Fake QR Code Scams: How to Check a QR Code Before You Scan It

🔎 Reverse Image Search

Image search techniques made simple: upload a photo or paste a URL and search 6 engines at once. 100% free, nothing stored.

📁 Upload Image 🔗 Paste URL

🖼️ Drag & drop an image, or click to browse JPG · PNG · WEBP · GIF · BMP — Max 8MB

Load

💡 Right-click any image online → "Copy image address" → paste here.

—

Dimensions: — Size: — Type: —

✕

Search this image on:

🔵 Google

🔍 Lens

🟦 Bing

🔴 Yandex

🟢 TinEye

📌 Pinterest

Select all engines 🔎 Search All Selected Engines

🔒 Your image is never stored on our servers longer than 24 hours and is never shared.

A QR code on a parking meter looks harmless. You point your phone at it, tap the link, and pay. But fake QR code scams work because you cannot read where a code leads just by looking at the pattern. A scammer only needs a cheap sticker, placed over the real code, to send you to a payment page they control.

Direct answer: A fake QR code scam, also called quishing, hides a phishing link inside a QR code — often a sticker over a real code on a meter, charger or table. Before you scan, check the sticker edge and read the link preview. Never enter card details or a password from an unexpected code; use the official app instead.

This guide shows you how to check a QR code before you scan it, where fake codes turn up, how to read the destination safely from a photograph, and what to do if you already scanned one. It is written for the UK, with the reporting routes that apply here, and every figure in it comes from the FTC, the National Cyber Security Centre (NCSC) or Action Fraud.

What Is a Fake QR Code Scam?

A fake QR code scam is a form of phishing that uses a QR code instead of a clickable link. The term most security teams use for it is quishing, short for QR-code phishing. A QR code is simply a web address stored as a picture, so a scammer can print a code that points to a convincing fake payment or sign-in page, then put that code where a genuine one should be.

The trick works for three reasons. First, you cannot read the destination by looking at the squares — the address only appears after your phone reads the code. Second, a sticker costs pennies and takes seconds to place over a real code on a meter, a sign or a payment machine. Third, people are in a hurry when they scan: they are standing at a car park meter, a charging point or a restaurant table, and the code promises to solve the task in front of them.

Scanning a code does not by itself infect your phone or steal your money. The harm comes next, when the page asks for card details, a password, a one-time code, or an app download. A legitimate business will almost never ask for those things immediately after a scan. If the page that opens wants your bank sign-in details, your email password, or permission to install software, close it. That request is the scam, whatever the code looked like.

Quishing is not only about stickers. The same trick appears in emails and text messages, where a QR code hides a phishing link that some email-security tools cannot read because it is an image, not text. The NCSC says it is seeing an increase in these email quishing attacks, and that people are more likely to scan the code on a personal phone, outside the protections of a work computer. The defence is the same in every case: check the destination and the request before you decide whether to continue.

Where Do Fake QR Code Scams Turn Up?

Fake codes appear wherever people expect to scan one and act quickly. Knowing the usual places helps you pause in exactly the right moment.

Parking meters and car parks. This is the best-known version of the scam. The US Federal Trade Commission warned in September 2026 that scammers have been covering the real QR codes on parking meters with codes of their own, and that scanning one could take you to a fake site designed to steal your money, your personal information, or both. In the UK, Action Fraud recorded nearly 800 QR-code fraud reports in the 12 months to April 2025, with victims losing £3.5 million in total, according to figures published by the Bureau of Investigative Journalism in June 2025. The NCSC says most UK QR-code fraud happens in open spaces such as stations and car parks, and often involves an element of social engineering — a person being talked into the next step, for example by a phone call pretending to be from a bank.

EV chargers. A fake code on a charging point works the same way: you expect to pay for charging, so a payment page feels normal. Check the charger’s screen or the operator’s own app first. If the code is a sticker on a charger that also has a card reader or an app you already use, use those instead.

Restaurant tables. Menus on QR codes are now normal, and the NCSC says the codes used in pubs and restaurants are probably safe to scan. The risk rises when a table code asks for more than a menu — an email address, an account, a card — or when a loose printed code has been left on a table that the restaurant did not put there. A menu should never need your password.

Parcels you did not order. The FTC warned in August 2026 about unordered parcels containing a note with a QR code, asking you to scan it to find out who sent the package or to arrange a return. The FTC says that code could lead to a phishing website designed to steal your credit card numbers, usernames or passwords. The FBI has described the same pattern and advises people not to scan QR codes from unknown origins. You are allowed to keep merchandise you did not order, so there is no need to scan anything to return it.

Emails and texts. A QR code in an unexpected message is a red flag on its own. The usual stories are a failed delivery, a problem with your account, or suspicious activity that needs an immediate password change. The FTC’s advice is direct: do not scan a QR code in an email or text message you were not expecting, especially if it urges you to act immediately. Contact the company through a number or website you already know is genuine instead.

How Can You Tell If a QR Code Is Fake Before You Scan It?

Start with the physical object. A code printed on a meter, a sign or a machine should look like part of that object. A fake code is usually a sticker, and stickers leave clues.

1. Feel the edges. Run a fingertip over the code. A raised edge, a corner that lifts, a second layer of paper, or a glossy sticker on a matt surface all suggest something has been stuck over the original.
2. Look for a code on top of a code. If you can see the corner of another printed code underneath, or the new code sits slightly crooked over an old one, do not scan it.
3. Compare it with the machine next to it. In a car park or a row of chargers, the genuine codes should all look the same — same size, same print quality, same position. One that is bigger, shinier, or in a different place is worth suspecting.
4. Check the print and branding. Blurry printing, a logo that does not match the operator, a spelling mistake in the text beside the code, or a code printed on plain paper taped to a machine are all warning signs.
5. Ask whether the request fits the place. A parking meter that asks you to download an app you have never heard of, or a restaurant code that wants your email password, is asking for something the situation does not justify.

None of these checks is proof on its own. A well-printed fake code can look perfect, and a genuine code can be worn or dirty. That is why the physical check is only the first step — the link preview is the second, and using the official app instead is the third. If anything feels wrong, skip the code entirely and pay or log in through a route you already trust.

Worked example: the parking meter that wanted card details

The example below is illustrative — the names and details are made up to show the checks in order. Sarah parks in a council car park in Manchester on a Saturday morning. The meter has a QR code sticker on its front. She runs a finger over it and feels a raised edge: the sticker lifts slightly at one corner, and beneath it she can see the edge of a printed code. She does not scan it.

Instead, she photographs the sticker. Then she opens the RingGo app she already has on her phone — the operator the car park signs name — and pays for her stay there. The payment works, and no code was needed. Before she leaves, she tells the car park attendant about the sticker so it can be removed, and she takes a photo of the meter as evidence.

Had she scanned the sticker, her phone would have shown a preview first. In this imagined case the preview reads something like ringgo-pay-secure.co.uk — close to the real operator, but with extra words added. The real operator’s address is shorter and matches the name on the car park signs. That mismatch, plus the raised sticker edge, is the whole check: two small observations, thirty seconds, no money lost. The same routine works at an EV charger or a restaurant table — inspect the object, read the preview, and fall back to the official app when either one looks wrong.

How Do You Read the Link Preview Before You Tap?

Most modern phones show you the destination before opening it. On an iPhone, the Camera app shows a small yellow notification with the address when it recognises a code. On Android, the camera or Google Lens shows a similar preview chip. The habit to build is simple: point, read, then decide. Never tap the preview without reading it.

When you read a preview, check four things:

1. Does the organisation’s real name sit in the important part of the address? In ringgo.co.uk, the name is right before the .co.uk. A fake address often hides the real name somewhere else, for example ringgo.pay-secure-example.com, where the real destination is pay-secure-example.com, not RingGo.
2. Are there misspellings, swapped letters or extra words? Look for small changes such as rnng0, payrnent, or secure-login added to a familiar name. The FTC says to inspect the URL before you open it and to check for misspellings or switched letters.
3. Is the address shortened? A shortened link hides the real destination entirely. Be wary of short links when the code is asking for payment or sign-in details, and prefer the organisation’s own app or a typed address instead.
4. Does the page match the situation? A code on a parking meter should lead to a parking payment page. If the preview points to a file download, a login page for a different service, or a page asking you to install remote-control software, close it.

A clean preview is reassuring, but it is not proof that a page is safe. Criminals can use compromised websites, legitimate hosting services and convincing addresses, so a familiar-looking link can still lead somewhere harmful. If the action matters — money, a password, an account — verify it through an independent route: the official app, or the address typed by hand.

Can You Check a QR Code by Photographing It Instead of Scanning It?

Yes — and for a code you are unsure about, a photograph is the safer way to look at it. Pointing your camera at a code and tapping the preview is already a kind of scan, but photographing it first gives you a still image you can examine without opening anything.

Here is the routine:

1. Photograph the code square-on. Stand close, fill the frame with the code, and keep the phone steady. Include the surrounding sign or meter in a second, wider photo — that context helps if you report the code later.
2. Open the photo in Google Lens. Lens can read a QR code from a saved photo and show you the link it contains, without opening the page. Read the address the same way you would read a live preview: real name in the important part, no misspellings, no unexpected shortener.
3. Compare the address with the operator’s real one. Check the name on the car park sign, the charger, or the restaurant’s own website. If the decoded address does not match, you have your answer without ever visiting the page.
4. Do not open the link from the photo. If the address looks wrong, delete the photo or keep it only as evidence for a report. Opening a suspicious page to “see what it is” adds risk for no benefit.

This photo-first method is also how you should handle a code that arrives as an image in a message or email. Save the image, then check it the same way instead of scanning it live. Our guide to scan a QR code from a photo explains the photo route in detail, and our reverse image search guide shows how to search with any saved image — useful if the same code image, or the same fake payment page, has been reported before.

One more thing: use the scanner built into your phone. The NCSC recommends using the QR scanner that comes with your phone rather than downloading a separate scanner app, and warns against installing an unfamiliar scanner just because a message or a website tells you to. A third-party scanner app is itself a way for a scammer to get software onto your phone.

What Should You Do If You Already Scanned a Fake QR Code?

First, do not panic. Scanning a code, or even opening the page it leads to, does not automatically mean someone has accessed your accounts. What matters is what happened next. Work through the situation that matches yours.

You saw the preview but did not open it. Dismiss the preview. Nothing was sent anywhere, and no account action is normally needed just because your camera recognised the code.

You opened the page but entered nothing. Close the page. Do not download anything, and do not accept requests to install an app, a configuration profile or a browser extension. Keep your phone and browser updated, and watch for anything unusual on the device afterwards.

You entered a password or a security code. Open the genuine service directly — through its app or its real website, not through any link in the message — and change the password immediately. Change it anywhere else you reused it, review recent sign-ins, and switch on two-factor authentication. If you cannot get into the account, contact the provider through its official help pages.

You entered card or bank details, or sent money. Contact your bank or card provider straight away, using its official app or the number on the back of your card. Tell the bank exactly what you entered or authorised. If money was sent, ask the bank to consider the payment under the relevant scam-reimbursement rules. Do not contact the people behind the fake site: the FTC warns that if you reach out to them, they may try to get more money or sensitive information out of you.

You installed an app or gave someone control of your phone. Disconnect the device from the internet if somebody may still have remote access, and contact your bank from another trusted device if financial accounts were used. Keep any details you may need for a report before you remove the app, and get help if you are unsure what access was granted.

If the fake page pretended to be a payment page, the same checks that catch a fake payment screenshot apply here too: a genuine payment confirmation comes from your bank or the payment app itself, not from a page a QR code opened. And if the code arrived inside a message that also included a screenshot as “proof”, treat that image with the same suspicion — our fake screenshot checker guide explains how to spot a doctored image before you trust it.

How Do You Report a Fake QR Code in the UK?

Reporting helps even when your own money is safe. A sticker on a meter can catch the next driver, and a phishing page can stay live until somebody reports it. Use the route that fits where the code appeared:

• On a parking meter, charger, sign or payment machine: tell the operator — the car park company, the charging network, or the business whose code was faked — so the sticker can be removed. Take a photo of the code and its surroundings first, and note the location and time.
• In a suspicious email: forward it to report@phishing.gov.uk, the NCSC’s reporting address. Do not click anything in the email first.
• In a suspicious text message: forward it free of charge to 7726.
• A suspicious website the code led to: report it through the NCSC’s reporting service, so it can be taken down.
• If you lost money: report it to Action Fraud at reportfraud.police.uk (in Scotland, contact Police Scotland) after you have contacted your bank. Keep the photos, the address the code led to, and any messages.

For a wider view of how photo-based scams fit together — fake profiles, doctored images, stolen photos used as bait — our photo scams guide covers the full set, including the checks that apply when a scam starts with a picture rather than a code.

The rule behind every row of that table is the same: a QR code is only a route. Check the destination and the request before deciding whether to continue. Most codes you meet are ordinary and useful — menus, tickets, sign-in pages, genuine parking payments. The few fake QR code scams among them give themselves away if you slow down for thirty seconds, look at the physical code, read the preview, and use the official app whenever money or a password is involved.

FAQs

How do I check if a QR code is safe?

Inspect the code first: feel for a sticker edge or a code over another code, and compare it with nearby machines. Then read the link preview, checking the organisation’s real name sits in the important part of the address, with no misspellings. For payment or a password, use the official app or type the real address yourself.

Is a sticker over a QR code always a scam?

Not always, but treat it as suspicious. Operators sometimes cover a damaged code with a replacement, so a sticker alone is not proof of fraud. The test is the destination: photograph the code, read the decoded address, and compare it with the operator’s real website. If it matches, the sticker is harmless; if not, do not scan it.

What should I do if I scanned a fake QR code?

Close the page and enter nothing further. If you only opened it, no account action is normally needed. If you typed a password, change it on the real service and anywhere else you reused it, then switch on two-factor authentication. If you entered card details or sent money, call your bank straight away, then report the code to Action Fraud.

How do I report a fake QR code in the UK?

Tell the operator so the sticker can be removed. Forward a suspicious email to report@phishing.gov.uk and a suspicious text to 7726, and report the website through the NCSC’s reporting service. If you lost money, report it to Action Fraud after contacting your bank, keeping photos of the code and the address it led to.