How to Spot a Fake QR Code (and Avoid "Quishing")

You cannot tell whether a QR code is safe by looking at it, so check the destination before you act. Preview the web address your phone shows, be wary of codes in unexpected messages and of stickers placed over other codes, and never enter passwords or card details on a page you reached from a code you cannot verify. Businesses can reduce the risk by framing their codes, checking them regularly and printing their name beside them.

What "quishing" is

Quishing is phishing done with a QR code. The code is just a picture of a web address; the scam is the page it opens. Because the pattern looks the same whether it leads to a menu or to a fake login page, people lower their guard, and security filters that scan text for bad links may not read the image at all. The US Federal Trade Commission published a consumer alert in December 2023 describing exactly this, including scammers who replace the codes on parking meters with their own and messages that invent an emergency, such as a missed delivery, to push people to scan quickly.

The two common tricks

Overlay stickers. A criminal prints a code and sticks it over a real one: on a parking meter, a restaurant table, a poster, a charity collection box. Customers think they are paying or reading the menu, and are sent to a look-alike page.

Unsolicited codes. A letter, email or text asks you to scan a code to reschedule a delivery, confirm a bank transaction or claim a prize. The urgency is the warning sign.

Seven checks before you open a code

1. Read the address your phone shows. Both iPhone and Android show the destination before opening it. Compare the domain with who you expected. A café menu should not open a domain you have never heard of.
2. Distrust shortened links from stickers and messages. A short link hides where it ends up. It is not unsafe by itself, but it removes a check you would otherwise make.
3. Look at the physical code. Is it a sticker lying over another print? Do the edges lift? Is it on a surface that should not carry a sticker?
4. Ask whether you were expecting it. Codes in unsolicited mail or messages deserve extra suspicion.
5. Go to the official site yourself. If a code says it is from your bank or courier, close it and open the official app or website instead.
6. Never enter credentials or card numbers on a page you cannot verify. Check that the address matches and that you really need to be on it.
7. Use a reader that previews links. Reading a code from a screenshot with a tool that shows the full address before opening anything is a safe way to inspect it.

What businesses should do

If you print QR codes for customers, you are part of the defence.

• Mount codes so they cannot be covered. Use a frame, a clear cover or a table stand rather than a loose sticker.
• Print your name beside the code and show it on the page. Customers who know what the page should say can spot a fake.
• Inspect codes on a schedule. Check them at opening, especially anywhere that handles payments or donations.
• Use a short link on a domain you control, or a provider that screens destinations. A dynamic code lets you change a destination quickly if something goes wrong, and a provider that checks for abuse reduces the chance that your own codes are used against people.
• Never ask for card details on a page you reach from a poster. Send people to your payment provider's hosted page.

If you scanned something suspicious

Close the page without typing anything. If you entered a password, change it on the real site and enable two-factor authentication. If you entered card details, call your bank. Report the sticker to the venue and, where relevant, to the consumer-protection agency in your country.

FAQ

Can scanning a QR code alone infect my phone?

Scanning only reads the text. The risk comes from what you do next: opening a malicious page, installing something it offers, or entering credentials. Keep your phone updated and be careful with the page that opens.

How do I check a QR code without opening it?

Look at the address preview shown by the camera app, or decode a screenshot of the code with a tool that displays the contents before opening anything. Our free QR code reader does this in your browser without uploading the image.

Are QR codes unsafe to use?

No more than any link. They are safe when they come from a source you trust and lead to the site you expected. Treat them like links in an email: check where they go before you act.