Spot a fake QR code before you scan it

A QR code is a link you cannot read with your eyes. That is what makes it convenient, and that is also what makes it useful to scammers. A code on a parking meter, a poster, a parcel, or in a message can look ordinary while pointing to a fake login page, a payment page you never meant to visit, or a download you never asked for. Most QR scams fail if you slow down at two moments: before you scan, and after your phone shows you the destination.

How a QR code scam usually works

Most QR scams, often called quishing — QR phishing — follow the same pattern. A scammer hides a harmful link inside a code, then gives you a reason to scan it in a hurry. The Federal Trade Commission (FTC) warned in its December 2023 consumer alert that scammers cover up real codes on parking meters with codes of their own, and send codes by text message or email with invented stories: a package that could not be delivered, a problem with an account, or suspicious activity that supposedly requires a password change. Each story is designed to create urgency, so that you scan the code and open the link without thinking about it.

Once you scan, the trap is usually the page behind the code rather than the code itself. The FTC describes a spoofed site that looks real but is not: if you log in there, the scammers can steal whatever you enter, and a bad code can also try to install malware. ESET, writing about quishing, makes a related point: because the destination is encoded in a visual pattern rather than written out as readable text, it stays hidden until you scan, and some traditional email filters cannot inspect it the way they inspect a visible link. None of this means QR codes are unsafe in themselves. It means the check has to happen after the scan, in the preview your phone shows you, before you tap through.

Before you scan: the five-second inspection

Your phone camera cannot tell you whether a printed code has been tampered with. Your eyes can help. Run through these checks before you point your camera at anything.

1. Look for a sticker placed over the real code

Feel and look at the edges. A sticker laid over a printed sign often has a visible border, a slightly raised edge, a different gloss or paper texture, or corners that are peeling. If the code sits on top of another code, a logo, or printed text, treat it as suspect. This is the classic parking-meter trick the FTC describes: the real payment code is covered, and the payment goes to the scammer instead. If anything looks layered, do not scan it. Pay through the official app, the meter itself, or the venue website you already know instead.

2. Check for damaged, mismatched, or sloppy printing

Compare the code with the rest of the sign. A genuine code printed as part of a sign usually matches its surroundings: same print quality, same alignment, same style. Be cautious if the code is blurry while the rest of the sign is sharp, if it is crooked or oddly sized for its frame, or if it looks like a home printout stuck onto a professional display. Damage alone does not prove a scam — a weather-worn poster can simply be old — but damage combined with an unexpected payment or login request should stop you. Our troubleshooting guide explains how to tell a printing problem from a tampering problem.

3. Ask whether the code belongs in this place at all

A code in an unexpected place is a red flag on its own. A code taped to a lamppost, a cash machine, or a random flyer, with no business name, no context, and no explanation of where it leads, has not earned your trust. The same goes for a code inside an unexpected parcel or in a message from a sender you do not recognise. Legitimate businesses tell you what the code is for — view the menu, pay for parking, join the Wi-Fi — and where it should take you. If neither is clear, leave it alone.

4. Read the message around the code, not just the code

Urgency is the scammer's favourite tool. Watch for messages that demand immediate action: an account will be closed, a parcel will be returned, or a payment is overdue. Watch for threats, for prizes you did not enter, and for requests that do not match anything you actually ordered. A genuine company will almost always give you another way to check — its own app, its official website, or a phone number you already trust — and will not insist that scanning is the only option.

5. Decide how you will scan before you scan

Use your phone's built-in camera or a scanner you trust, and plan to read the preview. Your built-in camera typically shows the destination address before opening it, which is exactly the pause this checklist relies on. Avoid installing a new scanner app at the moment you need to scan, especially one promoted by the very sign or message carrying the code. Our guide to how to scan a QR code walks through the preview step on common phones.

After you scan: read the preview before you tap

Scanning is not the dangerous step. Tapping through without reading is. When your camera recognises a code, it shows a preview — usually the address, sometimes a short description. That preview is your inspection window. Use it every time.

Check the spelling of the address, letter by letter

Look for misspellings, switched letters, and extra words. The FTC's central advice for an unexpected code is to inspect the URL before opening it, and if it looks like a familiar address, to make sure it is not spoofed. A single swapped letter, a hyphen where there should be none, an extra word such as secure or verify, or a well-known brand name attached to an unfamiliar domain can all signal a fake. Read the domain — the part of the address that identifies the site — rather than the brand name in the page title or logo, because logos are easy to copy and domains are harder to fake convincingly. If you expected a particular company and the domain is not that company, close the preview.

Be suspicious of hidden destinations

A shortened link hides the real destination, so treat it as unproven. If the preview shows a short link service or a long string of random characters instead of a recognisable domain, you cannot tell where it really leads until you open it — which is precisely the risk. When the destination is hidden, choose the known route instead: type the company's address yourself, or open its app.

Never enter passwords or payment details on an unexpected page

This is the rule that stops most QR scams cold. If you reached a login or payment page only because you scanned a code — especially one from a message you were not expecting — do not enter your password, card number, bank details, or verification code there, however convincing the page looks. Spoofed pages are built to look identical to the real thing. Instead, close the page and go to the service directly: open its app, type its address yourself, or call a number you already trust. If the message claimed there was a problem with your account, checking through the official app will tell you whether that problem is real, without handing your credentials to anyone.

Watch for urgency tricks on the page itself

Countdown timers, warnings, and pop-ups are pressure tactics, not evidence. A page that says your account will be locked in minutes or that you must act before a timer runs out is trying to rush you past the checks above. Close the tab. Genuine account problems do not disappear if you take five minutes to verify them through a separate channel.

Do not download files or join networks from a scanned code without a reason

A QR code can point to more than a website. It can trigger a download, or offer to connect you to a Wi-Fi network. Do not install an app or accept a download just because a scanned code asked you to, and be especially careful with apps offered outside your phone's official store. Do not join an unfamiliar Wi-Fi network offered by a code on a poster without confirming with the venue that the network is theirs.

If you already scanned a bad code

Scanning a bad code does not automatically mean you have been harmed, and even entering details on a bad page is recoverable if you act promptly. Work through these steps in order, and do not let embarrassment slow you down — scammers rely on people staying quiet.

First, stop and disconnect. Close the tab or app, do not enter anything further, and do not follow any further instructions from the page, such as calling a number it displays or installing anything it offers. If a download started, do not open it.

Second, change any passwords you entered, from a device and route you trust. Open the real service's app or type its address yourself, change the password there, and turn on multi-factor authentication if it is not already on. If you used the same password anywhere else, change it there too, starting with your email account, since email is often the key to resetting everything else.

Third, contact your bank or card provider promptly if you entered payment details. Tell them what happened, ask them to watch for unauthorised transactions, and ask about blocking or replacing the card. Check your statements over the following days for transactions you do not recognise.

Fourth, report it. In the United States, report the scam to the FTC at ReportFraud.ftc.gov, with as much detail as you can give: where you saw the code, what the message said, and the address it led to. Reporting helps authorities track patterns, such as a run of tampered codes in one area. If you are elsewhere, report it to your national consumer protection or fraud reporting service, and to the company being impersonated, through its official channels.

Finally, check your device. Make sure your phone's operating system is up to date and remove any app or file the code led you to install. If anything behaves strangely afterwards, seek help from the phone maker's official support rather than from any number shown by the suspicious page.

For businesses: protect your own customers from fake codes

If your business prints QR codes, your customers' safety is partly your design problem. A customer who cannot tell your real code from a sticker over it is a customer a scammer can redirect, and the damage lands on your reputation even though you did nothing wrong. A few practical habits make tampering harder to pull off and easier to spot.

Use branded, recognisable codes. A code that carries your logo and colours, and that leads to your own domain, is harder to imitate convincingly than a plain code pointing to a generic short link, and it gives careful customers something to recognise in the preview. Place the code as part of the printed design — under glass, behind a counter, or printed directly onto packaging or a permanent sign — rather than as a loose sticker that anyone can peel off or cover.

Tell customers where the real code lives. State plainly, on the sign itself and on your website, where customers will find your genuine code and where it should take them. For example: our payment code is printed on the meter itself, not on a separate sticker, and it leads to our own website. That single sentence turns every sticker elsewhere into an obvious fake. If you move a code or reprint a sign, tell customers through your usual channels, and remove old codes rather than leaving them in place to be exploited.

Prefer codes you can change without reprinting. Dynamic codes, which can be edited after printing, let you update a destination if a link changes or a code is compromised, without leaving an outdated code in circulation. FreeQrly dynamic codes are free after sign-in, with 20 free codes and currently unlimited codes during a limited-time promotion, and they can be edited after printing, with scan statistics and unlimited scans. If a printed code is reported as tampered with, you can change where the surviving codes point and reprint only what needs reprinting. A compromised static code, by contrast, has to be physically replaced.

Safer codes start with a trusted generator

Most of the safety advice above is about other people's codes. When you create your own, choose a generator that keeps the process simple and transparent. FreeQrly static codes are free, need no registration, carry no watermark, and never expire. You can create codes across 17 content types, export them as PNG or SVG for print, add a logo, or generate codes in batch when you need many at once. Try it on the FreeQrly homepage, or test a code you have received safely with the QR scanner — reading the preview first, as this checklist describes, before you tap anything.

The habit to keep is short: inspect before you scan, read the preview after you scan, and never let urgency skip either step. A code that cannot survive those two pauses has not earned your password, your payment, or your trust.