Back

Safety

How to Spot a Fake QR Code (Quishing) Before You Scan

By the QR Code Scan Kit team at BUILDLANESFirst published 4 min read

Short answer

Scanning a QR code is harmless; opening the link is where the risk is. Be suspicious of stickers on top of codes, codes in unexpected emails or texts, and any code that asks you to log in or pay. Read the full web address before you open it, and when money is involved, type the official address yourself instead.

Quick steps 3

  1. 01

    Look at the code itself

    Is it a sticker on top of another code, on a meter, charger, poster or table? Is it in an email or text you didn't expect?

  2. 02

    Read the full address

    Find the real site name: the last two parts of the name before the first single slash (pay-meter.net in parkcity.com.pay-meter.net). Check every letter.

  3. 03

    Don't log in or pay from a scanned link

    Go to the official website or app yourself, or pay at the machine or counter.

A QR code is just a link you can’t read. That’s what makes it useful, and it’s also why scammers like it. Swap one sticker, and everyone who scans it lands on a page the scammer controls.

There’s a name for it: quishing, short for QR phishing. The good news is that a fake code nearly always leaves clues, and you only need a few seconds to check.

Where fake QR codes show up

The FBI warned back in 2022 that criminals tamper with both printed and digital QR codes to send people to sites that steal login and payment details (FBI public service announcement). The usual places:

  • Parking meters and pay stations. A sticker over the real code leads to a fake payment page.
  • EV chargers, bike and scooter rentals. Same trick: a “pay here” sticker.
  • Emails and texts. “Scan to verify your account”, “your parcel is held”, “re-activate two-step login”. A code in an email gets past filters that check normal links.
  • Delivery cards and fake parking tickets left on doors and windscreens.
  • Restaurant tables and posters, where a code for the menu is swapped for one to a “payment” page.

The warning signs

Before you scan

  • A sticker on top of another code, or a code that looks newer, peeling or crooked compared with the rest of the sign.
  • A code you weren’t expecting, especially in an email or text that pushes you to act fast. The FTC’s advice is not to scan those at all and to contact the company through a website or number you already know (FTC consumer alert).
  • A code that asks for money or a login where you’d normally pay at a machine or in an official app.

After you scan, before you open

Look at the full web address. Most of the tricks are visible if you read it slowly:

  • Find the real site name. Take the name between https:// and the next /, and read it from the right: the last two parts are the site (three for addresses like .co.uk). In https://parkcity.com.pay-meter.net/login, the site is pay-meter.net, not parkcity.com.
  • Look-alike letters. rn instead of m, a zero instead of an o, or letters from another alphabet that look the same.
  • Extra words. city-parking-payments-secure.com is not your city’s website.
  • Short links (bit.ly and the like) hide where you’ll end up. That’s not always a scam, but on a parking meter it’s a red flag.
  • An @ in the address. Everything before the @ is ignored by the browser; the real destination comes after it.
  • A bare number like http://185.23.4.11/ instead of a name.
  • A file download, especially an app installer. The FBI advises against downloading apps from QR codes.

What to do instead

  • Pay at the machine, counter or official app. If a meter has a QR code, check the city’s or operator’s official app or website first.
  • Type the address yourself for anything involving a login or money.
  • Never enter a password, card number or one-time code on a page you reached by scanning a code in an email.
  • Check with the sender. If a friend or a business sends you a code, confirm it another way.

If you already opened it

  1. If you typed a card number, call your bank using the number on the back of your card.
  2. If you typed a password, change it on the real site and turn on two-step login.
  3. If you installed anything, delete it and run your phone’s updates.
  4. Report it. In the US: the FBI’s IC3 and the FTC at ReportFraud.ftc.gov. Tell the parking operator or business too, so they can remove the sticker.

Let a scanner do the first check

The checks above are easy to forget in the rain at a parking meter. A good scanner shows the full address before anything opens.

QR Code Scan Kit shows the real address of every link first, and warns you about the tricks above: look-alike letters, hidden redirects, the @ trick, bare number addresses and installer files. It never calls a link “safe”, because no app can know that for sure. Link warnings are free.

On a computer, you can paste a link or drop a picture of the code into our QR code scam checker to see the same facts.

Sources

Questions

Can you get hacked just by scanning a QR code?

Scanning only reads text, usually a web address. The danger comes after: opening a fake site and typing a password or card number, or installing an app from the link. Don't install apps from QR codes, and keep your phone updated.

What is quishing?

Quishing is phishing with a QR code. Instead of a link you can hover over, the scammer hides the address in a code, often in an email ("scan to keep your account active") or a sticker in a public place.

How can I check if a QR code is safe?

No tool can promise a link is safe. What you can do is see the full address before opening it and look for warning signs: a misspelled name, extra words, a short link that hides the destination, or a raw number instead of a name. A scanner that shows the real address and flags these signs helps.

What should I do if I paid through a fake QR code?

Call your bank or card provider straight away using the number on your card, change any password you typed on the fake site, and report it. In the US, report it to the FBI at ic3.gov and the FTC at ReportFraud.ftc.gov.

  • QR code scams
  • Quishing
  • Phishing
  • Safety

Related guides

More plain guides on the same kind of job. All guides

Try it

Free tools for this guide. They run in your browser and nothing is uploaded. All tools

Email copied