A fake QR code is often not obvious at a glance. The pattern can look normal. What gives it away is usually the context, the destination, or the request that follows.
This page is designed for fast scanning. Read the ten warning signs, note the practical action under each, and use them as a habit before you trust a code. For the broader topic, see QR Code Scams. If you already scanned something worrying, go to I Scanned a Scam QR Code — What Should I Do?.
The 10 warning signs
You weren't expecting the QR code
Unexpected codes in emails, texts, letters or public places deserve extra caution — especially when they arrive with an urgent story. Surprise is one of the most reliable early signals in quishing attempts.
What to do: Ask why this code is appearing now. If the request is unexpected, verify through an official channel before scanning.
You're being rushed
Scammers rely on pressure: fines, locked accounts, missed deliveries, limited-time payments. Urgency is designed to stop you thinking.
What to do: Slow down. Real organisations can usually wait while you check through an official app or known website.
It looks like a sticker
A common physical tactic is placing a fraudulent sticker over a genuine printed QR code on parking signs, posters or payment points.
What to do: Inspect the surface. If a code looks layered, newer, shinier or poorly aligned with the original print, do not trust it.
The destination looks wrong
The QR code is only a pointer. If the destination does not match the organisation you expected, stop.
What to do: Check the URL preview when your device shows one. Look for odd spellings, unfamiliar domains or unexpected redirects. When unsure, type the official address yourself.
You're asked for sensitive information
Legitimate processes rarely begin with a surprise scan that immediately demands high-value secrets.
What to do: Do not enter passwords, one-time codes, card details or identity documents on a page reached from an unexpected QR code.
You're asked for an unexpected payment
Parking top-ups, postage fees, invoice settlements and “account reactivation” charges are frequently mimicked. Unexpected payment demand after a scan is a major red flag.
What to do: Confirm the payment request in an official app, account portal or published contact channel before paying.
The branding looks convincing — but something feels off
Professional-looking design does not equal authenticity. Lookalike branding is a core phishing technique.
What to do: Trust the uneasy detail: wrong colours, low-quality logos, awkward language, or a layout that does not match the real service.
You're told to download something
Unexpected downloads after a scan increase risk. Treat them as a reason to stop and verify.
What to do: Do not install apps or open files solely because a QR code told you to. Prefer official app stores and known websites.
The QR code doesn't match its surroundings
Examples include a fresh sticker on weathered signage, a generic code on branded packaging, or a payment code in a context that never previously required scanning.
What to do: Check whether the code fits the place, material and organisation around it. A mismatched or temporary-looking code in a permanent setting is suspicious.
The story doesn't make sense
Ask: Would this organisation contact me this way? Would they need this information now? Would they only accept a scan under pressure? If the story is shaky, treat the code as untrusted.
What to do: If the explanation falls apart when you re-read it, walk away and verify independently.
A two-minute pre-scan routine
Use this whenever a QR code appears in an unfamiliar or high-stakes situation:
Before you scan
After you scan
What to do if warning signs appear
- Do not continue into logins, payments or downloads
- Verify independently using an official app or known website
- If you already interacted, follow I Scanned a Scam QR Code — What Should I Do?
- Learn the broader patterns in the QR Code Scams guide and the quishing explainer
Stop. Look. Verify.
Fake QR codes succeed when scanning feels automatic.
A short pause is often enough:
- Stop before you scan on autopilot
- Look at source, context and destination
- Verify through a channel you already trust
That habit protects you without requiring specialist cybersecurity knowledge.
Related guides
QR Code Scams: How They Work, Warning Signs & What to Do
Learn how QR code scams work, the warning signs to look for, how quishing works and what to do if you've scanned a suspicious QR code.
What Is Quishing? QR Code Phishing Explained
What is quishing? Learn how QR-code phishing works, where scammers use it and how to recognise and avoid QR-code phishing attacks.
I Scanned a Scam QR Code — What Should I Do?
Scanned a suspicious QR code? Learn what to do if you entered a password, shared payment details, downloaded something or made a payment.
QRaware provides educational information about QR-code scams and online fraud. It is not a substitute for professional cybersecurity, financial or legal advice.