What a payment QR code carries

Money

A QR code is a container. What it carries is a short run of text, and the text is the only part of it a person can read.

The shape

The shape described here is the payload, meaning the text a scanner hands back. A payment payload is a URI, and its parts run in a fixed order.

Field order: scheme, colon, address, then optional parameters
Scheme: lower case letters with no spaces, ending at the first colon
Address: the address exactly as it would appear on its own, in its own alphabet
Parameter start: a single ?, appearing at most once
Pair separator: an & between pairs, never a comma or a semicolon
Pairs: shaped name=value, with reserved characters percent encoded

scheme:address?name=value&name=value

bitcoin:1EXAMPLEEXAMPLEEXAMPLExxxxxxxxxxxx?label=example

A skeleton above, a placeholder below. The address inside the second line is the same fake used on the older Bitcoin address card. Percent encoding inside parameter values is described at percent encoding inside a link.

The container and the payload

The pattern of squares has no shape a person can inspect. Two codes carrying entirely different addresses look equally like noise. There is no way to see, from the picture, which chain it names, whether it carries parameters, whether it was generated the same day as the page around it, or whether it was regenerated afterwards while the words beside it stayed as they were. Everything a reader can check happens after a scanner has turned the pattern back into text.

That leads to the fact worth carrying away from this card. The printed line under a code and the code itself are two separate artifacts. They are produced by separate steps, usually at separate times, and nothing binds them together. A page can show one address in print and carry another in the pattern, and the page will look entirely ordinary. Reading the printed line is not reading the code.

The same reasoning applies to the scanning tool. A scanner that acts on a payload immediately, without showing you the decoded text, has removed the only inspection point in the whole process. The shape work on this card is only possible on a scanner that shows you what it read.

How to check it by eye

Reading the payload rather than the picture

Make the decoded text visible before anything else happens. If the tool will not display it, there is nothing on this card you can do.
Read the scheme, which is everything up to the first colon. It should name the system you expect, and it should be followed by the colon immediately with no space.
Read the address that follows and check its own shape against the relevant card, starting with the first character and the total width.
Compare the decoded address with the printed one along their whole length, not only at the two ends. Ends match far more often than middles do.
Read the parameters through to the end. A name you do not recognise deserves reading in full rather than skipping.

What a wrong shape means

A payload with no colon in it is not a payment URI. It may be a bare address, which is a legitimate thing for a code to carry, or it may be arbitrary text. Either way it has no scheme, so nothing in it says what system it is for.

A payload that turns out to be a web link rather than a scheme and address is a link, and it should be read as one. The relevant shape then is a link with a token inside it, not this card.

A decoded address that differs from the printed address is the finding this card exists for. The ordinary cause is a page rebuilt in stages, where one artifact was refreshed and the other was not. It is not by itself proof that anyone acted against you, and treating it as such is a mistake in the other direction. What it does mean, in every case, is that the two cannot both be relied on and neither should be used until the disagreement is explained.

A scanner that will not decode the pattern at all usually means damage: a crop, glare on a screen, a low resolution copy of a copy, or a code reprinted small.

What a correct shape does not prove

Suppose the payload decodes cleanly, the scheme is the expected one, the address passes its own card and the parameters parse. The following are all still open.

That the code and the caption beside it agree, unless you compared them yourself in full.
That the address belongs to the party the surrounding page names. A container carries whatever it was given.
That the parameters mean what their names suggest. A name in a pair is free text chosen by whoever built the payload.
That the code you scanned today is the code that was there yesterday. Images are swapped more quietly than text is.
That the pattern is undamaged in a way that matters. A code either decodes or it does not, and a code that decodes to the wrong text decodes just as confidently as one that does not.

What this card is not

The shapes of the addresses that appear inside a payload are on their own cards, from the bc1 form to a Monero address. Percent encoding gets a fuller treatment at percent encoding inside a link. Nothing here describes how any scanner works, how a code is generated, or how much data a pattern can hold; those are properties of the container rather than shapes of the text.