the money has not been withdrawn from the scammer's account yet, there is a chance of recovery.
2. Report to Policie ČR. File a report with all details: location, time, amount, recipient account number.
3. Take photos of the fake QR code and its location before it is removed.
4. Alert the business owner so they can check for and remove fraudulent QR stickers.
5. Save your banking app transaction record as evidence.

Share Payment Information Safely

When you need to send payment details — your account number, a QR platba code, or an invoice — to a business partner, client, or friend, sending them in plain email or a chat message creates a risk of interception and modification. Use LOCK.PUB to create a password-protected link containing your payment details. Share the link through one channel and the password through another. The information auto-expires, leaving no permanent record for anyone to tamper with.

The Bottom Line

QR platba is a genuinely useful Czech payment innovation, but its simplicity makes it easy to abuse. The one habit that protects you is reading the recipient information in your banking app before confirming every single transaction. If the name does not match the business, do not pay.

For sharing your own payment details securely, use LOCK.PUB — free, encrypted, and self-destructing. Stay vigilant, and always verify before you scan.