Fake QR codes: how to spot one, and what to do if you scanned it

Updated 28 October 2026

Quishing is phishing through a QR code: a fake code sends you to a page that steals your password or card details, or tries to get you to install a harmful app. To protect yourself, read the web address your phone shows before you open it, and be wary of any code that asks you to pay, sign in or install something. When money is involved, skip the code and type the official website yourself or use the official app.

A QR code is just a link you cannot read with your eyes. That is what makes it useful to scammers: a printed sticker or an image in an email hides the address until you scan it. The FBI has warned that criminals tamper with both printed and digital codes, and the Federal Trade Commission describes the same pattern: a code that leads to a convincing fake site, often with a reason to hurry.

Where fake QR codes show up

• Parking meters and parking signs. A sticker over the real code, or a sign telling you to pay by QR, leads to a fake payment page. You lose the card details, and you may still get a parking ticket because the parking was never paid. Over the winter of 2021 and 2022, San Antonio police warned about fake stickers on city meters, and Austin found them on more than two dozen pay stations.
• Electric vehicle chargers. The UK motoring organization RAC has warned drivers about fake codes on parking machines and EV charge points, and advises paying by cash, card or the operator's official app instead.
• Restaurant tables and menus. A code stuck on a table can lead to a fake menu or payment page instead of the restaurant's own.
• Letters, flyers and parcel notices. A note about a missed delivery, an unpaid bill or a fine carries a code for quick payment. The scripts are familiar from text messages: the FTC warns about fake texts demanding unpaid tolls or USPS redelivery fees. The same story can just as easily come as a QR code on a letter or a note under your windshield wiper.
• Emails with a QR code. A message about a password that expires or a document to sign asks you to scan a code. An image is harder for email filters to inspect than a link, and scanning moves you from a protected work computer to your phone. The FBI described exactly this tactic in a January 2026 alert about a state-backed hacking group.
• Stickers over real codes anywhere a code is printed: posters, bus stops, shop windows, product packaging.

Warning signs

One sign alone does not prove a scam, but each is a reason to stop and check.

• The code is a sticker, especially one placed over another code, with raised or peeling edges.
• The code asks you to pay, to sign in, or to enter card or personal details.
• There is pressure to act now: a fine that doubles, an account that will be closed, a parcel that will be returned.
• The address your phone shows does not match the organization: a different name, an extra word, a misspelling, or an unusual ending.
• The address is a shortened link, so you cannot see where it really goes.
• The page asks you to install an app, or to download a file. Get apps only from your phone's official app store.
• The code arrived in an email or letter you did not expect.

How to check a QR code before you open it

Without any app

1. Look at the code itself. If it is a sticker on top of something else, do not scan it.
2. Scan with your phone's camera, but do not tap yet. Most cameras show the address first.
3. Read the domain carefully. It is the name that ends just before the first single slash, and what counts is the end of that name: usually its last two parts, or three in endings such as .co.uk. In https://citypark.gov.pay-now.example/meter, the site is pay-now.example, not a government one: anyone can put familiar words in front.
4. If the code wants payment or a login, do not use it at all. Type the official website you know, or open the official app, and do the same thing there.
5. If you are unsure, ask: staff at the restaurant, the parking operator, or the sender, on a phone number you find yourself.

With a scanning app

A scanning app can show more than the camera. Ours, SafeScan QR for Android, follows a link's redirects so you see the real destination, including where a shortened link leads, and checks it against lists of known phishing and malware sites before you open it. It is free, with an optional Pro plan.

No checker can promise that a link is safe. A page set up an hour ago may not be on any list yet, so a clean result means only that no known threat matched at the time of the scan. The habits above still apply, especially for payments.

If you already scanned the code

Opening a page is usually not harmful by itself. What matters is what you did next. If you only looked, close the page and keep your phone up to date. If you typed details, paid or installed something, act quickly, in this order:

1. Card or bank details: call your card issuer or bank on the number on the back of your card or in its official app. Ask them to block the card and dispute the payment.
2. A password: change it at once on the real site, and on every other account where you used the same password.
3. Two-step verification: turn it on for your email, bank and other important accounts, so a stolen password is not enough.
4. An app you installed: uninstall it, and check your phone's settings for apps you do not recognize.
5. Watch your statements for charges you did not make, for the next few months.
6. Report it, which helps stop the same code from catching others.

Where to report a QR code scam

• United States: report fraud to the FTC at ReportFraud.ftc.gov, and online crime to the FBI's Internet Crime Complaint Center at ic3.gov. If someone is using your personal details, go to IdentityTheft.gov for a recovery plan. Forward scam texts to 7726 (SPAM).
• United Kingdom: in England, Wales and Northern Ireland, report to Report Fraud, which replaced Action Fraud, or call 0300 123 2040. In Scotland, call Police Scotland on 101. Forward suspicious emails to report@phishing.gov.uk and scam texts to 7726.
• Canada: report to your local police and to the Canadian Anti-Fraud Centre, online or at 1-888-495-8501.
• Australia: report any scam to Scamwatch. If you lost money, contact your bank first, then report to the police through ReportCyber.
• Elsewhere: contact your national police or fraud reporting service.
• Tell whoever owns the place: the city or parking operator, the charging network, the restaurant. They can remove the sticker.

Making your own QR codes

If you print codes for a business or an event, a static code is the more trustworthy kind: the address is written into the code itself, so there is no redirect server in between that could be taken over or change where it leads. Our QR code generator makes static codes in your browser. Print the code directly on your sign or menu rather than as a loose sticker, put your web address next to it so people can type it instead, and check your codes from time to time for stickers placed on top.

Questions and answers

What is quishing?

Quishing is phishing through a QR code: a short form of QR phishing. The code leads to a fake page that collects passwords or card details, or that pushes you to install a harmful app.

Can scanning a QR code hack my phone?

Scanning only reads the code's contents. The risk starts when you open the link and then type details, pay or install something. Keeping your phone and browser updated helps protect you against pages that try to exploit old software.

How can I tell if a QR code has been tampered with?

Look for a sticker on top of a printed code, raised or peeling edges, or a code that looks out of place on an official sign. Then check the address your phone shows before you open it.

Is it safe to pay through a QR code?

Only if you can confirm the address belongs to the business you mean to pay. When in doubt, pay at the machine, at the counter or in an app you already trust.

Should I scan a QR code in an email?

Treat it like a link in an email from someone you do not know. If the message says your account needs attention, open the app or type the website yourself instead.