Scams & fraud
Can a QR code be a scam? How to scan safely
QR codes are everywhere: parking meters, restaurant tables, invoices, posters. Because they hide the web address until you scan, they’re a handy way for scammers to send you to a fake payment or sign-in page. The fix isn’t to stop scanning. It’s knowing where a code should take you.
The short version
Scan smart
- Check the code hasn’t been stuck over the original.
- Read the web address your phone shows before opening it.
- Don’t enter card details or passwords on a page a QR code opened.
- For parking and bills, use the official app or website instead.
How QR code scams work
A QR code is just a web address in picture form. Scammers use them in a few ways:
- Stickers over real codes. A fake sticker is placed on a parking meter, EV charger or poster, sending you to a look-alike payment page.
- Codes in emails. A message says you need to scan a code to read a document, set up security on your account or confirm a delivery. Moving the link to your phone helps it slip past work email filters.
- Codes in letters or flyers. A fake fine, parcel card or bill with a code to pay.
- Codes for apps. Scanning downloads an app from outside the official store, which can be malicious.
How to scan safely
Look at the code itself
In a public place, check whether the code looks like a sticker stuck over something else, or doesn’t match the rest of the signage. If it looks tampered with, don’t use it.
Read the address before you open it
Most phone cameras show the web address before opening it. Check it belongs to the organisation you expect. A council parking meter should go to the council or its known parking app, not a random domain.
Be extra careful if it asks for money or a password
If a page opened from a QR code asks for card details or a sign-in, stop and use the official app or website instead. That’s the safest way to pay for parking, bills and fines.
Treat QR codes in emails like links
If you wouldn’t click a link in that email, don’t scan its QR code either. Work sign-ins should never need a QR code from an email.
Only install apps from the official store
If a code tries to download an app directly, cancel it and search for the app in the App Store or Google Play.
Restaurant menus are usually fine
A QR code on a table that opens a menu is low risk. Be more careful if it asks you to create an account or pay before you’ve ordered anything.
If you’ve already used a fake code
- Entered card details: call your bank straight away to block the card and look for unauthorised payments.
- Entered a password: change it on the real site, and anywhere else you use it. Turn on two-step verification.
- Installed an app: delete it and get your phone checked.
- Found a fake sticker: tell the business or council that owns the meter or sign so it can be removed, and report it to Scamwatch.
For businesses using QR codes
- Check your QR codes regularly, especially outdoor ones, for stickers placed over them.
- Use your own domain in the link so customers can recognise it.
- Print the web address next to the code as an alternative.
- Never ask staff to sign in to work systems by scanning codes from emails, so they know a request like that is a scam.
Practise on fake examples
Texts, links and QR codes is a free NovaSoft Labs course with six fictional scenarios and an explanation for every answer. Pass it to print a completion certificate.
Common questions
Can scanning a QR code hack my phone?
Scanning only reads the address. The danger comes from what you do on the page it opens, or an app it tries to install.
Are QR code scanner apps safer?
Your phone’s built-in camera is usually fine and shows a preview. Some third-party scanner apps are full of ads or collect data, so there’s little reason to install one.
Sources
This guide is general information, not legal or financial advice. If you think you’ve lost money or personal information, contact your bank and the services named above straight away.
Keep reading
Related help
Talk to NovaSoft
Want a hand with this at work?
These guides are free to use. If your business wants help putting the checks, accounts and devices in place, our team can do it with you.