Fake QR Codes: Are QR Codes Safe? 9 Scam Warning Signs
Would you notice if the QR code on a parking meter had been swapped overnight? Most people wouldn’t. In January 2022, Austin, Texas found fake QR code stickers on about 29 of its city parking pay stations. The city doesn’t even take payments by QR code.
I’m Bhargav, founder of linkutm. We generate QR codes for marketers every day, so a fake QR code is a direct attack on what my customers print. This week I ran two tests on fake codes. One shows why you can’t spot a fake by looking at its pattern. The other shows what a sticker over a real code actually does to your scan.
Here’s the short answer: QR codes themselves are safe. The code is just data. The danger is where it sends you and what it asks you to do next.
| Situation | Risk | What to do |
|---|---|---|
| Code printed into a menu, product, or poster you trust | Low | Scan, read the link preview, continue |
| Sticker on a parking meter, EV charger, or ticket machine | High | Use the official app or the machine itself |
| Code in an email, PDF, or text you didn’t expect | High | Don’t scan. Go to the site directly |
| Code on an unsolicited letter or package | High | Don’t scan. The FBI warns about exactly this |
| Code that asks you to install an app | High | Install only from the official app store |
| Code that joins Wi-Fi or opens a payment | Medium | Check the network name or payee first |
What Is a Fake QR Code?
A fake QR code (also called a malicious QR code) is a QR code that sends you somewhere its owner never intended. It usually leads to a phishing page, a fake payment form, or a malicious app download. Using QR codes this way has its own name: quishing, short for QR phishing.
Fake codes come in three forms:
- Sticker overlays. A printed sticker placed on top of a genuine code. This is the classic parking meter scam.
- Fake printed material. A whole flyer, letter, or parking notice made by the scammer.
- Digital codes. A code inside an email, PDF, or text message. These dodge email filters because the link is an image, not text.
Here’s the thing: a fake QR code is a real QR code. It follows the same standard and scans the same way. Nothing about the code itself is “fake”. Only the intent is.
Limitation: “fake” is a judgment you can only make after reading where the code points. No scanner can tell you who printed it.Are QR Codes Safe to Scan?
Is it safe to scan a QR code? Yes, scanning is safe in itself. A QR code stores text, usually a URL, and your camera only decodes that text. The risk starts when you open the link, type a password, approve a payment, or install something.
The FBI said this plainly in its January 2022 warning. Criminals “tamper with both digital and physical QR codes” to steal logins and redirect payments. Its advice was to check the URL after scanning and to be careful entering login or payment details.
One myth needs to die here. Many guides say “check for HTTPS” as if it proves safety. It doesn’t. HTTPS (the padlock) means the connection to that domain is encrypted. A scam domain can get a free certificate in minutes. So a padlock on cityparkinq.example only proves you’re talking privately to the scammer.
Real talk: I’d rather you read the domain name than look for the padlock.
Limitation: “safe to scan” assumes a normal phone camera. Third-party scanner apps add their own risk. I covered which ones to trust in my guide to QR code scanner apps.Can You Spot a Fake QR Code by Looking at It?
No. You can’t tell a fake QR code from a real one by its pattern. I tested this.
I encoded a genuine parking URL, https://pay.cityparking.example/zone/4127. Then I encoded a lookalike with one letter changed: cityparkinq (a “q” instead of a “g”). Both codes came out the same size (Version 3, 29 by 29 modules). A module is one black or white square in the code.
The result: 314 of 841 modules were different (37.3%). I then encoded a completely unrelated domain, quickpay-parking.example. That one differed by 36.4%.
So a one-letter fake looks just as different from the real code as a totally different website. QR codes scramble their data with error correction and a mask pattern, so similar URLs don’t produce similar pictures. Every QR code looks like random noise to a human.
Okay, so what does this mean for you? Comparing patterns is pointless. The only thing worth checking is the decoded URL your phone shows you.
Limitation: this was a digital test with fictional.example domains, built with Segno 1.6.6. Your exact percentages will vary by URL, but the point holds for any URL.
9 Warning Signs of a Fake QR Code
Here’s how to spot a fake QR code. These are the signs I check, from the physical code to the page it opens.
1. The code is a sticker
A code printed directly onto a sign, menu, or meter is hard to replace. A sticker is easy. Run a finger over it. Raised edges, bubbles, or a slightly different white are red flags.
2. You can see a second code, or edges of one
Look around and under the code. If you can see parts of another code’s corner squares, someone has covered the original. I’ll show why that matters in the sticker test below.
3. The code appeared where you didn’t expect one
Parking meters, ticket machines, and EV chargers often don’t use QR payments at all. Austin officials said the city doesn’t accept parking payments by QR code. If you’ve paid at that machine before without a code, be suspicious of a new one.
4. It arrived in an email, PDF, or letter you weren’t expecting
Unexpected codes in messages are the most common quishing route. Microsoft’s Q1 2026 email report counted QR phishing rising from 7.6 million attacks in January to 18.7 million in March, a 146% jump. Most of them were hidden in PDF attachments.
5. It came in a package you didn’t order
The FBI’s July 2025 alert describes unsolicited packages containing a QR code and no sender details. It’s a twist on the brushing scam, where sellers mail unordered items. The FBI’s advice: “Do not scan QR codes from unknown origins.”
6. The link preview shows the wrong domain
Your camera shows a link preview before opening anything. Find the root domain: the part just before the first single slash. parking.cityofaustin.example.co belongs to example.co, not the city. Watch for swapped letters like rn for m or 0 for o.
7. The preview shows a short link you don’t recognise
A short link hides the final destination. Legit businesses use them too, so this isn’t proof of fraud. But it means the preview can’t tell you where you’ll land. Expand it first with a URL shortener preview tool.
8. The page rushes you
Fake parking pages often show a countdown, a “fine pending” banner, or a discount that expires in minutes. Urgency is there to stop you checking things.
9. It asks for more than the task needs
A parking payment doesn’t need your bank login. A menu doesn’t need an app install. UK reporting on car park scams describes victims being signed up to bogus subscriptions that kept charging them. If the ask seems bigger than the job, stop.
Limitation: a skilled scammer can pass most of these checks. Signs 3, 4, and 5 (context) catch more fakes than any visual check.What a Sticker Over a Real QR Code Actually Does
Why does a small sticker work so well? I expected the original code to fight back. QR codes have error correction that can recover from up to 30% damage at the highest level. My test codes used level M (about 15%), the common default.
So I rendered a genuine code, placed a fake “sticker” code on top at different sizes, and decoded each scene with zxing-cpp 3.1.1 and OpenCV 5.0.0.
| Sticker placement | zxing-cpp read | OpenCV read |
|---|---|---|
| Covers 100% | Fake only | Fake only |
| Covers 100%, 10% off-centre | Fake only | Fake only |
| 80% as wide, centred | Fake only | Fake only |
| 60% as wide, centred | Fake only | Fake only |
| 60% as wide, in a corner | Fake only | Nothing |
| Fake placed beside the genuine code | Both | Both (single-code mode: fake) |
A sticker just 60% as wide as the real code was enough. The original never decoded. Error correction couldn’t save it because the sticker’s white border wiped out the centre and broke the finder patterns, the three corner squares a scanner uses to locate a code.
Look closely at the 60% scene, though. The genuine code’s outer corners are still visible around the sticker. That “code inside a code” look is warning sign number 2.
The side-by-side case is the sneaky one. Both decoders found both codes. OpenCV’s single-code mode returned the fake. With two codes in frame, you can’t be sure which one your phone opens.
Limitation: these were clean digital renders, not phone photos of real stickers. I didn’t test which code an iPhone or Android camera picks when two are visible, so I’m not claiming it.It’s Not Always a Link: What Else a Fake QR Code Can Do
Most guides assume a QR code is a URL. It isn’t always. The payload type decides what your phone offers to do. These formats are documented in the ZXing barcode contents reference, the open-source library behind many scanners.
| Payload | Example start | What a fake one can do |
|---|---|---|
| Web link | https:// |
Phishing page, fake payment form, malware download |
| Wi-Fi | WIFI:T:WPA;S: |
Join a network the scammer controls |
| SMS | sms: |
Pre-fill a text to a number that charges you |
| Phone | tel: |
Start a call to a premium or scam number |
| Contact | BEGIN:VCARD |
Save a fake “bank fraud team” number to your contacts |
| Calendar | BEGIN:VEVENT |
Add an event carrying a scam link |
| Payment | upi://pay or an EMV string |
Send money to the scammer’s account |
The contact one worries me most. A fake vCard can save a scammer’s number under a trusted name. When they call later, your phone shows “Bank Support”.
Your phone still asks before it joins, sends, calls, or saves anything. Read that prompt as carefully as a URL.
Limitation: prompts differ by phone, OS version, and scanner app. I haven’t listed per-device wording because it changes between updates.Real Fake QR Code Scams (2022 to 2026)
These cases come from police, national cyber agencies, and investigative reporting. Each one used a different route.
| Year | Where | What happened | Source |
|---|---|---|---|
| 2022 | Austin, Texas | Fake stickers on about 29 parking pay stations led to a fake “Quick Pay Parking” site | FOX 7 Austin |
| 2024 | Switzerland | Fake MeteoSwiss letters with a QR code installed Coper (Octo2) Android malware posing as the AlertSwiss app | Swiss NCSC |
| 2024 to 2025 | United Kingdom | 784 quishing reports and nearly £3.5 million lost in 12 months, mostly in car parks | TBIJ, citing Action Fraud |
| 2025 | United States | Unsolicited packages carrying QR codes to steal data or install malware | FBI IC3 |
| 2026 | Global email | QR phishing grew 146% from January to March | Microsoft |
The Swiss case is the one I’d show anyone who says “it’s just a link”. The NCSC says the malware tried to steal login data from more than 383 apps, including banking apps. It was installed outside the official app store, a step called sideloading.
Limitation: reported cases undercount real ones. Many victims never report a £5 parking loss.How to Check a QR Code Before You Scan It
Most advice tells you how to scan safely. This is about checking the code before you trust it. It takes under 30 seconds.
- Ask whether a code belongs here. Think about whether this place, letter, or email normally uses QR codes. If not, use the official app or website instead.
- Touch and inspect the code. Feel for a sticker edge and look for a second code, or corner squares peeking out underneath.
- Scan, but don’t tap yet. Let the camera decode the code and stop at the preview or prompt.
- Read the domain or prompt in full. Find the root domain and check every letter. For non-link codes, check the network name, phone number, or payee.
- Expand short links first. If the preview shows a short domain you don’t know, check where it goes before opening it.
- Do sensitive tasks the long way. For payments, logins, and app installs, open the official app or type the address yourself.
For the scanning side (which camera or app to use on each phone), see how to scan a QR code. If the code is in a screenshot, you can scan a QR code from an image without pointing your camera at anything.
Limitation: step 6 adds friction. For a coffee shop menu it’s overkill. I save it for anything involving money, passwords, or installs.Scanned a Fake QR Code? Do This Next
Act on what you did after the scan, not on the scan itself. Opening a page and closing it straight away is usually harmless.
- You paid. Call your bank or card issuer now and dispute the charge. Note the time, place, and amount.
- You entered a password. Change it on the real site, and anywhere else you reused it. Turn on two-factor authentication.
- You installed an app. Uninstall it. On Android, run Play Protect and check Settings for any device admin access you didn’t grant.
- You joined a Wi-Fi network. Forget the network in your settings.
- You got a parking fine after paying a fake site. Contest it with the council or city and include your payment record. KXAN reported Austin advising exactly that.
- Report it. In the US, report to the FBI at ic3.gov and to the FTC at reportfraud.ftc.gov. Tell the business or council so they can remove the sticker.
My guide on how to tell if a link is safe covers the general steps after clicking a suspicious link.
Limitation: banks treat payments you authorised yourself differently from card theft. Recovery isn’t guaranteed, and the FBI says so too.If You Print QR Codes, Make Fakes Easy to Spot
Why should marketers care? Because a sticker on your poster steals your customers and your scan data. Here’s what we tell linkutm customers.
- Print a readable URL under the code. For example,
go.yourbrand.com/menu. People can type it instead, and a fake sticker won’t match it. - Use your own domain in the code. A branded QR code on a custom domain shows your brand in the preview. A fake has to use a different domain.
- Make the code hard to cover. Print it into the material, put it behind glass, or show it on a screen.
- Don’t use your codes as redirect hops. An open redirect on your site lets scammers borrow your domain in their previews.
- Watch scans per placement. A dynamic QR code records every scan. If one meter or table drops to near-zero scans while others hold steady, go and look at it. A sticker diverts scans away from you.
That last point is the one most businesses miss. Your QR code analytics double as a tamper alarm. With linkutm QR codes, each placement gets its own code, so a drop at one location stands out.
Limitation: scan drops only show up where volume is steady. A code that gets three scans a week is too noisy to flag tampering. Physical checks still matter.Frequently Asked Questions
Can a QR code hack your phone just by scanning it?
Not on its own. A QR code holds text, and your camera only decodes it. Harm comes from what you do next: opening a malicious page, entering details, approving a payment, or installing an app. Keep your phone updated and decline unexpected downloads.Can a QR code contain a virus?
A QR code can’t contain a working virus, because it only holds a small amount of text. It can, however, link to a malicious app or download. The 2024 MeteoSwiss letters in Switzerland used exactly that trick to install Android malware.How can you tell if a QR code is fake?
You can’t tell from the pattern, because even a one-letter change alters about a third of the modules. Check the context instead: is it a sticker, did you expect it, and does the decoded domain match the organisation? Treat any code that rushes you or asks for a login as suspect.Is it safe to pay a parking meter with a QR code?
Only if the operator officially uses QR payments and the code is printed, not stuck on. Car parks are the most common place for fake codes in the UK, according to Action Fraud. Paying through the operator’s official app or the machine itself is safer.Is a QR code safe if the link shows HTTPS?
No. HTTPS only means the connection is encrypted. Scam sites get certificates too. Check the domain name in the preview, not the padlock.Are static QR codes safer than dynamic QR codes?
Neither type is safer for the person scanning. A static QR code points straight to its URL. A dynamic one goes through a redirect the owner can change. A sticker replaces either kind equally well. For the business, dynamic codes help because their scan data can reveal tampering.The Bottom Line on Fake QR Codes
QR code safety comes down to one habit: trust the destination, not the square. A fake QR code works because people skip that step.
- You can’t spot a fake by its pattern. Read the decoded domain or prompt.
- A sticker only 60% the size of a real code fully replaced it in my test.
- Context catches most fakes: stickers, unexpected messages, and unsolicited packages.
- Not every fake is a link. Wi-Fi, contact, SMS, and payment codes carry their own risks.
- If you print codes, add a readable URL, use your own domain, and watch scans per placement.
If you publish QR codes for your business, put them on your own domain and track every placement with linkutm QR codes. Fakes become easier to spot, for your customers and for you.
