A QR code on an invoice, a counter and a badge: where it actually goes

A QR code is convenient for the same reason it is dangerous. The domain is not readable. An employee points a camera at a code from an "invoice payment" letter, or at a sticker placed over your code on the counter. A page opens that looks like the bank, mail or your own form. Then comes either a payment or a password.

Banning codes in a company is hard: menus, passes and business cards print them. A rule for money and sign-ins is enough. A code from a letter does not confirm a change of bank details. A sticker you did not place gets removed, and the person responsible for the office is told. A payment link on your site goes to a known address, not to a file that is "easier for accounting".

Where this meets the site

• The payment page should not live as a separate PDF that is easy to swap on the host.
• A lead form does not ask for a password "for verification". A password on a public form is already a bad sign.
• The short address on a card points at your domain, not through a shortener you do not control.
• If the code opens an account area, that area has a normal sign-in, not only a secret link.

Lexora checks these entries in a site audit: where buttons, files and forms go, and whether a page asks for too much. If a code already led to a transfer or a mail sign-in, that is an incident, and the letter is kept first, rather than "reissuing everything". A pentest belongs here when an account opened from the code shows other people's data.