Quick Answer: Before opening a QR link, check the destination. If it is unexpected, abbreviated or asks you to pay or sign in, use the organisation’s known website or app instead. If you already scanned, respond based on what you opened, entered, paid or installed.
A QR code can open a website, a payment app or another action. The square pattern does not authenticate the person requesting that action. A fake code may lead to an imitation login, an unwanted download or a payment to the wrong recipient. To spot QR code scams, check where a code leads before tapping anything on the page it opens. A preview helps you identify a wrong destination before opening it.
Scammers use the gap between seeing a code and understanding the action it encodes. Your camera may show a link preview, but a shortened address or a payment-app action can still hide important context. Fake codes appear on parking meters, restaurant tables, in delivery texts and in emails. They can lead to phishing pages, fraudulent payment forms or app downloads that install malware.
Key Takeaways
- Check a QR code’s destination link before opening it, entering data or making a payment.
- Fake codes commonly appear as stickers over real ones, in unexpected texts or emails, and on parking and payment signs.
- If you have scanned a suspicious code, your next step depends on whether you only viewed the page or entered information, paid or installed something.
What Are the Warning Signs Before You Scan?
A QR code you did not expect is the clearest warning sign, especially if it arrives by text or email, or appears on a public sign with no obvious connection to a business you trust. Fake QR codes look no different from real ones. The risk lies in the data encoded in the image or the destination it points to, so you cannot judge it by the square pattern alone. Pay attention to the context, placement and behaviour around the code.
Quishing, or QR code phishing, works by hiding the clue people usually rely on with suspicious links: a visible web address. A tampered code can look identical to a legitimate one but send you somewhere completely different.
Look for Stickers, Altered Signs and Unusual Placement
Check whether a QR code is on a sticker layered over another code, particularly on parking meters, public kiosks or signs without official branding. The FTC reports fake stickers covering real parking meter codes. A raised edge or layered sticker can justify checking with the operator. An ordinary replacement label can also be legitimate, and a neatly printed code can be malicious; the physical clue is a reason to verify, not a verdict.
If a parking or payment sign seems altered, use the operator’s independently verified app, staffed desk or other supported payment method. Do not assume that one payment option proves a scam, or that successfully paying a stranger means the parking operator has received payment.
Question Unexpected Requests and Pressure to Act
Treat any QR code that comes with urgency or a request for personal details as suspicious. Scammers often pair fake codes with messages about missed deliveries, unpaid tolls or limited-time offers to make you scan and act without thinking. If a code asks you to confirm a payment, log in or download something you were not already planning to, stop and verify the source separately before proceeding.
Understand Why the Code Itself Cannot Prove It Is Safe
A QR code stores data, which may be a web link, text or an instruction for an app. Reading the code can reveal that data without proving who issued it. Ordinary QR patterns do not certify a merchant, payment recipient or website. Verify the source and the proposed action, not just the code’s appearance.
How Can You Check a Code’s Destination?
Use the camera’s preview where available and read what it proposes to open before tapping. The preview is a useful pause point, but it is not a safety guarantee. If you cannot see enough of the address or action to verify it, use a known route instead of opening it to investigate.
Preview the Destination with Your Phone’s Camera
Point your phone’s built-in camera at the code instead of opening a separate qr code scanner app. Apple’s Camera instructions and Google’s supported-camera instructions describe tapping the displayed link or banner. Android controls depend on the phone and camera app. A dedicated scanner may behave differently, so check the prompt rather than assuming every scanning tool works alike. Read the address carefully rather than tapping it immediately.
If the notification shows a shortened link, an unfamiliar domain or no clear connection to where you found the code, do not proceed. Close the notification and treat the code as unverified.
Check the Website Address Before You Open It
Look closely at the domain in the preview. Check for misspellings, extra words or unusual endings that do not match the business you expect. A bank’s name with one letter changed, or an unfamiliar extension attached to a familiar brand, may indicate a phishing site designed to imitate the real one. A secure connection does not establish who runs the site. A fake site can use HTTPS too. If the address is abbreviated or unclear, use the organisation’s known route instead.
Do not enter a password, card number or one-time code on a page reached through a QR code if the address looks even slightly wrong. Close the page and find the organisation’s official site or app instead.
Use the Official App or Website When You Cannot Verify the Code
For banking, government services or account recovery, skip the QR code and open the official app or type the known web address yourself. This avoids the uncertainty a QR code introduces and helps confirm you are using the genuine service. For payments through QR codes, confirm the recipient’s name and the exact amount before authorising anything. Do not give a sender your banking PIN or verification code to receive money. In your genuine payment app, read whether a prompt is receiving funds, requesting funds or authorising an outgoing payment; verify it independently if unclear.
Where Do Fraudulent Codes Appear?
Fraudulent QR codes often appear where people are moving quickly and expect to find a code, which can lower their guard. Knowing the typical locations can help you slow down at the right moment.
Parking Signs, Menus and Contactless Payments
The FTC has documented code overlays on parking meters. Scammers may place a sticker over the legitimate code so payments go to a fraudulent account instead of the parking authority. Restaurant tables and menus that use QR codes for contactless payments carry the same risk if someone swaps or covers a code without staff noticing. Public kiosks and posters advertising limited offers are also common targets, as a free-sounding deal can encourage people to scan without checking the source.
Emails, Delivery Messages and Unexpected Parcels
QR codes in unexpected delivery or account messages can be phishing attempts. A message claiming a package could not be delivered, or asking you to scan a code to reschedule a delivery, may lead to a page designed to collect personal details or payment information. An unexpected QR code sent through a channel a company would not normally use for that purpose is a clear warning sign.
Fake Login Pages, Payment Requests and App Downloads
A scanned code can lead to a fake login page designed to capture a username and password, a fraudulent payment request disguised as a legitimate service, or a prompt to install an app or browser plugin outside an official app store. Malware downloaded this way can capture banking credentials and enable financial fraud. You may not realise anything has happened until unauthorised transactions appear. Avoid downloading any app or browser add-on prompted by a QR code, and use official app stores instead.
What Should You Do If You Scanned a Suspicious Code?
| What happened? | First response |
|---|---|
| Previewed or opened only | Close the link and check whether anything downloaded or you accepted a permission. |
| Entered a password or code | Use a trusted device and the genuine service to recover access. Check sessions and recovery settings. |
| Authorised a payment | Contact the payment provider promptly and save the receipt or transaction reference. |
| Installed something | Use a trusted device for sign-ins and follow device security guidance. Contact IT for managed equipment. |
Close the page immediately without entering any information. Your next step depends on what you did after scanning. Seeing a scan result is not proof that your phone is compromised. Check whether a destination opened, a download occurred, permissions were accepted, information was entered or a payment was approved. Keep the phone updated and respond to what actually happened; do not assume that every scanner, website or device has identical behaviour.
If You Only Previewed the Link or Opened a Page
Close the browser tab or app without typing anything into it. Check downloads and any permissions or app actions you accepted. Use the device’s supported security controls if something installed or symptoms persist. An iPhone does not provide a desktop-style whole-system antivirus scan through an ordinary third-party app, so follow the platform’s guidance rather than buying a scanner advertised by the page.
If You Entered a Password or Authentication Code
Change the password immediately, particularly on any other account where you reused it. Credential theft from one fake page can expose several accounts at once. If you entered a two-factor code, act promptly through the genuine service: it may have authorised a sign-in or another action. Review sessions, recovery methods and connected apps, not only the password. Secure exposed email first where it can reset other accounts. Check recent login activity in the account’s security settings for anything you do not recognise.
If You Paid or Shared Personal Information
Contact your bank or card issuer straight away to dispute the charge and report possible fraud. Ask the provider what can still be stopped or disputed for the payment method you used. Keep existing receipts, messages, the code’s location and the transaction reference without reopening a suspicious page. Tell the merchant or parking operator if its sign appears tampered with. In the US, report fraud at ReportFraud.ftc.gov; elsewhere use the appropriate local reporting route. For exposed identity documents or a US Social Security number, follow identity-theft recovery guidance as well.
If You Downloaded a File or Installed an App
If the file did not run, remove it and do not open it to investigate. If you installed an app, extension or profile, stop using the device for sensitive sign-ins. On a managed device, contact its administrator before changing profiles. Use a different trusted device for account recovery and follow your operating system’s security guidance. Seek trusted support if suspicious behaviour or detections persist, or if the installed profile or app’s access is unclear. A reset can remove local data and settings and may not resolve an exposed account. Follow platform and backup guidance before taking that step.
Keep the Payment and Account Follow-Up Separate
If a scam payment also exposed a password, the bank’s transaction investigation does not secure that login. Likewise, changing a password does not reverse a transfer. Tell the relevant service exactly which action you took, including whether you entered card details, approved a payment in an app or only opened a page. Reimbursement depends on the payment method and circumstances; no result is guaranteed.
The FTC’s scam-response guidance recommends contacting the company used to send the money promptly. Ask about stopping or reversing that specific transaction. Keep the case reference, use independently verified support, and distrust a new contact demanding an upfront fee to recover your loss.
For a suspicious parking code, separately check whether your parking session exists in the genuine operator’s system. A receipt from a fraudulent payment page does not establish that the parking charge was paid. Use the operator’s supported help or payment route rather than making a second payment through the same uncertain code.
Check the Destination Before You Pay or Sign In
Before completing a payment or login that started with a QR code, pause and confirm that the destination matches what you expect. This matters most when the stakes are high, such as with banking, government portals and account recovery.
Before you tap “pay” or type a password on a page reached through a QR code, run through this shortlist:
- Read the full web address shown in your phone’s camera preview, checking for misspellings or an unfamiliar domain.
- Use the verified organisation’s own app or site for sensitive details; a padlock alone is not proof.
- Check that the recipient name and payment amount match what you expect if a payment is involved.
- Read the genuine payment app’s action and recipient; never share a PIN or verification code with someone promising to send you money.
- If anything looks uncertain, close the page and open the organisation’s official app or website directly instead.
Treat urgency as a warning sign. Confirm genuine delivery or account issues independently through the provider’s official app or known contact details.
Frequently Asked Questions
Can you tell a fake QR code by looking at the pattern?
No. Check where you found the code and where it directs you. A sticker can cover a legitimate code.
Is a link safe if it shows a padlock?
No. An impersonation site can also use HTTPS.
What if I only opened the link?
Close the page and check for downloads or permission prompts. Respond differently if you submitted details or installed something.
What if I paid through a QR code?
Contact the payment provider through a known channel and keep the receipt and the code’s location.
Sources and Image Credits
Guidance: FTC QR-code scams, Apple Camera scanning, Camera from Google and FTC scam response. Illustrations: Impulsec.
Share this article
Stuart Kerr Spindlow is Impulsec’s Publisher, Chief Editor and Lead Reviewer. He writes and maintains coverage of consumer cybersecurity and digital-safety software, with a focus on practical suitability, limitations and the evidence behind product claims. Read Stuart’s full profile.