QR Code Safety: How to Spot a Scam Before You Scan

Why QR codes feel safe (and why scammers love that)

QR codes have become the “shortcut button” of modern life. You scan one at a restaurant to see the menu, on a poster to sign up for an event, or at a parking meter to pay without touching a screen. It feels different from clicking a random link in an email—more physical, more real-world, more trustworthy.

That sense of trust is exactly what makes QR codes attractive to scammers. A QR code is basically a picture that contains a link (or sometimes contact details, Wi‑Fi settings, or payment info). Your camera can’t “see” if the destination is honest. It just decodes what’s inside and offers to open it.

This type of fraud is often called “quishing” (QR + phishing). The trick is simple: get you to scan a code that leads to a fake website or prompts an unsafe action—like entering card details, logging into a fake sign-in page, or downloading a malicious app.

Imagine this everyday scenario: you park downtown, you’re in a hurry, and you spot a QR code sticker on the meter with the words “Pay Here.” You scan it, it looks like a payment page, you enter your card, and you move on. You only find out later that the real parking authority never received a cent—and your card details went straight to a scammer.

The goal isn’t to make you afraid of every QR code. It’s to treat them like you’d treat a link you didn’t type yourself: useful, but worth a quick safety check.

Newsletter

Never miss out on great articles — just enter your email and receive a weekly update!

Go

I have read and accept the Terms & Policy

The quick “pause-and-check” method (takes 10 seconds)

You don’t need special tools to be safer. Most of the benefit comes from one habit: pause before you tap “open.” Your phone will usually show a preview of the link (a domain like cityparking-pay.com or paypal.com) before launching the website.

Use this simple checklist whenever the QR code could cost you money, reveal your login, or install something:

• 1) Look at the physical code: Is it a sticker placed over another QR code? Is it crooked, bubbled, or obviously added later? On parking meters and kiosks, sticker-over-sticker is a big red flag.
• 2) Read the domain carefully: The domain is the core of the web address (like example.com). Scammers rely on “looks close enough” tricks like paypaI.com (capital i), paypal.account-login.com (real word buried in a longer domain), or city-payments.net.
• 3) Ask: does this match the context? A menu should go to a restaurant site or a menu page—not to a file download. A parking payment should match the city/parking operator named on the meter.
• 4) Avoid logging in from a random QR: If it asks you to “sign in to Google/Microsoft/Apple” to see a menu or pay for parking, that’s suspicious. For sensitive accounts, open your browser and type the site yourself (or use the official app).
• 5) Be wary of urgency: “Fine increases in 30 minutes,” “Last chance,” “Account will be locked”—QR scams often use panic to skip your thinking step.

A helpful analogy: scanning a QR code is like accepting a ride from someone holding a sign with a destination on it. Before you get in, you check the license plate and driver name. The QR “license plate” is the domain. If it doesn’t match what you expect, don’t ride.

Extra safe option (especially for payments): whenever possible, skip the QR entirely and use an official route:

• Parking: use the city’s official parking app (or type the operator’s web address you see printed on the meter).
• Restaurants: ask for a printed menu or search the restaurant name and open the menu from their official site/listing.
• Payments/donations: type the known organization’s website or use a verified payment handle you already trust.

Common QR scams in real life (and how they play out)

Most QR scams fall into a few repeatable storylines. Once you recognize the pattern, they’re easier to spot—even when the design looks professional.

1) The “Pay for parking” sticker swap

You walk up to a meter. There’s a QR code labeled “Pay Here.” You scan it and land on a page that looks like a city payment portal—logo, colors, everything. The catch is subtle: the domain isn’t the city or the known parking operator. You pay, it “works,” and you leave. Later you may get a real ticket because you never paid the actual system, and your card details may be compromised.

How to handle it: If there’s an app name printed on the meter (common in many cities), use the app store listing you find yourself (not via the QR). If the meter has a location number, pay by entering the number inside the official app. If you must use the QR, confirm the domain matches the operator printed on the meter, not just “a parking-sounding website.”

2) The “Delivery problem—scan to reschedule” message

You receive a text that says your package couldn’t be delivered. It includes a QR code to “choose a new time slot.” The QR leads to a page that asks for a small fee. You pay $1.99, then the scammers have your card details (or enroll you in a hidden subscription).

How to handle it: Don’t use QR codes in unexpected texts. Open the delivery company’s official app or type the tracking site yourself. If you didn’t order anything, treat it as spam.

3) The “Wi‑Fi QR” in cafés and hotels

Some places post a QR code to join Wi‑Fi quickly. That can be legitimate, but it can also be abused. A malicious Wi‑Fi QR can connect you to a network controlled by an attacker (or to a network with a deceptive name that looks official).

How to handle it: Ask staff for the exact Wi‑Fi network name. If your phone shows multiple similar networks, choose carefully. For sensitive logins (banking, work accounts), prefer your mobile data or a trusted VPN when on public Wi‑Fi.

4) The “Login to view the document” trap

A flyer at a coworking space says “Scan to get the free template.” You scan it and it opens a familiar-looking sign-in page for Google or Microsoft. You enter your email and password. The page refreshes and says “Error.” In reality, you just handed your credentials to a fake site.

How to handle it: If a QR takes you to a login prompt, stop. Open a new tab, go to the real service (by typing it or using the app), and look for the shared file or template there. For work accounts, turn on multi-factor authentication (MFA) and consider a password manager that warns about mismatched domains.

QR codes aren’t the enemy—they’re just fast. And speed is exactly what scammers try to steal from you: your time to think. A small pause, a careful glance at the domain, and a preference for official apps can keep QR codes convenient without becoming a gamble.