QR Code Scam Safety: How to Spot a Malicious QR Code

QR codes have made a lot of everyday tasks faster — paying at a counter, joining Wi-Fi, opening a menu — but that same convenience has made them a growing target for scams. The good news is that QR code scams are almost entirely preventable with a couple of simple habits.

The most common QR code scams

Sticker overlays on legitimate codes. Scammers print a fake QR code sticker and paste it directly over a real one — on a parking meter, a payment counter, or a poster — redirecting an unsuspecting scan to a fraudulent payment page or phishing site instead of the intended destination.

"Quishing" (QR phishing) emails and flyers. Instead of a suspicious link in an email (which many people have learned to distrust), scammers embed a QR code instead — since QR codes hide their destination until scanned, they bypass the instinctive caution people now apply to obvious text links.

Fake payment or refund codes. A code claiming to process a refund, a parking fee, or a delivery redirect that actually initiates a payment from your account rather than to it, or leads to a card-detail-harvesting page designed to look legitimate.

Malicious app download prompts. A scanned code that directs to an app download outside official app stores, often disguised as a required "update" or "viewer" needed to access content.

How to protect yourself

1. Check for physical tampering before scanning — a sticker slightly misaligned, peeling at an edge, or an odd size difference compared to surrounding print is a red flag on a printed code.
2. Preview the destination before opening it. Use a scanner that shows the full URL or content of a code before taking any action, and read it properly rather than tapping "open" reflexively.
3. Check the domain carefully. Scam URLs often closely mimic a real brand's domain with small misspellings or extra words — read the whole domain, not just the recognisable part.
4. Be extra cautious with unsolicited QR codes — in an email, a text message, or a flyer that appeared somewhere unexpected — especially any urging urgent action ("scan now to avoid a fee").
5. Never enter payment or login details on a page reached via a QR code unless you're confident of both the source of the code and the destination it opened.

Why "just scan and see" is risky

Some scanner apps open a link automatically the moment a QR code is recognised, with no preview step. This removes the one moment where a user could catch something suspicious before it's too late — by the time a fraudulent page loads, some scams have already achieved their goal (a tracking pixel, an auto-download, or a convincingly disguised login page).

A safer default habit

Treat an unfamiliar QR code the same way you'd treat an unfamiliar link — worth a second look before acting on it, especially anywhere money, passwords or personal information might be involved.

QR Code Scanner always shows you what a code contains before opening it — scan with confidence →