How to Spot and Avoid QR Code Scams
QR code scams are simple in theory, but they can do real damage once someone uses one. That innocent-looking square might send you to malware, a payment request or a convincing fake website. Criminals call it “quishing” because they count on people scanning first and asking questions later.
Key takeaways
- QR scams use an ordinary-looking code to conceal phishing pages, bogus payment requests and malware.
- Before scanning, check both the destination link and the situation, particularly on signs, emails and parcels.
- If you scanned a suspicious code, shut it down, update your passwords and check account activity straight away.
- For payments and sign-ins, use official websites and trusted apps rather than scanning without checking.
What QR code scams are, and why they work
A QR code scam is fraud where you cannot see the risky destination until after you scan the code. It might open a phishing page, a fake delivery notice, a bogus login screen or a card payment form. The FTC has warned that scammers use QR codes to hide harmful links and steal information; the danger is in the page the code opens, not in the square itself. FTC
These scams work because QR codes now feel normal: restaurant menus, parking signs, parcel slips, posters and charity notices. People see them as a quick route, so they often skip the checks they would make with a web address. Apple iPhone and Android users can both be targeted, so this is not a problem tied to one brand or operating system.
Quishing means QR code phishing. In practice, the code pretends to belong to a trusted service and pushes you to hand over login details, card information or other personal data. The University of Illinois Chicago also notes that malicious QR codes can trigger malware downloads, so the risk can go beyond a fake login page. UIC
Common QR code scam setups to look out for
- QR codes you did not ask for, sent by email or text message, particularly if the message pressures you about a missed payment, delivery or account issue
- Counterfeit stickers put on top of legitimate codes on posters, menus, parking signs, transport notices or package labels
- Offers based on a ‘free’ gift, prize, parking fine, charity appeal or refund request that urge you to scan straight away
- Codes that send you to a page requesting login details, card payment information or a file download rather than a standard service page
The United States Postal Inspection Service has warned about QR codes sent from unfamiliar email addresses or text messages that tell you to scan immediately. It has also flagged package-related scams, where a small gift arrives with a card asking the recipient to scan a code to register the present or find out who sent it. That mix of curiosity and pressure is exactly what scammers want. USPIS
How to check a QR code before you open it
- If your phone lets you, preview the destination link before opening it and examine the web address carefully. A genuine address should correspond to the brand or service you are expecting.
- Consider whether the QR code fits the setting. A code on a café table, courier label or parking notice should lead to the venue or service you are already using.
- Look out for misspellings, strange domain names, sign-in requests, demands for payment and messages pushing you to act immediately.
- When a code seems suspicious, avoid scanning it and open the official website or app directly. That small extra step cuts out most of the danger.
A useful check is to compare the destination with the official website or app you normally use. A polished logo proves very little if the web address is wrong, the wording feels off or the page asks for details the real service would not need. HTTPS only means the connection is encrypted. It does not prove the site is genuine, because scammers can use encrypted connections on fake pages as well.
What to do if you scanned a suspicious QR code
- Shut the page immediately and do not enter any more information.
- If you typed in passwords or other credentials, update them as soon as possible and enable additional account protection if the option exists.
- Review your bank and card activity for transactions you do not recognise, and speak to your bank if your payment details may have been revealed.
- Scan the device for security issues, delete any app or file you did not intend to add, and look over your recent downloads.
If you have entered credit card details or login credentials, work on the basis that someone else may already have them. Change the password on the affected account straight away, then check any other accounts where you used the same one. The faster you reduce the places that password still works, the less useful it becomes to a scammer.
Some harmful QR codes are built to do more than steal a password. UIC says they can send users to malware downloads that may track activity, extract messages or allow a device to be compromised. If your phone starts behaving oddly after you scan one, treat that as a warning sign, not bad luck. UIC
How to reduce your risk day to day
- For payments, logins and support, rely on official apps and bookmarked websites rather than scanning a code while being rushed.
- Update iOS and Android software regularly so your phone receives the newest mobile security fixes.
- Take care with codes on unexpected parcels, in car parks, on adverts, takeaway menus and charity appeals.
- See urgent wording as a red flag rather than a reason to speed up, and stop for a moment before tapping or scanning.
For South Africans who regularly use QR payments, the safest habit is to pause for a few seconds before doing anything. Ask who put the code there, whether the request makes sense in that setting, and use the official app when you need to pay, log in or get support.
In a café, taxi rank, market stall or parking area, look closely for stickers placed over existing codes. That is a common way to replace a genuine code with a fake one.
The same pattern turns up in plenty of everyday scams. The code borrows trust, urgent wording pushes people to act quickly, and the goal is usually access to money, accounts or personal data. A QR code sent out of the blue by text, or one printed on a sticker stuck over another code, should worry you more than a code in a place you already recognise.
Frequently asked questions
What is a QR Code Scam?
This scam hides an unsafe destination behind a QR code until you scan it. That destination could be a fake login page, a payment request or a malware download. The usual aim is to collect passwords, card details or other personal information, and the risk comes from the page or file that opens.
Can QR code scams affect iPhone and Android users?
Yes. Both iPhone and Android users can be targeted, so neither platform is automatically safe. The same checks apply on each: confirm where the code leads, ask whether the situation makes sense, and make sure the web address matches the service you expected.
How can I tell if a QR code is safe?
Only scan when you trust the source and the context makes sense, such as a code linked to a service you are already using. If your phone shows the destination before opening it, check the web address for odd spellings, unfamiliar domains or requests to log in or pay. If anything feels wrong, stop and go directly to the official website or app.
What should I do if I entered my details after scanning a QR code?
If you entered card or banking details, contact your bank and check your account for transactions you do not recognise. If you typed in a password, change it and turn on extra account security if it is available. It is also worth checking the device for anything you did not mean to install, because some harmful QR codes can point you towards malware.
Are QR codes on posters and menus always safe?
No. Fake stickers or swapped codes can appear on posters, menus, parking signs and package labels, so do not assume they are genuine. Only scan a code when you can clearly trust where it is displayed and who supplied it. If you are unsure, use the venue’s official website or app instead.
