QR Code Scams: What They Look Like and How to Avoid Them

A QR code is a convenient way to move someone from a physical sign to a web page. It is also a convenient way to move them somewhere they did not intend to go. The code itself is neutral; the scam is in where it points and what the page asks for.

Use the QR Scanner to read a code before opening it. The decoded payload is the first piece of evidence, and it is available without trusting the label around the pattern.

The sticker swap

The simplest attack does not need a fake website. It needs a sticker. A scammer places a code over the genuine one on a parking meter, a restaurant table, a charging point or a poster. The sign still looks official; the code goes somewhere else. Check the edges and the material around the code. One that sits proud of the surface, or on different paper from the sign, is worth peeling back or ignoring.

A code in a public place should never be the only route to a service. If you can type the organisation’s address yourself, do that.

Fake notices and payment demands

Common versions arrive as a parking fine, a parcel delivery, a council notice, an unpaid invoice or a refund. The message creates a deadline and offers the code as the fastest fix. The page then asks for card details, a bank transfer or a payment app.

Verify the claim through the organisation’s own app or a phone number you look up independently, not through the code. A genuine penalty usually has a reference number and a process that does not depend on one small square of print.

Phishing and account theft

Some codes lead to a page that copies a familiar login screen and asks for an email password, a one-time code or a recovery phrase. Others ask you to install an app that requests accessibility permissions or remote access. A code in an unexpected email can also bypass a link filter, because the message contains an image rather than a clickable address.

Treat any request for a password, a one-time code or a remote-access install as a stop signal. No legitimate support person needs your one-time code, and no routine parcel requires it.

Habits that stop most attempts

Preview the payload before opening it, and read the domain rather than the page title. Be wary of short links and addresses that imitate a brand with a small spelling change. Set your scanner to ask before opening, and use a browser that shows the full address. If you are unsure, close the page and reach the organisation by a route you already trust.

If you have entered details, change the affected password from another device, contact the organisation and report the code to the venue. Removing the sticker protects the next person.

Scan with QR Scanner and read the decoded address before you tap through. For the wider method, read How to Scan a QR Code Safely Before You Open It. For a step-by-step check, see How to Check a QR Code’s Destination Before Opening It.