VARNIUMAI risk defense / everyday bearings

SCAM / QR & PAYMENT LINKS

Before You Scan That Code, Read the Destination.

A QR code hides its destination until you scan it, and a payment link can say one thing while pointing at another. The check is not the code — it is the address behind it, read before you commit.

Start here

The free tool below runs entirely in this browser — no account, nothing stored or transmitted. Redact anything you would not want kept before you type it.

Open the companion tool →

Why the code hides the decision

A QR code is just a printed URL, and you cannot see the URL until after you scan. Scammers replace legitimate codes — on menus, flyers, parking meters — with ones that point at lookalike domains that collect your payment and your card.

The defense is to read the destination before you commit: open the camera preview, inspect the address it shows, and if you are paying a known business, pay through their official app or website instead of the code.

The protocol

  1. Enter or paste the destination the code or link points to, or type what it claims to be.
  2. Read the domain reading: does the actual address match the claimed sender, or is it a lookalike?
  3. If anything mismatches, do not scan or tap. Pay the known business through its official app or site.
  4. If you already paid through a suspicious code, contact your card issuer and report at ReportFraud.ftc.gov.

What the tool does

Enter a QR destination or payment link and get a domain-level reading with the mismatch basis shown, plus the no-scan way to pay. It runs in this browser; nothing is sent or stored.

Limit first: This is a destination aid, not a fraud investigation service. It can miss a lookalike domain and it can flag an ordinary link. A clean reading never proves a link is safe.

Open the companion tool →

One human next step

If you already paid, contact your card issuer or payment app, then report the code to the business and file with the FTC at ReportFraud.ftc.gov.

Research log and safety checks

AI-assist path: not used for a verdict. This artifact is an inspectable destination reading; a remote model would add an opaque classification where the reader needs to see the mismatch itself. §6.10: not a frontier-pace topic.

§0.5 protection result: category is scam-fraud-defense; crisis-adjacent: no; fear/urgency/scarcity toolkit used: no. The protective function is free and the paid feature is convenience only.

Related dispatches

Pairs with the same protection bar: a free complete reading, an optional convenience unlock, and no fear-framing.