Is it secure to use a QR code for banking or tax documents?

A QR code can provide convenient access to a financial portal, but it does not make the destination safe. Use an authenticated first-party domain, protect sensitive documents behind access controls, monitor for tampering, and give customers a separate way to verify the institution before entering credentials or payment details.

Does generating the code expose my portal URL to your servers?

Client-side generation can reduce exposure of the encoded URL, but the site must be checked for analytics, logging, third-party scripts, and other network requests before making that promise. Never place secrets or reusable access tokens in a visible symbol; use an authenticated portal and documented privacy controls.

Can I encode a cryptocurrency address?

Yes. The Bitcoin type builds payment links for a receiving address, with an optional amount, for the coins listed in the generator. The generator cannot verify the address, so check it in your wallet before printing, and remember that crypto payments cannot be recalled.

How should customers verify a financial QR code?

Show the institution name and expected first-party domain beside the symbol, and repeat them on the landing page before requesting information. Customers should preview unfamiliar destinations and stop after unexpected redirects. Payment or identity flows should use authenticated systems, monitoring, and established fraud-response channels.

What should never go inside a financial QR code?

Account numbers, balances, statements, client identifiers, document links and session tokens. Anyone who photographs a mailer can decode the symbol, so the code should hold only a front-door address, with identity and access controls applied by the portal after the scan.

Which rules apply to a firm's QR codes?

It depends on the firm, country and activity. Examples to ask compliance about include FINRA Rule 2210 and recordkeeping rules, UK FCA rules, the GLBA Safeguards Rule, GDPR and PCI DSS. A QR code does not satisfy any of them by itself.

How do I take card payments through a QR code?

Link to a hosted checkout from a PCI DSS compliant provider so your firm does not handle card data, and print the provider domain or your own beside the code. Keep payment links separate from login links, and see the guide on accepting QR code payments.

What does QR code fraud look like for financial firms?

Common patterns include fake stickers over legitimate codes, look-alike domains and spoofed login pages. UK Action Fraud logged 784 QR phishing reports from April 2024 to April 2025, per press coverage. Print your domain, add a never-ask warning and inspect public signs.

QR Codes for Financial Services: Safe Client Access

Advisers, accountants and financial firms can put a QR code on statements, tax mailers, business cards and lobby signs to open a portal sign-in, a booking page, a hosted payment page or a contact card, provided clients can confirm who is behind the code before they act. That means first-party domains, tamper-resistant placement, a printed domain and a phone number that does not depend on the code.

This guide covers what a code in this sector should and should not link to, how to design a mailer that helps clients verify it, what the public warnings about QR fraud say, which rule families to check with your compliance function, how to handle a cryptocurrency address, and a rollout checklist. It is general information, not financial, legal or compliance advice, and a QR code does not secure a portal or satisfy any regulatory obligation on its own.

What can a financial-services QR code link to?

Put an address in the code and keep secrets out of it. Anyone who photographs a mailer can decode the symbol, so account numbers, balances, document links and session tokens never belong in it.

Table of five destinations (portal sign-in, booking, hosted payment, contact card, crypto address) with what the code holds and the main caution for each. — Original diagram: five common destinations, what the code should hold and the main caution for each.

Portal sign-in: the front door of your document or account portal, on your own domain, over HTTPS. Do not encode a client identifier, a document link or a token.
Booking: your scheduling page for an introductory or review call; a Calendly QR code works if you already use that service.
Payment: a hosted checkout from a provider that is PCI DSS compliant, so your firm does not handle card data. See how to accept QR code payments.
Contact card: a vCard QR code with your direct line and office details, handy on business cards.

The generator creates codes in your browser, which can reduce exposure of the encoded URL, but that is a property of the tool, so check any generator you use for analytics, logging and third-party requests before making privacy promises to clients.

How should a client verify a financial QR code?

Financial services are a prime phishing target. The FBI's Internet Crime Complaint Center warned in January 2022 that criminals tamper with QR codes, including codes that redirect payments. The FTC has issued consumer warnings about QR codes on unexpected packages and in unexpected messages, which can lead to spoofed login pages or malware downloads, according to news coverage of those alerts. UK reports give a sense of scale: Action Fraud logged 784 reports of QR-code phishing between April 2024 and April 2025, with losses of about £3.5 million, according to press coverage of the figures. Vendor statistics on growth rates vary widely and are not comparable, so this guide does not repeat them.

Design your materials so a client can check a code in a few seconds.

A client mailer with a firm name, a message, a schematic QR square, the expected domain, a phone number and a never-ask warning, with callouts. — Original diagram: anatomy of a client mailer. The firm, domain and phone number are invented.

Print the firm name and the exact expected domain beside the code, and repeat both on the landing page.
Tell clients, in plain language, that the firm will never ask them to log in, pay or "verify" through a link in an unexpected message, and that their phone's preview should show your domain before they tap.
Give a phone number and let clients type the portal address directly. The code is a convenience, not the only route.
Inspect lobby and reception codes regularly for overlays, and use integrated or tamper-evident signage.

Flow showing scan, read the address preview, compare it to the printed domain, then continue on a match or stop and call a known number if it does not match. — Original diagram: three checks before the client taps, and what to do if the address does not match.

The quishing guide, the can QR codes be hacked? explainer and the QR safety check are good links to give clients.

Which rule families should your compliance team check?

Rules depend on the type of firm, the country and the activity, so this list is a starting map, not a checklist of what applies to you.

Four layers of a client-facing QR workflow: what the page says, what sits behind the sign-in, how money moves, and fraud and incident handling, with the rule family for each. — Original diagram: four layers of a QR workflow and the kind of rule that touches each.

Layer	Rule family (examples)	What to ask
Page content and records	FINRA Rule 2210 on communications with the public; broker-dealer and adviser recordkeeping rules; UK FCA financial-promotion and record-keeping rules	Is the linked page reviewed like other client communications, and are the messages it generates kept?
Client data	GLBA and the FTC Safeguards Rule in the US; GDPR in the UK and EU	Does the portal, not the code, provide access control, encryption and audit logging?
Payments	PCI DSS	Does a hosted checkout keep card entry with the provider?
Fraud and incidents	Regulator and breach-notice duties, FBI and FTC reporting channels	Who removes a tampered sign and tells clients?

Tax preparers and many accountants are treated as financial institutions under the Gramm-Leach-Bliley Act, according to tax-industry guidance, which brings the FTC Safeguards Rule (16 CFR Part 314) into play: a written information security plan, a designated qualified individual, risk assessment, access controls and multi-factor authentication, among other items. Secondary sources disagree on some details of the 2022 and 2023 changes, so read the rule text and the IRS's security guidance for tax professionals rather than relying on a summary. FINRA's annual oversight report treats books and records, including off-channel communications, as a recurring exam topic, which is a reminder that a QR code can create a new channel your supervision program has to cover.

Also run the practical questions past compliance before printing: who owns the domain, how it renews, what happens if the portal provider changes, and how a client reaches a person if the site is down.

Can you encode a cryptocurrency address?

Yes. The Bitcoin QR code generator builds a payment link for a receiving address with an optional amount, and works offline in your browser for the supported coins. The generator cannot verify the address, so check it in your wallet before printing. Show the full address in text beside the code so the payer can confirm it, and remember that a transaction to a wrong or tampered address is generally irreversible. This is a technical capability, not a recommendation, and digital-asset activity carries its own regulatory and risk considerations that your compliance team should assess before you publish an address to clients.

How should you print and place the code?

Business cards: a code of about 1 inch (25 mm) square, black on white, with the quiet zone clear.
Statements and mailers: 1 to 1.5 inches (25 to 38 mm) with the domain printed beneath.
Lobby signage: size it for the scanning distance, on rigid, tamper-evident mounting.
You may tint a code in your firm's colors if contrast stays strong and you test the printed result. Export SVG for print and check the proof with the scannability tester.

The print size guide explains how distance and size relate. A static code never expires and suits a stable portal address; use a dynamic code only if you need to change the destination without reprinting, and then treat the redirect service as a vendor in your risk review.

What goes wrong when the portal moves?

Think of a small advisory firm that prints 3,000 quarterly statements with a code pointing at its old portal vendor’s address. A year later the firm changes vendors and lets the old domain lapse. Nobody notices that the stack of printed statements in clients’ drawers still carries the old address, and anyone who registers the lapsed domain can put a convincing sign-in page behind every one of those codes.

The repair is to print codes only for addresses on a domain the firm owns and renews, keep a redirect from retired paths for as long as printed material is in circulation, print the expected domain and a phone number beside the code, and add domain renewals and vendor changes to the compliance calendar. Lobby signs belong on a separate monthly inspection, because an overlay sticker looks identical to the real code.

How do you launch a client-facing code?

List each destination (sign-in, booking, payment, contact, crypto) and decide whether it needs a code at all.
Confirm that no client ID, balance, document link or token will appear in any code or URL.
Send the destination pages and wording through compliance review, including recordkeeping for any messages they generate.
Check that the portal provides authentication, access control, encryption and audit logging.
Choose a hosted, PCI DSS compliant checkout for payments.
Print the firm name, expected domain, phone number and a plain-language warning beside every code.
Test the printed proof on two phones, including an older one.
Schedule sign inspections and write down who removes a tampered item and who informs clients.
Set a review date for domains, certificates and vendor contracts.

Which regulatory questions need your compliance team?

Several answers depend on facts the guide cannot see: whether your firm is registered with the SEC, FINRA, the FCA or a state regulator, whether your tax practice is a financial institution under GLBA, how your supervision program treats a QR-linked page, and whether your jurisdiction restricts how you promote or accept digital assets. No source reviewed for this article addressed QR codes under the SEC Marketing Rule specifically, so ask counsel how that rule applies to an adviser's print materials.

This page is general information, not financial, legal or compliance advice. Confirm what your regulator and software provider require before deploying a client-facing QR workflow.