QR code safety: how to spot fake and malicious QR codes

QR codes are useful precisely because they hide a long address behind a simple pattern — and that is also the one thing to be careful about. You cannot tell by looking at a code where it leads. Most codes you meet are perfectly harmless: menus, Wi-Fi logins, event pages, product manuals. But a code can also be printed, stuck over a genuine one, or sent in a message by someone who wants you on a fake login page. This practice has a name — quishing, phishing through a QR code — and defending against it is mostly a matter of one habit and a few warning signs.

The one habit: read the preview before you tap

When you scan a code, your phone does not immediately open the destination. It shows you a preview first — the address, or the action it is about to take. That preview is your safety check, and it costs two seconds. Read it. Does the address match what the code promised? A code on a restaurant table should point at something plausibly connected to that restaurant, not at an unrelated short link or a generic file-sharing page. A code in an email from your bank should point at your bank's real address, not a close misspelling of it. If the preview and the promise do not line up, do not tap — just close the camera and move on.

The same applies to non-link codes. A Wi-Fi code should name a network you recognise and expect. If a code in a public place suddenly asks your phone to do something you did not expect — open an app store page, start a download, or dial a number — treat that surprise as a warning in itself.

Warning signs worth knowing

• A sticker over another code. A code that looks pasted on top of a printed sign, a parking meter, or a poster deserves suspicion, because replacing a genuine code with a fake one is one of the simplest tricks. If the code looks like an afterthought, check with staff or find the official sign instead.
• Urgency and threats. Messages warning that your account will be closed, a parcel will be returned, or a fine will double unless you scan immediately are designed to rush you past the preview check. Genuine services rarely demand instant action through a code in a random message.
• Unexpected codes in messages. A QR code arriving by email or text from a sender you were not expecting — especially one asking you to log in or pay — should be treated like any unexpected link: verify through the official app or website instead, by typing the address yourself.
• Lookalike addresses. Fake pages often use addresses that resemble a real brand with a small change: an extra letter, a swapped character, or a different ending. Reading the preview slowly, rather than at a glance, catches most of these.
• Login pages that feel off. If a scanned link lands on a login page, ask whether you expected to log in at all. A menu, a timetable, or a product page should not need your password. Never enter a password on a page you reached through a code you did not fully trust.

If you already scanned a suspicious code

First, do not panic, and work out how far you went. If you only scanned and looked at the preview without tapping, nothing happened — your phone did not send anything or install anything by scanning alone. Close the preview and you are done. If you tapped through but entered nothing, close the page; avoid downloading anything it offered. If you entered a password, change that password immediately, ideally from the real site or app reached by typing its address yourself, and check the account's recent activity. If you entered payment details, contact your bank or card provider promptly and tell them what happened — they deal with this regularly and can watch or replace the card. If you downloaded and installed an app the page pushed at you, remove it and consider running your phone's built-in security scan.

For businesses: protect your own codes

If you print QR codes for customers, their trust is your problem too. Print codes directly into your signage rather than as loose stickers where possible, place them where staff can see them, and check them regularly — a quick scan once a week catches a tampered code before many customers meet it. Adding a short line of text under the code ("Scan for our menu") also helps customers notice when a preview points somewhere unrelated. And if you create codes with a tool like the QRGen generator, remember that a static code's destination is fixed in the pattern itself: nobody can quietly re-point it later, because there is no redirect to hijack.

Frequently asked questions

Make codes your customers can trust: create a static QR code free →