QR Code Security: How to Spot and Avoid QR Code Scams

A QR code is just a way of writing down a link. The problem is that people can't read it with their eyes, so they can't tell a real link from a fake one until after they've scanned it. Scammers take advantage of that. QR-based phishing even has its own nickname: "quishing". Consumer protection agencies, including the US Federal Trade Commission, have warned people about it.

The good news: a handful of habits make you very hard to fool.

Fake stickers on real signs

A scammer prints their own QR code and sticks it over the genuine one on a parking meter, EV charger, restaurant table or poster. The fake code leads to a look-alike payment page that steals card details.

QR codes in emails and letters

Phishing emails increasingly use a QR code instead of a link, partly because email filters are worse at checking images. Typical lures: "scan to re-verify your account", "your parcel is held", or "set up two-factor authentication".

Unexpected codes in the post or on flyers

A code on an unsolicited letter, a "you've won" flyer, or a package you didn't order can lead to scam sites or app downloads you shouldn't install.

1. Read the preview. Your phone camera shows the web address before opening it. Check the domain carefully: paypa1-secure.co is not PayPal.
2. Look for tampering. On public signs, check whether the code is a sticker over something else, or looks misaligned or newly added.
3. Don't log in or pay from a scanned link you didn't expect. Open the official app or type the website address yourself instead.
4. Be suspicious of urgency. "Scan within 24 hours or your account is closed" is a classic pressure tactic.
5. Never install apps from a QR code unless it takes you to the official App Store or Google Play listing of a company you trust.
6. Keep your phone updated. Browsers block known dangerous sites, but only if they're up to date.
7. If in doubt, don't scan. Ask staff, or look up the official website independently.

• Print the destination in words next to the code, for example "Scan to pay at pay.yourcafe.com", so customers can check the preview matches.
• Use your own domain in the destination where possible. Customers trust a link they recognise.
• Check public codes regularly for stickers placed over them.
• Don't ask for passwords or card details on the first page a QR code opens.
• Keep your website secure. If it's hacked and flagged, browsers will show a warning to everyone who scans.

Providers of dynamic QR codes (the kind that redirect through the provider's server) have a responsibility not to become a free redirect service for scammers. At QRCraft, dynamic codes can only point to normal web addresses (plus email, phone and SMS links), not to scripts, private network addresses or other short links that hide the final destination.

No tool can stop someone sticking a fake code on a meter, though. Your best protection is still a two-second look at the preview before you tap.