To spot a fake QR code, look at the real web address before you open it, check whether a sticker has been placed over the original code, and be suspicious of any code that rushes you to pay, log in or "verify" something. Scams that use QR codes are called "quishing" (QR phishing). A QR code itself cannot harm your phone, but the link inside it can lead to a look-alike website built to steal your passwords or card details. This guide shows you what to look for and what to do if you think you have been caught out.

What is quishing?

Phishing is a scam that tricks you into handing over personal information through a fake message or website. Quishing is the same idea, with the fake link hidden inside a QR code instead of written out in text. Scammers like QR codes for a simple reason: you cannot read a QR code with your own eyes. A link in an email can be hovered over and inspected, but a square of black and white dots gives nothing away until your phone scans it. Some email filters also look at text links more closely than images.

Where fake QR codes show up

• Stickers on top of real codes. A fraudster puts their own code over a genuine one on a parking meter, a restaurant table, an EV charger or a poster.
• Emails and text messages. A message claims a package is delayed, an account is locked, or a payment failed, and asks you to scan a code to fix it.
• Letters and flyers. Official-looking mail or leaflets, especially ones through your door or stuck on your car windshield.
• Public posters and ads. Offers that seem too good to be true, such as free gift cards or prizes.
• Fake "customer support" or survey codes. Codes that ask for personal details in exchange for a reward.

Seven warning signs

1. It is stuck on top of something else. Run your finger over the edge. If the code is a sticker, or the surface looks tampered with or uneven, do not scan it.
2. It arrives without you asking. If you did not expect a code, be doubtful, especially if it comes from a company you do not deal with.
3. It creates urgency. "Pay now," "act within 24 hours" and "your account will be closed" are classic pressure tactics.
4. The web address looks wrong. Watch for misspelled brand names, extra words, odd endings or long strings of random characters.
5. It asks for sensitive details. A site that wants your password, card number or one-time code right after a scan deserves caution.
6. It wants you to download something. A prompt to install an app or a file from a QR code is a red flag. Use your official app store instead.
7. It just feels off. Poor spelling, blurry logos and odd formatting are all signs of a fake. Trust that feeling.

How to scan a QR code more safely

You do not have to give up QR codes, just add a pause before you tap through:

1. Preview the link first. Most phone cameras show the web address at the top of the screen when you scan. Read it in full before opening it, and look at the domain, the part right before the first single slash.
2. Check the source. Ask yourself whether the code is where it should be, and whether the organization would really use a QR code for this.
3. Go to the official site yourself. If a code claims to be from your bank, a delivery company or a government service, close it and type the official address, or open their app.
4. Be careful with payments. Before paying at a meter, charger or kiosk, check that the code is part of the machine and matches the payment details shown.
5. Keep your phone updated. Updates fix security problems, so install them.
6. Use unique passwords and two-step verification. If you do slip up, these limit the damage.

A scanner that shows you where a link goes before it opens makes steps one and two easier. SafeSkan, for example, gives each scanned link a Trust Score and a preview so you can judge it first. The score is a guide to help you decide and does not replace your own judgment.

Scanning codes you already have

Sometimes a QR code arrives as a screenshot, a PDF ticket or an image in a chat. Treat it with the same caution as one on a wall. If you need to scan it, use a tool that decodes images and shows you the destination before it opens. Never scan a code from an unknown sender just to see what it does.

What to do if you scanned a fake code

• Close the page. If you only opened it and did not enter anything, you are most likely fine. Close the tab.
• If you entered a password, change it right away on the real site, and on any other site where you used the same one. Turn on two-step verification if it is available.
• If you entered card details or paid, contact your bank or card issuer straight away using the number on your card. Ask them about freezing the card and disputing the charge.
• If you installed something, remove it and consider running a security check on your phone.
• Report it. Tell the business whose code was tampered with, and report scams to the relevant consumer protection authority in your country.

Making your own codes safely

If you make QR codes for your own business, you can help customers trust them. Use a short, branded web address, put a short line of text next to the code saying where it leads, and check regularly that nobody has stuck something over it. For quick codes, the free online QR code generator from Playful Souls creates a link code in seconds.

Frequently asked questions

Can scanning a QR code hack my phone?

Scanning alone is very unlikely to do harm. The risk comes from what you do next: opening a malicious page, entering your details, or installing something. Pause before you act on what the code shows you.

Are QR codes in restaurants and parking lots safe?

Most are legitimate, but because they are public, they can be tampered with. Check for stickers placed over the original and read the web address before you pay or enter details.

How can I tell where a QR code leads without opening it?

Use a scanner that shows the full web address, or a preview, before it opens. Many phone cameras display the link first, and some dedicated scanners add a safety score.

Is it safe to scan a QR code in an email?

Be careful. If the email is unexpected or urgent, do not scan. Contact the company directly using a number or website you already know is real.