Avoiding QR code scams
You cannot tell where a QR code goes until you scan it. Scammers exploit that by sticking fake codes over real ones. Three seconds of checking before you tap avoids most of it.
Where it usually happens
- Parking meters. A fake sticker over the real code harvests card details.
- Restaurant table ordering. A second sticker is layered over the original.
- Letters and delivery notices. An unpaid fee or delivery problem is the pretext for scanning.
- Codes in email. Mail filters check links but rarely read a QR code inside an image, so phishing emails increasingly use codes instead of links.
Before you scan
Is it a sticker on top?
Touch it. Raised edges, signs of something stuck over the printed surface, or print texture that does not match the surroundings are all red flags. Two codes on the same public machine is a reason for extra caution.
Read the address your phone shows
Modern phone cameras show the address before opening it. That preview is the most important moment. Check three things.
- Does the domain belong to who it should? A parking payment should go to the city or the operator; a restaurant order to the restaurant or a known ordering service.
- Is it a lookalike? One swapped letter, or the real name followed by an unrelated domain, such as
citypark-gov.cominstead ofcitypark.gov. - Is it a short link hiding the destination? A link that does not say where it goes is a warning sign in itself. Official payment codes rarely use link shorteners.
After scanning, never
- Enter passwords, card numbers or verification codes on a page a QR code opened
- Install an app because a QR-opened page told you to
- Follow pressure like ‘pay now or face a penalty’
If payment or login is needed, open the official app or type the address yourself instead. A genuine service will let you do the same thing that way.
If you already entered details, contact your bank or card issuer immediately to block payments, and change the password on every account that shares it. Then report it to your local police or national fraud reporting service.
If you are the one making codes
Businesses and institutions can make it easier for people to scan with confidence.
- Put your own domain directly in the code. Short links or unfamiliar intermediate addresses leave people no way to tell real from fake. More on why in static versus dynamic QR codes.
- Print the domain in text next to the code so people can compare it with what they scan.
- Check regularly that nobody has stuck anything over your codes.