Check a Bitcoin QR code for address substitution before sending

A QR code is an input method, not proof of the intended recipient

Scanning can reduce typing mistakes, but it can also import an address or amount from an untrusted screen, altered clipboard or replaced image. The wallet's decoded transaction is the object that must match the fresh authenticated receiving instruction. This is a verification and record-keeping method, not a prediction, payment instruction, legal opinion or promise of an account outcome.

Bitcoin.org advises wallet users to secure devices, use backups and take care with online services. It does not certify a particular QR code or receiving service. People paying with Bitcoin need a final comparison that does not confuse convenient scanning with recipient authentication.

Retrieve a fresh receiving instruction

Deposit addresses and invoice conditions can change, expire or depend on an authenticated account context. Read in context, an old screenshot may be correctly copied but no longer applicable. This is a decision checkpoint, not an invitation to fill missing fields with assumptions.

Open the signed-in receiving page from a known origin and record its issue time. A reproducible handoff names account reference, asset, network, address, invoice ID, expiry and warnings. If that set is incomplete, follow the stop instruction: Do not reuse an address solely because it worked before.

Decode the QR content before approval

A Bitcoin payment URI can contain an address, amount, label or message, and a QR image can encode unexpected data. Read in context, the visible picture does not reveal every decoded field. This is a decision checkpoint, not an invitation to fill missing fields with assumptions.

Read the wallet's decoded destination and amount without signing. A reproducible handoff names raw scheme, destination, amount, label, message and wallet warning. If that set is incomplete, follow the stop instruction: Cancel when the wallet cannot display the decoded request.

Compare the complete destination

Shortened address previews and matching first or last characters cannot exclude substitution in the hidden middle. Read in context, visual familiarity is weaker than a complete character comparison or trusted device confirmation. This is a decision checkpoint, not an invitation to fill missing fields with assumptions.

Compare the full address using the wallet and authenticated instruction. A reproducible handoff names invoice address, wallet address, comparison method, mismatch result and reviewer. If that set is incomplete, follow the stop instruction: Do not accept a destination supplied by chat.

Confirm amount and fee as separate values

The recipient amount and miner fee reduce funds in different ways and may be displayed in BTC or a fiat estimate. Read in context, a correct total requires both units and the current wallet summary. This is a decision checkpoint, not an invitation to fill missing fields with assumptions.

Write the exact BTC output and fee, then check the combined spend against the limit. A reproducible handoff names recipient amount, fee rate, absolute fee, fiat estimate time and total debit. If that set is incomplete, follow the stop instruction: Do not raise the spend limit to meet a countdown.

Use device and clipboard hygiene

Clipboard malware, overlays and compromised devices can alter payment data after it is copied. Read in context, repeating the same action on the same compromised environment is not independent verification. This is a decision checkpoint, not an invitation to fill missing fields with assumptions.

Update the device, inspect destination again after paste and use a trusted second display when available. A reproducible handoff names device, wallet version, update state, clipboard use, second-display check and result. If that set is incomplete, follow the stop instruction: Stop if the destination changes between views.

Reconcile broadcast, confirmation and credit

A transaction can be broadcast and confirmed without being credited by the receiving service if the route or amount was unsupported. Read in context, network success and account credit are separate evidence layers. This is a decision checkpoint, not an invitation to fill missing fields with assumptions.

Keep one timeline for the transaction hash, confirmations and account status. A reproducible handoff names hash, output address, amount, fee, block status, invoice state and account credit. If that set is incomplete, follow the stop instruction: Do not send a duplicate payment to fix a delayed credit.

What the named source establishes and leaves unresolved

Bitcoin.org's security guidance supports protecting the wallet environment, maintaining backups and treating online services cautiously. The article applies those principles to the last-mile QR and destination comparison.

Bitcoin.org cannot authenticate a SignalBet address, set a minimum deposit, guarantee confirmation time or recover a misdirected payment. Current authenticated instructions remain essential.

Close the record with a bounded decision

The pre-send record contains fresh invoice details, decoded QR fields, full-address comparison, amount and fee, device checks and post-send reconciliation. It never includes a seed phrase or private key.

SignalBet is 18+ only where lawful. Bitcoin finality does not make gambling safe; use only disposable funds, set a fixed limit and stop instead of repeating a delayed payment or chasing a loss.

Use the responsible-play centre, the editorial policy and the guide library for related safeguards.

Retrieve a fresh receiving instruction: Follow-up review

An old screenshot may be correctly copied but no longer applicable. On review, preserve the earlier row and append account reference, asset, network, address, invoice ID, expiry and warnings with a fresh timestamp. Open the signed-in receiving page from a known origin and record its issue time. The standing limit remains: Do not reuse an address solely because it worked before. The follow-up stores no password, one-time code, recovery code, seed phrase or private key and never treats an unresolved field as permission to continue.

Decode the QR content before approval: Follow-up review

The visible picture does not reveal every decoded field. On review, preserve the earlier row and append raw scheme, destination, amount, label, message and wallet warning with a fresh timestamp. Read the wallet's decoded destination and amount without signing. The standing limit remains: Cancel when the wallet cannot display the decoded request. The follow-up stores no password, one-time code, recovery code, seed phrase or private key and never treats an unresolved field as permission to continue.

Compare the complete destination: Follow-up review

Visual familiarity is weaker than a complete character comparison or trusted device confirmation. On review, preserve the earlier row and append invoice address, wallet address, comparison method, mismatch result and reviewer with a fresh timestamp. Compare the full address using the wallet and authenticated instruction. The standing limit remains: Do not accept a destination supplied by chat. The follow-up stores no password, one-time code, recovery code, seed phrase or private key and never treats an unresolved field as permission to continue.