QR Code Safety and Scams

How QR code scams work

A QR code is just data, usually a link. Scammers use that link the same way they use links in phishing emails, and the trick is called quishing. Common versions:

• Stickers over real codes on parking meters, EV chargers and restaurant tables that lead to a fake payment page.
• Emails and letters with a QR code that asks you to “verify your account” or “pay a delivery fee”.
• Fake support or prize codes that ask you to install an app or enter your login.

Warning signs

• The code is a sticker on top of another code, or looks out of place.
• The link shown by your camera doesn’t match the company, or uses look-alike spelling (paypa1, amaz0n).
• The page asks for a password, card number or a one-time code right away.
• It pushes urgency: “pay now or your car will be towed”, “your account will be closed”.
• It asks you to install an app or a configuration profile.

How to scan QR codes safely

1. Use a trusted camera or scanner and inspect its link preview before opening it. Preview behavior varies by device; a shortened URL may not reveal the final destination.
2. Type the address yourself for payments and logins, instead of following a code.
3. Pay parking and charging fees in the official app when you can.
4. Check a suspicious code before opening it: select a photo in Scan & test to inspect the encoded content locally. A decoded URL or passing scan check does not certify the site or any redirect destination as safe.
5. Keep your phone and browser updated.

If you already scanned a malicious code

• Don’t enter any more information. Close the page.
• If you entered a password, change it on the real site and turn on two-factor authentication.
• If you entered card details, call your bank and block the card.
• Report it. In the US, report scams to the FTC at reportfraud.ftc.gov; tell the venue so they can remove fake stickers.

For businesses: make QR codes people can trust

• Link to your own domain over HTTPS, so the address people see matches your brand.
• Add your brand name and the expected destination domain beside the code. A logo alone does not prove authenticity; attackers can copy it.
• Use tamper-evident placement for public codes and check them regularly.
• Use a dynamic QR code to manage a code you control. This cannot disable a scammer’s replacement sticker or a different QR code; inspect public placements and remove tampered material.

FAQ

Safety sources and limitations

The US Federal Trade Commission explains QR phishing and replacement-code scams. Its guidance supports checking unexpected links, contacting a business through a known channel and keeping your device updated. This guide provides general precautions; QRCodeAlchemy scan checks are not a malware verdict or proof of the operator’s identity.