How to Spot a Fake QR Code Sticker (and What to Do About It)

A fake QR code sticker is a code that someone else stuck on top of a legitimate one, or a code placed where no legitimate one should be, so that your scan sends you to a site the attacker controls. You can spot most of them by checking the physical surface for signs of tampering, scanning only codes you expect to find in that location, and reading the web address your phone shows before you tap anything. If you have already scanned and entered details, act quickly: change the password on the affected account, contact your bank if you paid or shared card details, and watch for follow-up phishing attempts.

Why fake QR stickers work

QR codes are silent. A well-printed sticker looks exactly like the kind of code a business would legitimately use, and most people have been trained by years of menus, parking apps and payment posters to scan without thinking. The phone does the work, so the eye stops doing its job.

The attack itself is simple. Someone prints a code that points to a lookalike website, walks past a parking meter or a restaurant table, and sticks it over the real code. When you scan it, you land on a page that mimics the official payment site or app and asks for card details or a login. Because you initiated the scan yourself, the request feels trustworthy in a way that a random text message never does.

This is called "quishing" in security circles, but the name matters less than the mechanics: the QR code is just a link, and a link can point anywhere. Your defence is to treat every scan the way you would treat a link in an unexpected email.

Where fake codes tend to appear

Anywhere a code invites you to pay, log in or download something is a candidate. The most common targets:

• Parking meters and pay-by-phone parking signs, where a fake code can lead to a payment page that captures your card details.
• Stickers on public charging stations, bike-sharing docks and EV chargers.
• Posters and flyers for events, charities or deliveries, especially ones that ask for a deposit or a "delivery fee".
• Restaurant table codes for menus and payment.
• Parcels and delivery notes, where a fake "track your parcel" code can lead to a phishing page asking for a redelivery fee or personal details.
• ATM surrounds, ticket machines and any public terminal with a smooth, flat surface where a sticker can sit flush.

The common thread is money or credentials. A code that leads to a Wi-Fi login page is a much less attractive target than one that leads to a payment form, so focus your suspicion where the code asks you to pay or sign in.

Physical signs of tampering

Before you scan, spend three seconds looking at the code itself. You are looking for evidence that it does not belong to the surface it is on.

• Edges and corners. A sticker laid over a printed code usually shows a raised edge, a corner lifting slightly, or a faint outline where it was pressed down. Run a fingernail along the edge if the surface allows it.
• Mismatch in print quality. Official codes on a parking meter or a payment terminal are usually printed or engraved as part of the fixture. A home-printed sticker often has slightly different colours, a glossier finish, or visible pixelation around the modules.
• Alignment. If the code sits crooked, off-centre, or overlapping text that it should sit beside, treat it as suspect.
• Layering. Two codes very close together, or a sticker that covers a frame or logo that is part of the original design, is a strong sign of a cover-up.
• Wear that does not match. A code that looks brand new on a weathered, faded surface has not been there as long as the surface has.
• Adhesive residue. Smears, bubbles or old sticker ghosts around the code suggest the spot has been tampered with before.

None of these checks is foolproof on its own. A careful attacker can print a clean, well-aligned sticker. The point is that most tampering is done quickly and cheaply, and it usually shows.

Check the link before you open it

The single most useful habit in QR safety is this: your phone shows you where a code leads before you commit. Use it.

On most modern phones, scanning a QR code with the built-in camera app produces a notification or banner showing the web address. Do not tap it immediately. Read it first.

What to look for in the address:

• The domain. This is the part just before the first single slash, and it is the only part that truly matters. In https://pay.parking-example.com/checkout, the domain is parking-example.com. Everything before the first dot (pay.) and everything after the first slash (/checkout) is decoration that anyone can choose freely.
• Misspellings and lookalikes. Attackers rely on small differences: paYment-site.com instead of payment-site.com, extra letters, swapped letters, or hyphens where none belong. Read the domain letter by letter if money is involved.
• Unfamiliar shorteners. Addresses from link shorteners (typically very short domains followed by a random-looking code) hide their destination entirely. You cannot tell where they lead without resolving them, so treat shortened links from physical stickers with extra suspicion. Some shortener services show a preview page; if yours does not, do not follow the link when money or logins are involved.
• The padlock is not a guarantee. The padlock icon or "https" means the connection is encrypted, not that the site is honest. Fake phishing sites use https too. Never treat the padlock as proof of legitimacy.
• Immediate pressure. If the page the code opens demands that you log in, pay, or enter card details right now, that urgency is itself a warning sign. Legitimate parking and payment pages generally let you review what you are paying for first.

If you are unsure, type the organisation's known web address into your browser yourself instead of using the code. Thirty seconds of typing beats a compromised card.

Red flags after scanning

Some attacks only become visible once the code has opened. Stop and back out if any of the following happens:

• The page asks for your card details to pay for something you did not select, or asks for a payment before showing you what you are paying for.
• A login page appears where you expected a menu, a timetable or a price list.
• The site asks you to install an app or a configuration profile from outside your phone's official app store.
• The page asks for information no legitimate process needs at that moment: your full card PIN, your online banking password, or one-time codes from your banking app.
• The address changes several times in quick succession, hopping through redirects before landing somewhere unexpected.
• The page looks like a well-known service but the domain in the address bar does not match that service's real name.

Backing out costs you nothing. Entering details on a fake page can cost you a great deal.

What to do if you already scanned and entered details

If you realise after the fact that you used a fake page, speed matters more than embarrassment. Work through this in order:

1. If you entered card details, contact your bank immediately. Ask them to block or replace the card and report the transaction. Most banks have a 24-hour fraud line; the number is on the back of your card or on their official website, not on any page the QR code led you to.
2. If you entered a password, change it now, on the affected service and anywhere else you reused the same password. If you do not use a password manager, changing reused passwords is the moment to start.
3. If you approved a payment or a login prompt, revoke it. Check the account's security or sessions page for unknown devices and sign them out.
4. If you installed an app or a profile, remove it, then run your phone's built-in security scan if it has one. On iPhones, check Settings for configuration profiles you do not recognise; on Android, uninstall anything you cannot account for.
5. Watch for follow-up attacks. Attackers who capture your phone number or email often follow up with convincing texts and calls. Treat any message about the incident with suspicion and contact organisations through their official channels.
6. Report it. Tell the business whose code was covered over, and report the incident to your local police or national cybercrime reporting service. This helps them warn other customers and, sometimes, get the sticker removed.

Keep a record of what happened, including the address you were sent to and any payment references. You may need it for your bank or the police.

How businesses can protect their own codes

If you run a business that uses QR codes, you are defending both your customers and your own reputation. Practical measures, roughly in order of impact:

• Print the destination address next to the code. A short, readable web address under the code lets customers verify where it leads and gives them a fallback if they distrust the sticker. This is the cheapest and most effective protection available.
• Use tamper-evident labels. Security labels that tear, leave a pattern behind, or show "VOID" when peeled make cover-up stickers obvious and make tampering visibly risky.
• Mount codes so they cannot be overlaid. Engraved plates, recessed panels, or codes printed directly onto the fixture are far harder to replace than a paper sticker on a flat surface.
• Check your codes regularly. Add a quick visual check to existing routines: staff opening a restaurant verify table codes each morning, a parking operator's rounds include the meters, a shop checks its window posters. You are looking for stickers over your codes, residue, or codes that look different from the ones you deployed.
• Use a domain you control and keep it short. A short, memorable address is easier for customers to verify at a glance than a long one full of parameters.
• Avoid blind shortened links in public. If you must use a shortener, pick one that shows a preview or interstitial page so scanners can see the destination.
• Tell customers what legitimate codes look like. A small notice saying "our payment page is at [address]; we never ask for your PIN" sets the expectation that verification is normal.
• Respond fast when tampering is found. Remove the fake, clean the surface, replace with a tamper-evident version, and warn customers through your usual channels.

Building the habit

QR safety is not about paranoia; it is about one habit applied consistently: verify before you act. Look at the physical code for signs it was not placed by the business. Read the address your phone shows before tapping. Refuse pages that demand logins, payments or app installs under pressure. Type known addresses yourself when money is involved. And if you run a business, make your codes physically hard to fake and give customers a way to check them.

The technology is not the problem. A QR code is a link, and links are safe when you read where they go. The risk comes from scanning on autopilot. Break the autopilot, and most of these attacks fail at the first step.

Conclusion

Fake QR stickers succeed because they look ordinary and because scanning feels like the safe, familiar option. Your defence takes seconds: inspect the sticker for lifted edges and mismatched printing, read the web address before opening it, and never enter card details or passwords on a page you reached through a code you did not verify. If you have already been caught, contact your bank and change your passwords immediately. Businesses should print the destination address beside every public code, use tamper-evident labels, and check their codes regularly. The key takeaway: treat every QR code as a link from a stranger until you have read where it actually leads.