What is a QR code payment (static versus dynamic)?
The code is not a payment method. It is an address, and that difference explains most of what goes wrong at the counter.
One asks the customer to type the amount. One does not. Almost everything that goes wrong at a counter comes from that single difference.
The code is a label, not a rail
The image is just an encoded string. Scan it and your app reads a merchant identifier, sometimes an amount, sometimes a reference number. The payment still travels over UPI, or a card rail, or whatever underlying system the code points at. The QR is packaging.
This matters because people say "I paid by QR" the way they would say "I paid by card", and the two statements are not the same kind of claim.
Static: the printed sticker
A static code is printed once and taped to the counter. It contains the merchant's address and nothing else. You scan, you type the amount, you pay.
It costs the merchant almost nothing, which is exactly why it spread through millions of small shops. It also creates the two failure modes everyone has experienced. The customer types the wrong amount. And the merchant cannot automatically tell which payment matches which sale, so reconciliation happens by ear, through the audio confirmation speaker sitting beside the till.
That speaker is not a gimmick. It is the reconciliation system.
Dynamic: generated per sale
A dynamic code is produced by the billing system for one transaction. It carries the amount and a unique reference. The customer scans and confirms, with nothing to type.
Wrong amounts become impossible. Reconciliation becomes automatic, because every payment carries the reference of the sale that created it. The trade is that the merchant now needs a system capable of generating codes, which means a real point-of-sale setup rather than a printed sticker.
The security question people ask
QR fraud is rarely about the code being clever. It is about a sticker being covered with a different sticker, or a code being sent to you by someone claiming you need to scan it to receive money.
The rule that survives every variation: scanning a code and approving a payment sends money out of your account. No legitimate code has ever pulled money in. If someone owes you money and sends you a code to scan, they are not paying you.
A static code is a house number painted on a wall. A dynamic code is a pre-addressed envelope with the amount already written on it. Both get you to the same house. Only one removes the chance of writing the wrong thing.
Where you meet it
Every counter, every street stall, and every time you have squinted at a code wondering whether to type the amount or wait for it to appear.