How to Spot a QR Code Scam
A QR code scam hides a link to a fake payment or login page inside a code — stuck over a real one, printed on a flyer or sent by email — so read where a code goes before you open it, and never type a password or card number into a page a code opened.
A QR code scam is ordinary phishing with the link hidden in a picture. The code sends you to a page that looks like a car park’s payment screen, a bank login or a parcel company’s delivery form, and everything you type goes to the person who made it. Nothing about the code itself is dangerous. The danger is that you cannot read where it goes by looking at it, so people open first and check afterwards, if at all.
The version that reaches most people is the sticker. Someone prints a code, sticks it over the real one on a parking meter, an EV charger or a café table, and waits. In September 2026 the US Federal Trade Commission warned about exactly this on parking meters, and cities have been finding fake “scan to pay” stickers on their meters all year. The check is physical: a real code is usually printed onto the machine or sign, and a fake one is a sticker with an edge you can feel.
The version aimed at offices comes by email. The message says your password is expiring or a document is waiting, and instead of a link it carries a QR code, often inside a PDF attachment. Email filters check links; they have a much harder time with a picture. Scanning it moves you onto your own phone, away from the protections on a work computer. If an email could have used a link and used a code instead, treat that as the warning.
In India, the common version reverses the direction of payment. A “buyer” for something you are selling online sends a UPI QR code and says scanning it will send you the money. Scanning a UPI code always pays the person who made it, never the other way round, and the PIN you are asked for is what releases the money from your account.
The one habit that stops all of these is the same: read the link before you open it. Your phone’s camera shows a preview of the address, and the scanner on this site shows the full text of any code without opening anything, with a warning for shortened links, bare number addresses and names spelled with look-alike characters. A warning is not proof of a scam and a clean result is not proof of safety, but a real business’s code almost always goes to a domain with that business’s name in it.
Check a QR code before you trust it
- Before scanning a code in a public place, touch its edge. A sticker on top of another sticker, or a code that peels, is the most common sign of a swap.
- Scan it with a scanner that shows the link instead of opening it — your camera’s preview, or the QR code scanner on this site.
- Read the domain, the name between https:// and the next slash. It should be the name of the business in front of you, spelled exactly, not a shortened link or a string of numbers.
- If the code asks you to pay or log in, close it and go to the company’s own app or website by typing the address yourself.
- For a UPI payment, check the name your payment app shows on its own confirmation screen before you enter your PIN.
- If you did type a password or card number into a page a code opened, change the password and call your bank the same day.
Common QR code scams and how to recognise them
| Where the code appears | What the fake page wants | The tell |
|---|---|---|
| Parking meter or EV charger | Your card number | A sticker stuck over the machine’s own code |
| Email or PDF attachment | Your work or email password | A code in an email that could have held a link |
| Flyer, parcel note or letter | Card details or a delivery fee | A delivery or prize you were not expecting |
| A chat message from a buyer | Your UPI PIN | A claim that scanning sends you money |
| Restaurant table or shop counter | The payment meant for the shop | A payee name that is not the shop’s |
Frequently asked questions
Can scanning a QR code hack my phone?
Scanning alone almost never can. A QR code only holds text, and reading it does nothing until you open what it points to. The harm comes after: a page that asks for a password or card number, or one that pushes you to install an app. Keep your phone updated and the small remaining risk shrinks further.
How can I tell if a QR code is safe?
Read the link before you open it. A safe code for a car park, restaurant or shop goes to a domain with that business’s name in it. A shortened link, a bare number address, or a name with a swapped letter is a reason to stop and go to the company’s website yourself.
Why do scammers use QR codes instead of links?
Because a code hides the address. You can hover over a link in an email and see where it goes, and an email filter can check it too, but a picture of a code gets past both. It also moves you from a work computer to your own phone, which has less protection.
Will scanning a QR code send me money?
No. Scanning a UPI or payment code always sets up a payment from you to whoever made the code. If a buyer or a stranger sends you a code and says scanning it will pay you, it is a scam — and entering your UPI PIN is the moment money leaves your account.
I scanned a fake QR code. What should I do?
If you only opened the page, close it: nothing has been taken. If you typed a password, change it on the real site and turn on two-step login. If you entered card or bank details or a UPI PIN, call your bank straight away. In India, report it on 1930 or cybercrime.gov.in; in the US, at ReportFraud.ftc.gov.
How do I stop someone sticking a fake code over mine?
Look at your printed codes every morning, print your shop name or website next to each one so customers can compare, and put codes behind glass or laminate where you can. A scanner that shows the link makes the daily check take a few seconds.
Related tools
Last updated .