How to spot a QR code scam

A QR code hides its link until you scan it. That makes it handy for scammers, who use it to send people to fake payment and login pages. A few habits make you much harder to fool.

By the 3D-QR team · Updated · 4 min read

What is quishing?

“Quishing” is phishing with a QR code. Instead of a suspicious link you can read, you get a pattern you can’t. You scan it, your phone opens a page, and the page asks for a card number, a password or a login code. Because you chose to scan it, it can feel more trustworthy than a link in a message, and that is exactly the point.

A QR code can’t install anything or take over your phone by being scanned. The danger is only ever where it leads: a fake website, a malicious download or a payment you didn’t mean to make.

Where scam QR codes turn up

  • Parking meters and pay stations: a sticker placed over the real code, leading to a fake payment page.
  • EV chargers: the same trick, on the code you scan to start charging.
  • Letters and parcels: “missed delivery” cards, fake fines and fake bills with a code to “pay now”.
  • Emails: messages asking you to scan a code to re-verify an account, review a document or reset a password. Putting the link inside an image can help it slip past some email filters, which is why scammers use it.
  • Restaurant tables and posters: a sticker over the real menu code.
  • Social media and marketplaces: a “buyer” who sends a QR code so you can “receive” a payment.

Most phone cameras show a preview of the link before opening it. Read it. On a computer, use the QR code safety checker, which shows the full link and looks for warning signs without visiting the page.

When you read a link, the part that matters is the domain: the name just before the first single slash. In https://pay.example.com/parking, the domain is example.com. Read it from right to left:

  • paypal.com.secure-login.xyz belongs to secure-login.xyz, not PayPal.
  • paypa1.com uses the number 1 in place of the letter l.
  • amazon-delivery-help.com is not Amazon, whatever it says.

Warning signs

  • A sticker on top of another code, or a code that looks newer, crooked or differently printed from the sign around it.
  • A link shortener (such as bit.ly or tinyurl) on something official. Real councils, banks and parking companies usually show their own domain.
  • A brand name in the wrong place, as in the examples above, or a domain that is close to a real one but not quite.
  • Odd endings on the domain that the real organisation doesn’t use.
  • Plain http:// instead of https:// on a page that asks for details.
  • A raw number address like http://203.0.113.7/pay.
  • A file download, especially an app file ending in .apk or .exe.
  • Urgency: “pay within 24 hours to avoid a fine”, “your account will be closed”.
  • A request for a card, a password or a one-time code straight after scanning.

No single sign proves a scam, and a clean result doesn’t prove a page is safe. New scam sites can look perfectly normal. Use these signs as reasons to slow down.

Safer habits

  • For payments, use the official app or type the company’s address yourself instead of scanning.
  • Don’t scan codes in unexpected emails or letters. Contact the company using details you already have.
  • Touch the sign. A sticker that peels or sits raised is a warning.
  • Keep your phone and browser up to date.
  • Turn on two-factor authentication for email, banking and shopping accounts, so a stolen password alone is not enough.

If you already scanned one

Scanning alone did no harm. What to do depends on what happened next:

  • You only opened the page: close it. Clear your browser history for that site if you like. Nothing else is needed.
  • You entered a password: change it right away on the real site, and on any other site where you used the same password. Turn on two-factor authentication.
  • You entered card details or paid: call your bank or card provider on the number on the back of your card. Ask them to block the card and dispute the payment.
  • You installed something: uninstall it, run your phone’s security check, and change passwords from a different device.

Then report it: to the owner of the sign or meter, to the company being impersonated, and to your country’s fraud reporting service.

If you put QR codes in public

Businesses and councils can make tampering easier to spot:

  • Print the code as part of the sign, not as a separate sticker.
  • Print your web address under the code, so people can check that the link matches.
  • Check your codes regularly, and scan them yourself.
  • Tell customers where your codes appear and what domain they use.

When you make a code with your own logo and colours, a plain substitute sticker stands out more.

Try the tools from this guide

More guides

Buy me a coffee