Are QR Codes Safe? How to Spot a Fake QR Code

The Short Answer

Scanning a QR code is safe - the risk is where the code takes you.

A fake code looks exactly like a real one, so you cannot tell by looking at the squares.

Check the address before you open it, and never pay or log in through a code you did not expect. The QR Code Scanner shows the real destination and warns you about the usual tricks first.

What Is Quishing?

Quishing is phishing with QR codes.

Instead of a dodgy link in an email, the scammer hands you a code that opens a copy of a real website - a parking app, a bank, a delivery company - and waits for you to type in a password or card number.

It works because a code hides the address. Email filters and people both check links; few people check a QR code.

Authorities have warned about it for years: the FBI in 2022 and the US Federal Trade Commission in 2023.

Where Fake QR Codes Show Up

• Parking meters and EV chargers - a sticker over the real code leads to a fake payment page.
• Restaurant tables and menus - a swapped code "to pay the bill".
• Fake parking tickets - a note on your windscreen with a code to pay a fine.
• Emails and letters - "scan to verify your account", "your package could not be delivered".
• Posters and flyers - prize draws, discounts and surveys that ask for personal details.
• Unexpected parcels - a gift you did not order with a code to "find out who sent it".

7 Warning Signs of a Fake QR Code

1. A sticker on top of another code. Run a finger over it. Real codes are usually printed on the sign, not stuck on.
2. It asks for money or a login straight away. Parking, tolls and fines can almost always be paid in the official app or on the official site.
3. A short link. bit.ly and similar services hide the real address. Fine on a poster you trust, a red flag on a parking meter.
4. A look-alike address. paypa1.com, amaz0n-help.net, or letters from other alphabets that look Latin. Read the name slowly.
5. No https. A payment page without a secure connection is never real.
6. It downloads an app or a file. Real businesses send you to the official app store, not to an .apk file.
7. Urgency. "Pay within 24 hours or…" is pressure, not customer service.

How to Check a QR Code Before You Open It

Most phone cameras show only a short preview of the link. Look at it before you tap - and when in doubt, check it properly.

1. Take a photo or screenshot of the code (on a computer, see how to scan a QR code from a screenshot).
2. Open the QR Code Scanner and upload or paste it - or use the scanner's camera.
3. Read the site name in large type at the top. Is it the company you expect?
4. Check the warnings: short links are followed automatically so you see every redirect and the final site, and look-alike addresses, hidden addresses, app downloads and payment pages are flagged.
5. Only then open it - or better, type the company's address yourself.

Payment codes for bank transfers get checked too: the scanner shows who would receive the money and whether the IBAN is valid.

Already Scanned One? What to Do

• Did not type anything? Close the page. Just opening a link is rarely harmful on an up-to-date phone.
• Entered a password? Change it right away, on the real site - and anywhere else you use the same one. Turn on two-factor login.
• Entered card details or paid? Call your bank or card company now. They can block the card and often reverse the payment.
• Installed an app from the link? Uninstall it and run your phone's security check.
• Report it. Tell the parking company, restaurant or shop so they can remove the sticker, and report the scam to your national fraud reporting service.

For Businesses: Protect Your Own Codes

If customers scan your codes, scammers may copy them.

• Print the address under the code - "Pay at parkingcity.com" - so people can compare.
• Use your own domain, not a short link. A short link teaches customers to trust addresses they cannot read.
• Print codes into the sign instead of using stickers, and check them regularly for stickers on top.
• Add a branded frame and your logo - in the QR Code Generator - so a plain swapped code stands out.
• Test every code before it goes out with the QR Code Checker.

Frequently Asked Questions

The Bottom Line

• The code is harmless - the link inside is what matters
• Stickers on top, short links and look-alike names are the big red flags
• Never pay or log in through a code you did not expect
• Paid by mistake? Call your bank right away

Five seconds of checking beats five days of arguing with your bank.