QR Code Scam Safety: How to Spot a Malicious QR Code
Practical safety tips for avoiding QR code scams, including 'quishing' phishing attacks, fake payment codes and sticker overlays.
QR codes have made a lot of everyday tasks faster — paying at a counter, joining Wi-Fi, opening a menu — but that same convenience has made them a growing target for scams. The good news is that QR code scams are almost entirely preventable with a couple of simple habits.
The most common QR code scams
Sticker overlays on legitimate codes. Scammers print a fake QR code sticker and paste it directly over a real one — on a parking meter, a payment counter, or a poster — redirecting an unsuspecting scan to a fraudulent payment page or phishing site instead of the intended destination.
"Quishing" (QR phishing) emails and flyers. Instead of a suspicious link in an email (which many people have learned to distrust), scammers embed a QR code instead — since QR codes hide their destination until scanned, they bypass the instinctive caution people now apply to obvious text links.
Fake payment or refund codes. A code claiming to process a refund, a parking fee, or a delivery redirect that actually initiates a payment from your account rather than to it, or leads to a card-detail-harvesting page designed to look legitimate.
Malicious app download prompts. A scanned code that directs to an app download outside official app stores, often disguised as a required "update" or "viewer" needed to access content.
How to protect yourself
- Check for physical tampering before scanning — a sticker slightly misaligned, peeling at an edge, or an odd size difference compared to surrounding print is a red flag on a printed code.
- Preview the destination before opening it. Use a scanner that shows the full URL or content of a code before taking any action, and read it properly rather than tapping "open" reflexively.
- Check the domain carefully. Scam URLs often closely mimic a real brand's domain with small misspellings or extra words — read the whole domain, not just the recognisable part.
- Be extra cautious with unsolicited QR codes — in an email, a text message, or a flyer that appeared somewhere unexpected — especially any urging urgent action ("scan now to avoid a fee").
- Never enter payment or login details on a page reached via a QR code unless you're confident of both the source of the code and the destination it opened.
Why "just scan and see" is risky
Some scanner apps open a link automatically the moment a QR code is recognised, with no preview step. This removes the one moment where a user could catch something suspicious before it's too late — by the time a fraudulent page loads, some scams have already achieved their goal (a tracking pixel, an auto-download, or a convincingly disguised login page).
A safer default habit
Treat an unfamiliar QR code the same way you'd treat an unfamiliar link — worth a second look before acting on it, especially anywhere money, passwords or personal information might be involved.
QR Code Scanner always shows you what a code contains before opening it — scan with confidence →
QR Code Scanner
Fast QR & barcode scanner with a built-in QR code generator
More about QR Code Scanner
Check the Link Before You Open It: A Quick Routine
A ten-second routine for reading the address in a scanned QR code and spotting the signs of a suspicious link.
Read article →QR Codes in the Classroom: Ideas for Teachers
Simple ways teachers use QR codes: quizzes, treasure hunts, reading extras and quick links to resources.
Read article →QR Scanners and Camera Permissions: What to Allow
Why a scanner app needs camera access, which other permissions it does not need, and how to review them.
Read article →Shortened Links in QR Codes and What They Hide
Why people shorten links for QR codes, how it changes the scanning experience, and how to stay careful with them.
Read article →