How do you share a payment link by tap?

It is a link, not a payment

The tag holds an address. The payment happens on a page, through whatever payment provider you use, exactly as it would if the person had typed the address.

No money passes through the tag, no card details touch it, and it holds nothing sensitive.

So the technical exercise is trivial and the risk is entirely about where the address points and whether it is still yours.

The substitution problem

A tag that leads to a payment page is worth replacing with one that leads somewhere else. That is a real pattern with printed codes in public places, and a tag is no different.

It is also easier to hide: a sticker over a sticker looks like nothing, where a code covered by another code is sometimes noticed.

And nobody complains to you, because a customer who paid the wrong person does not know that they did.

This is not a reason to avoid the idea. It is a reason to treat a public payment tag as something that needs checking rather than installing.

Reducing the exposure

Prefer a tag you present rather than one you leave. A card handed over is watched, and a sticker on a stall is not.

Use a tamper evident tag where one must be left in place, so removing it destroys it and a replacement is visible.

Check it yourself regularly, by tapping it and confirming the destination, which takes seconds and is the only reliable control.

Use your own domain, so the address is short, recognisable and yours, and so you would notice a change.

What the payer sees

A notification or a browser showing an address. That address is the only thing telling them who they are about to pay.

So a short recognisable domain matters more here than anywhere else. An opaque shortened address gives them nothing to judge.

Say the amount and the recipient out loud, so the screen confirms what they already expect rather than being their only information.

And accept that some people will not tap a payment tag from a stranger, which is entirely sensible of them.