QR codes are just a way to encode a link — the code itself can't be malicious any more than a URL can. The real risk is that a phone camera can't show you where a code leads until after you scan it, which scammers exploit by covering legitimate codes with fake ones. Here's how it works and how to avoid it.
How QR code scams actually work
The pattern is almost always the same: a scammer generates a code pointing to a phishing page or fake payment form, then places it somewhere people already expect to scan a code — a parking meter, a restaurant table, a poster, a package. The fake often sits directly on top of a real one as a sticker, so it looks completely normal until you scan it.
Where this shows up most
- Parking meters. A sticker over the official payment code, leading to a fake payment page that captures card details.
- Restaurant table tents. A menu QR replaced with one leading to a phishing site or a fake "free WiFi" login.
- Unsolicited mail or email. A QR code in place of a clickable link, used to slip past spam filters that scan for suspicious URLs in text.
- Fake delivery notices. A code claiming to reschedule a package delivery, leading to a credential-harvesting page.
How to tell if a QR code is fake
A fake QR code looks exactly like a real one, so judge the context and the destination instead. Run through this checklist before you open the link:
- Is there a sticker on top? Raised edges, a code that doesn't match the rest of the sign, or one that partly covers another are the clearest sign of a fake.
- Is the URL what you expected? Your camera's preview shows the domain. Be wary of swapped letters, odd endings, or shorteners you don't recognize.
- Does it ask you to pay or log in? A code on a parking meter, a package or a poster that goes straight to a card or password form is suspicious.
- Is it rushing you? "Pay now or get a fine" and "your package will be returned" are classic QR fraud (quishing) pressure tactics.
- Did it arrive unasked? A QR code in an unexpected email, text or letter deserves the same suspicion as a dodgy link.
If something feels off, don't scan — find the official website or app and go there yourself. If you've already entered payment details, contact your bank right away.
How to protect yourself
- Check for a sticker. Look for a code that seems to sit on top of a different one — a slightly raised edge or mismatched printing is the giveaway.
- Read the URL preview. Most phone cameras show the destination before you tap through — check it matches what you'd expect.
- Be suspicious of urgency. "Scan now or your package will be returned" is a pressure tactic, not a normal delivery notice.
- Never enter payment or login details on a page you reached via an unexpected QR code, especially in a public space.
How to make your own codes trustworthy
If you're the one putting up a QR code, the goal is to look obviously legitimate. Link to your own domain rather than an unfamiliar shortener when possible, and use a styled, branded code rather than a generic black-and-white square — it signals the code was made intentionally, not slapped together. Capy QR's editor lets you match your code's colors and logo to your brand for exactly this reason, free with no signup. Start at the QR code editor.
Build yours in the editor → free QR code generator
A styled, obviously-legitimate code
Here's the kind of branded code that doesn't look like a random sticker:
Frequently asked questions
- How can I tell if a QR code is fake?
- Look for a sticker stuck over the original code, check the URL your phone shows before you open it (an odd domain, swapped letters, an unfamiliar shortener), and be wary if the page asks for a payment, a password or personal details for no clear reason. When in doubt, don't open it — type the official address yourself.
- What is a QR code scam?
- A QR code scam (sometimes called "quishing") replaces or disguises a legitimate QR code to redirect victims to a phishing site, a fake payment page, or a malicious download — relying on the fact that people can't read a QR code's destination before scanning it.
- How do scammers place fake QR codes in public?
- The most common method is a sticker placed directly over a legitimate code — on a parking meter, a restaurant table tent, or a poster. It looks identical to the real one but points somewhere else entirely.
- How can I tell if a QR code is safe before scanning it?
- Check for a sticker placed over the original, look at the URL preview your phone shows before you tap through, and be suspicious of QR codes asking for payment or login details in unexpected places like a parking sign or unsolicited email.
- Does scanning a QR code alone infect my phone?
- No — a QR code just encodes text, most commonly a URL. Scanning it opens that link the same way tapping a link would; the risk comes from what you do after (entering credentials, downloading a file), not the scan itself.
- How do I make sure my own QR codes aren't mistaken for a scam?
- Use a reputable, transparent QR code destination — link to your own domain or a trusted redirect service, not an unfamiliar shortener. A styled, branded code (like one made with Capy QR) also looks more intentional and trustworthy than a plain black-and-white square.
Bottom line: a QR code is only as trustworthy as the link behind it — check before you tap, and style your own codes so they look intentional. Ready to make one? Open the editor or browse more QR guides.