How to Spot a Fake or Dangerous QR Code

By the QR Code Haven team · Updated October 27, 2026 · 5 min read

What is "quishing"?

Quishing (QR phishing) is a scam where a QR code leads you to a fake website, usually a copy of a parking app, a bank, a delivery company or a login page. The goal is to get your card details, passwords or a payment, or to make you install a malicious app.

QR codes suit scammers well. You can't see the link before scanning, the code looks the same whether it's legitimate or not, and a phone screen shows only part of the address. Email filters that block suspicious links often can't read a link hidden inside an image of a QR code.

Where fake QR codes show up

• Parking meters and EV chargers. A sticker over the real code leads to a fake payment page. This is one of the most common scams in the US, UK and Europe.
• Restaurant tables. A fake "menu" or "pay here" code over the real one.
• Letters and parcels. "Your parcel is on hold, scan to pay the customs fee", or a fake fine.
• Emails. "Your Microsoft 365 password expires today, scan to keep it." The QR image gets past email security filters.
• Posters and flyers promising prizes, discounts or free WiFi.
• Payment requests. "Scan this code to receive your money" on marketplaces. In reality the code makes you pay.

Warning signs before you scan

1. A sticker on top of another code, or a sticker that looks slightly misaligned, newer or a different size from the sign. Run your finger over it.
2. Urgency and threats: "pay within 24 hours", "account suspended", "final notice".
3. An unexpected message asking you to scan something to log in, verify or pay.
4. No branding or the wrong branding around the code on an otherwise official sign.
5. A code where you'd normally use an app. Most parking operators, banks and delivery firms tell you to use their official app.

Warning signs after you scan

Before you tap "open", look at the link your phone shows. Better still, use a scanner that shows the whole link without opening it, such as our QR code safety scanner. Watch for:

• The real domain isn't the company's. In paypal.secure-account.top, the website is secure-account.top. Everything before it can be invented. Read the address from right to left, up to the first single slash.
• Look-alike spelling: paypa1.com, micros0ft-login.com, or foreign characters that look like Latin letters (shown as xn-- in the address).
• Link shorteners such as bit.ly or tinyurl, which hide the destination. Not always malicious, but a reason for care.
• An IP address instead of a name, like http://185.23.44.12/pay.
• No https. A payment or login page without https is a red flag.
• Strange domain endings: .top, .xyz, .zip, .click and similar cheap endings show up in phishing far more often than in legitimate business use.
• Words like login, verify, account, refund or prize in an unfamiliar domain.
• A direct app download (.apk). Never install an app from a QR code; use the App Store or Google Play.

Our safety scanner checks for all of these automatically and shows a Safe / Caution / Risky verdict with reasons. It runs in your browser and never opens the link by itself.

The page itself can give it away

If you did open the link, these signs should stop you:

• It asks for card details to "verify" your identity or to pay a tiny fee.
• It asks you to log in even though you never needed to log in for this before.
• The design is slightly off: blurry logos, odd spelling, a different color scheme.
• It asks you to install an app or a "security profile".
• It pushes for speed with countdown timers.

Close the page. If you think the request might be real, open the official app or type the company's address yourself.

Safe habits

• Use official apps for parking, banking and deliveries instead of codes on signs.
• Check the link before opening it. Most phone cameras show a preview; long-press it to see more.
• Never enter passwords after scanning a public code. No legitimate poster needs your password.
• Turn on two-factor authentication for email, banking and shopping accounts. A stolen password alone then isn't enough.
• Keep your phone updated so browser protections stay current.
• When paying with UPI or other apps, check the recipient name before confirming. And remember: scanning a code is for paying, never for receiving money.

If you've scanned a fake code

1. Don't enter anything else. Close the page.
2. If you entered card details, call your bank straight away using the number on the back of your card, and block the card.
3. If you entered a password, change it immediately, and on every other site where you used it. Turn on two-factor authentication.
4. If you installed an app, uninstall it, run your phone's security scan, and consider a factory reset if it had device-admin rights.
5. Report it. Tell the business or parking operator so they can remove the sticker, and report the scam to your national fraud service (for example the FTC in the US, Action Fraud in the UK, or the cybercrime portal in India).

For businesses: protect your customers

• Brand your codes. A frame with your name and a clear call to action makes a plain sticker on top stand out. Our generator adds frames and logos for free.
• Use your own domain in the link (yourname.com/pay) so customers can check it.
• Inspect codes regularly, especially outdoors and on payment points. Tamper-evident or engraved codes are harder to cover.
• Tell customers what to expect: "Our code always opens yourname.com."

QR codes are a convenient, safe technology. The trick is the same as with any link: check where it goes before you trust it.

Frequently asked questions

Related free tools