The only "tampering protection" is the error correction by the QR code. Proper protection would need a PKI, which would make it so complex, no one would use it.

The only "tampering protection" is the error correction by the QR code. Proper protection would need a PKI, which would make it so complex, no one would use it. You always have to bullshit check the data anyway. Payee name + bank account number are _not_ checked in Austria. I guess this is similar to other EU countries, as @kiwijamo also suggested.