QR code security

A QR code is not dangerous in itself — it is just text written in squares. What is dangerous is that you cannot see that text in advance. This page explains how to look at it before you tap.

Fraud through QR codes

Known as quishing — phishing via a QR code. The principle is old, it has only moved from email to paper: the code leads to a page that looks like a bank, a courier or a parking meter, and asks for your login details or card number.

It works better than email phishing for two reasons. First, you cannot see the address in advance. Second, a code on a physical object feels trustworthy: what is stuck on the machine surely belongs to the machine.

Where it happens most

Parking meters. A code stuck over the original leads to a fake payment page. The most widespread variant in Europe.
EV chargers. Same principle, larger amounts.
Shared bikes and scooters. A code leading to a fake registration.
Fake invoices. A letter with a QR payment that looks like it comes from a real supplier but has a different account number.
Leaflets. "Scan and win."
Restaurant stickers. A code over the menu link leading to a page demanding prepayment.

The simplest attack is a sticker. It needs no technical skill — print your own code and stick it over the original. With outdoor machines it is worth running a finger over the code to check whether something is underneath.

How to spot a fraudulent code

Check whether it has been stuck over. Sticker edges, different paper, different colour, uneven surface.
Check that it fits its surroundings. A well-made machine with a crooked office-printed code is suspicious.
Read the address before you tap. Most phones show it. If yours does not, use a reader that does.
Never enter login details. Not even into a page that looks right. Log into your bank through its own app, not a link from a code.

Our reader never opens a link on its own. It shows the full address, highlights the domain and warns about known tricks. The decision stays with you — and that is the whole difference from a camera that immediately offers to open it.

What to look at in an address

The only part that matters is the domain — what comes before the first slash. An attacker can write the rest however they like.

Look-alike characters

A domain can use letters from another alphabet that look identical. Cyrillic а is indistinguishable from Latin a but leads elsewhere. This is a homograph attack.

Browsers often show such a domain starting with xn--. If you see that on an address that should be an ordinary company, something is wrong.

A name before the @ sign

The address https://bank.com@thief.com/login leads to thief.com, not the bank. Everything before the @ is discarded. It is an old trick that still works because people read addresses from the left.

Shorteners

A shortened link hides the real destination until you open it. On a code in a public place, a shortener is reason for caution — an honest business has no reason to hide where it leads.

Payment codes

With a QR payment your phone does not move money by itself — it opens the banking app with the details filled in. Read those details before you confirm.

Account number. Does it match the invoice?
Amount. Does it match?
Recipient. Banks often fill in the account holder's name. If it does not match, do not pay.
Reference. On an invoice this is usually the invoice number.

A fake invoice is the most expensive variant. The letter looks like it is from a real supplier, the amount matches, only the account number is different. For new suppliers and unusually large amounts, verify the account by another route — a phone number you already know, not the one on the letter.

Wi-Fi codes

A Wi-Fi code joins a network without typing the password. Convenient in a café, risky with a code of unknown origin: whoever runs the network can see where you connect and may try to divert your traffic.

Only join networks whose operator you know.
Do not do banking on someone else's network.
Remove the network afterwards so your phone does not rejoin it.

I scanned something odd

Scanning a code will not harm you by itself. Harm comes from what you do next.

If you only opened a page:

Close it and enter nothing.
Install nothing, however the page asks.

If you entered login details:

Change the password immediately — from your own device, not through the link.
Turn on two-factor authentication if you have not.
For a bank, call the customer line.

If you paid:

Contact your bank as soon as possible; a payment can sometimes still be stopped.
Report it to the police. The account number is a trail.

For businesses: protect your codes

Print the code onto the surface, not onto a sticker. A sticker can be covered; printing cannot.
Integrate the code into the artwork so that covering it is visible — a frame, a print across the edge, a brand colour.
Write the domain next to it. Then people can check that what opened matches.
Inspect physically. For outdoor equipment, make code checks part of routine maintenance.
Do not use shorteners. A hidden destination teaches customers that hidden destinations are normal.

With static codes, the content has no way out either. When you create a payment code here, the account number never reaches our server — it is computed in your browser. You can verify that in your developer tools, Network tab.

What next

For how to make codes that work, see the QR code guide.

Last updated 1 September 2026.