Before you act on a QR code, read the link your phone shows and check that it’s the real organisation’s website, spelled correctly. Be wary of stickers placed over printed codes, codes in unexpected texts or emails, and any page that asks you to log in or enter card details after scanning. Never scan a code to receive money: payment codes only ever take money out of your account.
QR codes are convenient for a simple reason: you can’t read them. You trust that the code goes where the poster says. That’s also what makes them useful to scammers, and why “quishing” (QR phishing) has become common enough that the US Federal Trade Commission and the FBI have both issued warnings about it.
The good news is that a few habits protect you from almost all of it.
How QR scams work
A QR code just contains a link or some text. A scam code contains a link to a page made to look like something you trust: a parking payment page, a courier’s site, your bank’s login. Once you’re there, the page asks for card details, a password or a one-time code, or tries to get you to install an app.
Common scams to know
| Scam | How it looks | Warning sign |
|---|---|---|
| Parking meter stickers | A sticker on a meter or sign: “Scan to pay” | A sticker on top of the official signage; a link that isn’t the council’s or the official parking app’s site |
| Fake delivery messages | Email or text with a QR code about a missed parcel or customs fee | You weren’t expecting anything; urgency; small “fee” requested |
| Account “security” emails | “Unusual sign-in. Scan to verify your account.” | Real companies don’t ask you to scan a code from an email to log in |
| Payment code swaps | A sticker over a shop’s UPI or wallet code | The payee name shown in your app isn’t the shop’s name |
| “Scan to receive money” | A buyer on a marketplace sends a code to “pay” you | Scanning a payment code never sends money to you |
| Unexpected parcels with codes | A package you didn’t order with a code inside | Curiosity is the bait; the code leads to a data-harvesting page |
Five checks before you act
- Look at the code itself.
Is it a sticker on top of another code? Is the edge peeling or slightly misaligned? Official codes are usually printed into the sign, not stuck on later.
- Read the link before opening it.
Phone cameras show the web address before you tap. Check the domain carefully:
paybyphone.comis notpaybyphone-parking.net. Short or random-looking links deserve extra suspicion where money is involved. - Ask whether you expected it.
A code in an email or text you weren’t expecting is the biggest red flag of all.
- Don’t log in after scanning.
If a page reached through a QR code asks for a password or card number, close it and go to the official site or app directly.
- Check the payee name.
When paying a shop by UPI or another QR method, your app shows who you’re paying. If it isn’t the shop, stop.
Payment codes: the “receive money” trick
This one catches people selling things online. A “buyer” says they’ll pay, then sends a QR code and asks you to scan it to receive the money. Scanning it opens a payment request from you, and entering your PIN sends them money. The rule is simple: you never need to scan a code or enter your PIN to receive money. For shop owners, our guide to UPI QR codes for shops explains how to protect your counter code too.
If you already scanned and entered details
- Card details: call your bank using the number on the back of the card and block it.
- Password: change it immediately on the real site, plus anywhere you used the same password, and turn on two-step verification.
- UPI or wallet PIN: contact your bank or app’s support and change the PIN.
- Installed an app: uninstall it, check for unfamiliar device administrator permissions and update your phone.
- Report it: tell the parking operator, shop or company whose name was used, and your national cybercrime or fraud reporting service.
For businesses that use QR codes
- Print codes into signs and packaging rather than using stickers where possible, so a stuck-on code stands out.
- Inspect public codes (meters, tables, counters) regularly.
- Use your own domain in the link so customers can recognise it.
- Tell customers what the code should show: “Our payment page is yourshop.com/pay”.
Keep it in proportion
Most QR codes are exactly what they look like. You don’t need to stop scanning menus or tickets. Treat a QR code the way you’d treat a link in an email: fine when it comes from where you expect, worth a second look when money or passwords are involved.
Frequently asked questions
Can scanning a QR code hack my phone?
What is quishing?
How can I tell if a QR code is fake?
Do I need to scan a QR code to receive money?
Is it safe to scan QR codes at restaurants?
Check a QR code before you trust it
Upload a photo or screenshot and see the link or payment details without opening anything.
Open QR Code Reader