A fake QR code is often not obvious at a glance. The pattern can look normal. What gives it away is usually the context, the destination, or the request that follows.
This page is designed for fast scanning. Read the ten warning signs, note the practical action under each, and use them as a habit before you trust a code. For the broader topic, see QR Code Scams. If you already scanned something worrying, go to I Scanned a Scam QR Code — What Should I Do?.
The 10 warning signs
A two-minute pre-scan routine
Use this whenever a QR code appears in an unfamiliar or high-stakes situation:
Before you scan
- Was I expecting this?
- Is anyone rushing me?
- Does the code look physically tampered with?
- Does the surrounding context make sense?
- Do I have another official way to complete this task?
After you scan
- Does the website address look right?
- Is it asking for sensitive information too quickly?
- Is a payment or download unexpected?
- Would I trust this page if it had arrived as a random link?
What to do if warning signs appear
- Do not continue into logins, payments or downloads
- Verify independently using an official app or known website
- If you already interacted, follow I Scanned a Scam QR Code — What Should I Do?
- Learn the broader patterns in the QR Code Scams guide and the quishing explainer
Stop. Look. Verify.
Fake QR codes succeed when scanning feels automatic.
A short pause is often enough:
- Stop before you scan on autopilot
- Look at source, context and destination
- Verify through a channel you already trust
That habit protects you without requiring specialist cybersecurity knowledge.