At a Saturday market, the woman selling sourdough has a card reader she reaches for maybe four times a day and a printed square in an acrylic stand that gets used forty. People point a phone at it, tap twice, and hand over a loaf. The square cost her almost nothing and it moves more of her money than the reader does.
That setup is everywhere now, and it carries a set of risks nobody hands you a leaflet about.
What a payment app code actually is
The shape is the same across the peer-to-peer apps. You hold an account tied to a phone number or a handle. The app produces a code that encodes a link to that account. Someone scans it, their app opens a payment screen already addressed to you, they type an amount and confirm.
Zelle, Cash App and the other consumer payment apps each do this a little differently, but the mechanism does not vary much. The code moves no money and holds no money. It is an address, printed.
Which means the interesting questions here are not technical ones. They are about trust, tampering, and what happens when a sale goes wrong.
Do not take the rules from an article
Fees. Sending and receiving limits. Which account types may accept payment for goods. What counts as a business account. Which countries and banks are supported. Whether a code can be reused or expires.
All of that differs between apps, differs between account types inside a single app, and changes over time. Anything you read on a third-party page about those specifics, this page included, may already be stale. Open the app, find its own help section, and read the current terms for the account type you actually hold. If you are taking business payments, that reading is not optional; some account types are not intended for commercial use, and discovering that after a hold lands on your balance is an expensive way to learn it.
Everything below is the part that does not change when a fee schedule does.
Print your name beside the square
A customer at your table is about to send money to a screen showing a name they have never seen before. Maybe it is your legal name. Maybe it is a handle you picked in college.
Put the identifying details on the sign itself, printed, right next to the code:
- The exact name or handle that will appear on their confirmation screen.
- Your business name, so a stranger can match the two.
- The last digits of the phone number on the account, if the app displays them.
Now the customer has something to check against. When the screen matches the sign, they pay without asking. When it does not, they ask, and that question is the entire security model working the way it should.
Train whoever works the table to expect that question and to welcome it. A vendor who says "yes, check that the name matches" reads as safe. A vendor who bristles does not.
The sticker over your sticker
Here is the attack, and it is common enough to plan for. Someone walks past your sign and presses their own sticker over your code. Two seconds, no tools. Every payment after that lands somewhere else, and you find out at closing when the total does not match the till.
It works because a printed square carries no visible identity. Nobody in line can tell yours from theirs. The wider pattern, including what a swapped code can be pointed at beyond payments, is covered in the notes on fake and tampered codes and the security overview.
What actually defends a market stall:
- Laminate the sign, or mount it under acrylic or glass. Adhesive grips a glossy laminate poorly, and a sticker that does hold looks obviously wrong.
- Use tamper-evident stock for anything left unattended, so removal leaves a visible mark.
- Keep the code inside a printed frame carrying your logo and name. An overlay either covers the frame or sits crooked inside it, and both are easy to spot.
- Do not leave the sign out overnight on an unattended table.
Scan your own code every morning
Before the first customer, scan your own sign with your own phone and confirm the name that comes up is yours. Do it again after any break where the table sat unattended.
Ten seconds. It is the only check that catches an overlay, a swapped stand, or a sign that got mixed up with another vendor's during pack-down last week.
If you run several stalls or several locations, keep a list of which code sits at which spot and photograph each sign in place at setup. When a payment lands in the wrong account, you want a record of what was where.
Peer-to-peer payment is not a checkout
The most important thing to understand about these apps: they were built to move money between people who already trust each other. Splitting rent. Paying back a friend. Reimbursing a sibling for concert tickets.
Because of that design, buyer protection on personal transfers is typically limited or absent, and the exact terms vary by app and by account type. In practice this cuts both ways.
For you as the seller, a completed transfer is usually hard for the payer to reverse on a whim, which sounds like good news. It also means you are the customer service department. No dispute process backs you up, no chargeback protection, no formal record beyond the app's own history.
For your customer, paying this way sits closer to handing over cash than to using a card. Say so if they ask. A buyer who understands that will not be surprised later, and the ones who are surprised later leave reviews.
Where a real processor earns its cut
The printed square is right for low-value, face-to-face sales where the goods change hands immediately. Bread at a market. A haircut. A jar of honey off a folding table.
Move to an actual payment processor when any of these is true:
- The transaction is large enough that a dispute would genuinely hurt.
- The goods ship later instead of changing hands now.
- You need receipts, invoices, refunds or tax records that reconcile cleanly.
- You take remote orders from people who have never met you.
- Customers expect to pay by card and are walking away because they cannot.
Processors take a percentage and they charge it for a reason: dispute handling, fraud screening, records, refunds, and a legal relationship that survives an argument. Hosted checkout links from merchant tools print as codes just as easily, and the general setup for a payment code is the same whichever rails sit behind it. A PayPal code or a Venmo code works identically at the sign level; only what stands behind it changes.
Print a new sign this week with your business name above the code, laminate it, and scan it yourself before the market opens.
