QR code safety: how to spot and avoid QR scams
QR codes are just links, so they can lead to fake sites like any link in an email. Scams using QR codes are sometimes called quishing. A few habits make you very hard to fool.
How QR scams work
- Stickers over real codes on parking meters, charging points and restaurant tables, leading to fake payment pages.
- Codes in emails and letters claiming a parcel, a fine or a bank problem, designed to get around email link filters.
- Codes asking for logins that copy a bank, a delivery company or your workplace.
Before you tap: five checks
- Read the address the phone shows. Does it match the business? Look for misspellings and odd domains.
- Check for stickers. A code stuck on top of another sign is a red flag, especially on payment machines.
- Be wary of urgency. 'Pay now or be fined' is a scam pattern.
- Don't enter passwords or card details on a page you reached from a code you don't trust. Open the official app or type the address yourself.
- Don't install apps from a code unless it leads to the official App Store or Google Play page.
If you've been caught
Contact your bank straight away if you entered card details, change any password you typed, and report the code to the business that owns the sign. In the US you can report fraud to the FTC; in the UK, to Action Fraud.
For businesses: make your codes trustworthy
- Use your own domain or a recognizable one, so the address people see makes sense.
- Print your web address next to the code, so people can type it instead.
- Check your public codes regularly for stickers placed on top.
- Add your logo and a clear call to action. Branded codes look intentional.
- Use dynamic codes so you can switch off a destination that's been misused.
We check every dynamic code destination against Google's lists of unsafe sites and block codes that point to phishing or malware.