We Can’t Keep Fighting Today’s Scams Using Yesterday’s Reporting Processes

Scammers are constantly adapting to new technologies, and one area that deserves far more attention is the growing use of QR payments in financial scams. QR codes have become an incredibly convenient way to make payments. With a simple scan, a customer can complete a transaction within seconds, without manually entering account numbers or other payment details. But the same convenience that makes QR payments attractive to legitimate users can also be exploited by criminals. What concerns me is not simply that scammers are using QR payments, but that our fraud-prevention and reporting systems may still be structured around an older model of financial crime. Traditionally, when someone becomes a victim of a scam, one of the first pieces of information they may be asked to provide is the bank account number to which the money was transferred. That information can help banks, law enforcement and investigators identify the recipient and begin tracing the transaction. But what happens when the victim simply scans a QR code? The victim may have no idea what account sits behind that QR code, who controls it, or where the money ultimately goes. They may only have a payment confirmation, transaction reference or digital receipt. For the victim, this can make an already stressful situation even more confusing. For investigators, it can mean additional steps before they can identify and connect the relevant information. And for the scammer, those additional steps create something incredibly valuable: time.

Time is one of the most important advantages a fraudster can have. The moment a victim realizes they have been scammed, the clock starts. Every minute that passes can provide an opportunity for the criminal to move money, transfer funds between accounts, use other payment channels, contact another victim, or simply disappear. This is why fraud prevention cannot only be about identifying suspicious activity. It must also be about the speed at which that activity can be reported, investigated and acted upon. We often tell people to contact their bank immediately when they believe they have been scammed. That is absolutely the right advice. But the effectiveness of that advice depends on what happens after the customer makes that call or submits that report. If the reporting process requires information the victim does not have, if different departments need to manually collect information, or if investigators have to spend significant time reconstructing a transaction that could have been automatically identified, then valuable time is being lost. And the criminal benefits from that delay.

QR payments themselves are not the problem. They are an important part of the modern financial ecosystem and provide significant benefits to customers and businesses. The issue is that criminals study the same technologies that legitimate users adopt. Whenever a new payment method becomes popular, criminals will look for ways to manipulate it. They may place fraudulent QR codes on invoices, advertisements, websites, messages, social media posts or even physical locations. They may impersonate businesses, government agencies, banks, delivery companies or individuals and convince victims that they need to make an urgent payment. The technology does not need to be inherently insecure for it to become part of a scam. Criminals often exploit the human trust surrounding the technology. A victim sees a familiar logo, receives an urgent message, scans a QR code and completes the payment. Only afterward do they realize something was wrong.

This is where our thinking about fraud prevention needs to change. Instead of asking whether criminals can use QR payments for scams, we should be asking whether our systems are capable of identifying and responding to QR-based fraud quickly enough. If criminals have already recognized that QR payments can create another layer between themselves and their victims, shouldn’t our financial institutions have recognized the same possibility? If a victim reports a QR transaction, the bank already has access to information that the customer may not see. The customer may only see a transaction amount and reference number, while the financial institution may be able to identify the payment destination, associated account or wallet, merchant or payment identifier, timestamp and other transaction information. The question is whether these details are being brought together quickly enough when a fraud report is made.

Imagine a customer realizes that they have been deceived into making a QR payment. Instead of having to explain everything manually or search for information they may not understand, they could immediately select a dedicated “Report Fraudulent QR Payment” option within their banking application. The system could automatically attach the transaction details, flag the payment for review, and send the relevant information to the bank’s fraud team. If the same recipient, payment identifier or destination has already been associated with other complaints, the system could potentially identify that connection. The customer could immediately receive clear instructions about what to do next, while the financial institution begins the investigation. The objective would not be to guarantee that every fraudulent payment can be reversed, because that depends on many circumstances, but to make sure that the response begins as quickly as possible. The faster the system reacts, the less time the criminal has.

This is also where data analytics and artificial intelligence could become increasingly important in fraud prevention. A single transaction may look completely ordinary when viewed in isolation. But hundreds of transactions connected to the same destination, payment identifier, device, merchant profile or behavioural pattern may tell a very different story. One victim may appear to be an isolated incident. Multiple victims reporting similar activity can reveal a pattern. Fraud prevention therefore needs to move beyond looking at individual transactions and start looking more aggressively at relationships and patterns across transactions. Criminals often operate networks, not isolated incidents. If our systems can connect information across reports quickly, we may be able to identify emerging fraud patterns before they grow into much larger campaigns.

There is another important issue here: the difference between fraud prevention and fraud reaction. Traditional approaches often become active only after a victim reports a crime. By that point, the damage may already have occurred. A more proactive approach would continuously monitor emerging payment methods and ask how each one could potentially be abused. Before a new technology becomes a major target for criminals, financial institutions should be conducting threat modelling, testing reporting procedures and identifying the information that investigators will need if something goes wrong. In other words, we should not wait for criminals to demonstrate every weakness before we start thinking about it.

This is a fundamental principle of crime prevention: understand how the offender thinks. Criminals look for opportunities, weaknesses, confusion and delays. They look for situations where victims do not know what to do and organizations take too long to respond. They look for ways to make investigations more complicated. They look for opportunities to move quickly while everyone else is still trying to understand what happened. If we want to prevent modern financial crime, we have to think from the perspective of the criminal. Where can they create distance between themselves and the victim? Where can they hide? Where can they create uncertainty? Where can they gain time? And, most importantly, how can our systems remove those advantages?

The financial industry has invested heavily in improving payment speed and convenience. Transactions that once took hours or days can now happen almost instantly. Customers expect payments to be fast, simple and available around the clock. But there is an uncomfortable question we need to ask: Have our fraud-response systems become as fast as our payment systems? If money can move in seconds, but reporting a fraudulent transaction takes hours, we have created an imbalance that criminals can exploit. We cannot build instant payment systems and then rely on slow, manual fraud-reporting processes to protect them.

The same principle applies to customer education. We constantly tell people to be careful, verify payments, avoid suspicious links and report scams immediately. These messages are important, but we cannot place the entire responsibility on the customer. A customer can do everything correctly and still become a victim of a sophisticated social-engineering attack. Once that happens, the financial institution has a responsibility to make the reporting and response process as efficient as possible. Telling people to “report it immediately” means very little if the system they report through is not designed for immediate action.

The challenge becomes even greater as criminals combine technologies. QR payments can be combined with phishing, fake websites, social media impersonation, fraudulent invoices, fake customer-service accounts, deepfake communications and other social-engineering techniques. The scam may begin on one platform, move to another and ultimately result in a payment through a completely different channel. This means fraud detection can no longer operate in isolated silos. The modern scam crosses platforms, technologies and organizations. Our response needs to be capable of doing the same.

There is also a lesson here for law enforcement and policymakers. Reporting mechanisms should evolve alongside payment technologies. If a new payment method becomes widely adopted, investigators need access to the information necessary to understand how that payment works and how evidence can be obtained when it is abused. Victims should not be expected to understand the technical structure behind a transaction. A person who has just lost money to a scam should not have to become an investigator themselves. The system should make it easier for them to report what happened and provide the information that financial institutions and authorities need.

Ultimately, this is not just a banking problem. It is a crime-prevention problem. It is a technology problem. It is a customer-protection problem. And it is a question of whether our institutions are willing to adapt as quickly as criminals do. Technology will continue to evolve. Payment methods will continue to change. Criminals will continue to study those changes and search for opportunities. If our systems only adapt after a new scam becomes widespread, we will always be reacting from behind.

We need to move toward fraud-prevention systems that anticipate criminal behaviour rather than simply respond to it. We need reporting mechanisms that capture the information investigators actually need. We need stronger connections between banks, payment providers, law enforcement and fraud-intelligence teams. We need better use of data to identify patterns across seemingly unrelated transactions. And above all, we need to recognize that time is a security control. Every minute saved in reporting, identifying and escalating a fraudulent transaction can potentially reduce the criminal’s opportunity to cause further harm.

The question is no longer whether criminals will exploit new payment technologies. They will. The real question is whether our institutions will identify those opportunities before the criminals do, or at least respond quickly enough when they do. QR payments are only one example of a much larger challenge facing the financial ecosystem. Tomorrow’s scam may involve a different technology, a different payment method or an entirely different form of digital interaction. The lesson remains the same: we cannot keep fighting today’s scams using yesterday’s reporting processes.

Criminals adapt. Technology evolves. Payment systems change. Fraud techniques become more sophisticated. Our prevention systems must evolve faster.

Because when a victim reports a scam, the criminal may already be moving.

And in the fight against fraud, every second matters.