You’re standing in a parking lot, phone in hand, already running late. There’s a QR code stuck on the meter, so you scan it, type in your card details, and hurry off. Except that code was never the parking company’s. It was a sticker a scammer pressed over the real one minutes earlier — and your card details just went straight to him. That’s how most qr code scams work. Nobody hacks your phone. They just borrow your trust for about fifteen seconds.
It isn’t just parking meters. QR codes sit on restaurant tables, bus stops, shop windows, even “confirm your parcel” texts. The problem is built in: you can’t read one with your eyes, so you have no clue where it leads until your phone opens it. Scammers love that blind spot. Here’s how these cons run, the red flags that give them away, and what to do if you’ve scanned one already.
How QR Code Scams Actually Work
The technical name is “quishing” — QR code phishing. The code itself is harmless; it’s just a link wearing a disguise. The danger is the page waiting on the other side. Scammers print their own codes and stick them over genuine ones — on restaurant tables, parking meters, EV chargers, even fake “final notice” letters. You scan what looks like the real menu or payment page and land somewhere identical-looking, built to collect your card number and logins.
Some versions skip the fake page entirely. One scan can open your payment app to the wrong account, join your phone to a dodgy Wi-Fi network, or bounce you through three redirects before you notice. It’s the same con as phishing emails — our guide to how phishing works shows the playbook; the QR code just replaces the dodgy link.
Email is the other delivery route. Scammers send fake invoices and password-reset warnings with a QR code instead of a link, because email filters spot bad links but usually can’t see inside a QR image. Different wrapper, same destination: a page that wants your details.
QR Code Scams: Red Flags to Spot Before You Scan
You can’t read a QR code, but you can read everything around it. Look for these:
- A sticker sitting on top of another code. Run your thumb across it. If the edges lift, or the code sits on glossy paper while everything around it is printed flat, it’s been tampered with.
- No branding anywhere. Real businesses print a logo, a payment provider’s name, or at least the words “scan to pay.” A naked code on a random flyer or lamppost deserves zero trust.
- A URL preview that looks wrong. Most phones show the address before opening it. Watch for misspellings like “paypa1” instead of “paypal”, odd endings such as .xyz or .top, or a jumble of random characters.
- It asks for a login or full card details immediately. A menu code should open a menu. A parking code should ask for a small, fixed fee. If a scan suddenly wants your bank login, close the page.
- A countdown or a threat. “Pay within three minutes or you’ll be fined” is theatre. Genuine parking companies do not run countdown timers on strangers.
Context matters too: a handwritten “free gift card” sign taped to a bus shelter is not a payment system.
What to Do Before You Scan Any QR Code
Preview the link, every single time. Your phone’s camera app shows the web address before it opens — actually read it instead of tapping on autopilot. That one habit quietly kills most of these scams.
Stick to the scanner built into your phone. Third-party QR apps are a mixed bag; plenty are stuffed with ads, and a few have been caught sending users to shady pages. Your phone’s built-in camera does the job perfectly well.
Look at the code like a detective for a second. In a café, the genuine code is part of the table stand or the printed menu, not a peeling sticker added later. On a parking meter, glance at the meter next to yours — official codes look identical on every machine. And if a code asks for money, sanity-check the amount and the reason. Paying a small fee for parking is normal. Paying a “release fee” for a parcel you never ordered is a trap — the same pattern shows up in our guide to shopping online safely.
Not sure? Ask a human. It feels awkward for roughly two seconds, but staff will happily confirm whether a code is theirs — and if it isn’t, you’ve just saved the next ten customers. Still unsure? Skip the code and type the website address in yourself. Twenty extra seconds, and the scammer is out of the picture completely.
Already Scanned a Suspicious Code? Do This Now
First, breathe. If the page that opened is asking for details and you haven’t entered any, close the tab and you’re almost certainly fine. Scanning on its own rarely damages a phone — the harm starts when you hand over information, install something, or approve a download.
If you did enter a password, change it right away and switch on two-factor authentication while you’re in there. If it was your email password, treat it as urgent — email is the master key that resets nearly every other account you own. If you entered card details, call the bank, freeze the card, and watch your statements for tiny “test” charges over the next few days — scammers probe with small amounts first.
Finish with a quick clean-up: run your phone’s built-in security scan, delete anything the page pushed you to install, and clear your browser history so you don’t drift back there later. It also helps to learn the classic signs a website is unsafe, so the next fake page gets spotted in seconds instead of minutes.
Conclusion
QR codes aren’t going anywhere, and they don’t need to — the code isn’t the villain here. Qr code scams succeed because the link is invisible and we’re all in a hurry. Slow down for the URL preview, get suspicious the moment a simple scan asks for logins or money, and you’ll stay ahead of nearly every sticker, flyer and fake invoice doing the rounds.
Frequently Asked Questions
What is quishing?
Quishing is phishing carried out with a QR code instead of a link. The code sends you to a fake page built to steal your logins or card details. The code is just the delivery method — the scam is the page it opens.
Can a QR code hack my phone just by scanning it?
Very unlikely. A scan just opens a link, and modern phones show you that link first. The risk comes afterwards — entering details on the fake page, downloading an app it offers, or approving a payment.
How do I see where a QR code leads before opening it?
Point your phone’s built-in camera at it and wait — a preview of the web address appears as a small banner or notification. Read it carefully. If the domain is misspelled, unfamiliar, or looks like random characters, don’t tap it.
I scanned a fake code and entered my bank details. What now?
Call your bank immediately and freeze the card. Then change passwords on any account sharing those details, turn on two-factor authentication, and watch your statements for small unfamiliar charges over the following week.
Are QR codes on restaurant menus safe to scan?
Usually, yes — especially when the code is printed as part of the menu or table stand. Stay cautious if it’s a loose sticker, or if the “menu” page suddenly asks you to log in or pay before you’ve ordered anything.
