Static vs Dynamic QR Codes: What Changes for the Payer

Published: 19 October 2026

Category: how-to-guides | cardbuzz

Two QR stickers can look identical and behave very differently. A static QR encodes the same payment instructions every time; a dynamic QR generates fresh instructions per transaction, usually with the amount baked in. As the payer, the difference changes what you must verify — and what can go wrong.

What each type actually encodes

A static QR is printed once and reused indefinitely. It typically encodes only the merchant's identifier — a UPI ID or a merchant reference — and nothing about the amount. You scan, you type the amount yourself, you pay. The kirana store's laminated sticker on the counter is the classic example.

A dynamic QR is generated per transaction, on a screen or a fresh printout. It encodes the merchant's identifier plus the exact amount, and often a transaction reference or an expiry. You scan, the amount is pre-filled, you verify and pay. Restaurant billing systems, e-commerce checkout pages, and modern billing counters use these.

The security difference that matters

Static QRs have one structural weakness: they never change, so anyone can photograph, copy, or replace them. The well-known fraud is sticker pasting — a fraudster overlays their own QR on a merchant's sticker, and every payer who scans it sends money to the fraudster. Because the sticker is permanent, the tampering can sit unnoticed for days.

Dynamic QRs resist this by construction. Each code is tied to one transaction, amount, and usually a short validity window. A pasted-over dynamic QR would have to be replaced in real time, per customer, which is dramatically harder to pull off at scale. The pre-filled amount is a second line of defence: if the code were tampered with, the amount or payee name on your review screen would look wrong.

But dynamic QRs are not magic. A compromised billing screen can still display a fraudulent dynamic QR, and a payer who taps through without reading the review screen gets no protection from the technology. The security advantage of dynamic QRs is real, but it only activates if you actually verify.

One more dynamic-QR property worth knowing: expiry. Because each code is generated per transaction, many systems give it a short validity window — often just a few minutes. If you scan a dynamic QR, get distracted, and authenticate ten minutes later, the payment may fail or, worse, you may be looking at a stale screen while the billing counter has moved on. Scan dynamic QRs when you are ready to pay immediately, not speculatively.

What you must verify for each type

Scanning a static QR: you are the amount-entry mechanism, so you are also the error mechanism. Type the amount carefully, digit by digit, and confirm the payee name on the review screen matches the merchant in front of you. Never let a stranger "help" by entering the amount on your phone.

Scanning a dynamic QR: the amount is pre-filled, so your job shifts to verification. Check that the pre-filled amount matches your bill exactly — to the rupee. Check the payee name. If anything differs, stop; do not edit the amount and proceed, because a mismatch means either a billing error or tampering, and both deserve a conversation with the merchant before money moves.

Which one should you prefer?

When you have the choice — a printed sticker versus the merchant's billing screen — prefer the dynamic QR for larger amounts. The pre-filled amount removes your biggest error surface (mistyped digits), and the per-transaction code is harder to tamper with. For small everyday payments at trusted shops, static QRs are perfectly fine provided you verify the payee name and amount every single time.

The habit that covers both: never authenticate a QR payment without reading the review screen. The ten seconds it takes is the entire security model.

Key takeaways

  • Static QRs encode only the merchant's identity; you enter the amount. Dynamic QRs encode identity plus a pre-filled amount per transaction.
  • Static QRs can be copied or pasted over; dynamic QRs are per-transaction and harder to tamper with.
  • With static QRs, verify your typed amount digit by digit; with dynamic QRs, verify the pre-filled amount matches your bill exactly.
  • For large payments, prefer dynamic QRs — and always read the review screen before authenticating.