Are QR codes safe? QR code scams and how to avoid them

How QR code scams work

The trick is always the same: a QR code that looks official sends you somewhere you didn’t expect. Common versions:

• Stickers over real codes on parking meters, EV chargers, bike and scooter rentals, restaurant tables or posters, leading to a fake payment page.
• Emails and letters with a QR code (“Your parcel is waiting”, “Confirm your bank account”, “Your password expires today”) that open a fake login page.
• Fake parking fines or invoices on a car windscreen or in the post, with a code to pay.
• Codes that do more than open a page: start a call or a text message to a premium number, join an unknown Wi-Fi network, or install an app.

Before you open a scanned link

Your phone shows the address before opening it. Take two seconds to read it.

• Does the address match who it claims to be? A bank, parking company or shop should use its own known domain, not a strange name, random letters or a spelling trick like paypa1.
• Is it a shortened link (bit.ly and similar) on something that asks for payment? Be extra careful, because you can’t see the real destination.
• Is the code a sticker on top of another code? Look closely, especially at anything you’d pay through.
• Did it arrive unexpectedly by email, letter or text? Don’t scan it. Go to the company’s website or app yourself instead.

Red flags after opening

• The page asks for your password, PIN, card number or bank login when you only wanted to read a menu or pay for parking.
• It pushes urgency: “Pay within 24 hours”, “Your account will be closed”.
• It asks you to install an app or a “security update”.
• It opens a text message or call to a number you don’t recognise.

For payments in public places, the safest route is the operator’s official app or the payment terminal itself, not a code you can’t verify.

If you already entered your details

1. Card or bank details: call your bank straight away and block the card. Check recent payments.
2. A password: change it on the real website, and everywhere else you used the same password. Switch on two-factor authentication.
3. Installed an app: uninstall it and run your phone’s security check.
4. Report it to the company being imitated and to your national fraud or cybersecurity service (for example Action Fraud in the UK, reportfraud.ftc.gov in the US, CERT-EE in Estonia). Tell the owner of the place where you found a fake sticker.

For businesses: make QR codes people can trust

As scams become better known, careful customers hesitate to scan. These habits make your codes look and stay trustworthy:

• Point codes to your own domain (yourshop.com/menu), so the address people see is clearly yours.
• Print the web address next to the code as well, so people can compare. The description option in the generator puts text under the code.
• Use static codes. Codes from dynamic QR services pass through someone else’s server, which could later show other content. See static vs dynamic QR codes.
• Add your logo to the code (generator options → Logo), so a plain sticker on top of it stands out.
• Make tampering hard: put codes behind glass or laminate, or print them as part of the sign rather than as a separate sticker.
• Check public codes regularly, especially anything connected to payments, and scan them yourself now and then.
• Never ask for passwords or card details on the page a code opens unless the customer clearly expects to pay there.

More: how to scan a QR code on iPhone and Android.

Want to see where a code leads without opening it? Paste a screenshot into the QR code reader.