by Serguey Shinder
In 2023 we put a small printed card on every trade counter in our branches, with a QR code and the words Pay your account here. Scanning it took a customer to our account payments page, where they could settle an invoice by card while their goods were being picked. Smaller builders liked it, and by the end of 2024 it handled about eleven hundred payments a month.
In May 2025 a customer of one of our Midlands branches rang the credit team to ask why his payment of two thousand three hundred pounds was not showing. We had no record of it. When the branch manager looked at the card on the counter, there was a second code printed on a clear sticker and placed exactly over ours. It led to a copy of our payments page, logo and all, on a web address one letter different from our own, which collected card details and amounts.
The same sticker was on cards in two other branches. Over about three weeks, fourteen customers had paid a little under ten thousand pounds to somebody who was not us. We refunded every one of them.
What I had to accept was that we had built the opening ourselves. A QR code is a web address that nobody can read. A customer scanning one has no way to check where it goes before it opens, and on a phone the address bar is small enough that few people look at it afterwards. What they were really trusting was the counter: our branch, our staff, our card in a plastic stand. We had attached a payment page to that trust with something any stranger could cover with a sticker costing a few pence, while queueing for sand.
We had thought about the security of the payment page in detail. Encryption, the provider's fraud checks, the certificate. Nobody had thought about the piece of card, because it did not look like part of the system. It was the part the attacker chose, because it was the only part with no lock on it.
The codes came off every counter that week. Account payments are now made only after logging in to the customer's online account, or on the card terminal at the counter, which staff hand over themselves. Anything we print that a customer might scan or type now carries a short address that is easy to read and check, and we registered the obvious misspellings of our name. Opening checks in every branch include looking at anything on the counter a customer might act on. And our statements say, in plain words, that we will never ask for payment through a code on a sign.
A printed code feels like a fixture. To the person scanning it, it is a link from a stranger, and anybody with a sticker can become the stranger.
– Serguey Asael Shinder
Leave a Reply