QR codes are just a way to encode a link — the code itself can't be malicious any more than a URL can. The real risk is that a phone camera can't show you where a code leads until after you scan it, which scammers exploit by covering legitimate codes with fake ones. Here's how it works and how to avoid it.
How QR code scams actually work
The pattern is almost always the same: a scammer generates a code pointing to a phishing page or fake payment form, then places it somewhere people already expect to scan a code — a parking meter, a restaurant table, a poster, a package. The fake often sits directly on top of a real one as a sticker, so it looks completely normal until you scan it.
Where this shows up most
- Parking meters. A sticker over the official payment code, leading to a fake payment page that captures card details.
- Restaurant table tents. A menu QR replaced with one leading to a phishing site or a fake "free WiFi" login.
- Unsolicited mail or email. A QR code in place of a clickable link, used to slip past spam filters that scan for suspicious URLs in text.
- Fake delivery notices. A code claiming to reschedule a package delivery, leading to a credential-harvesting page.
How to protect yourself
- Check for a sticker. Look for a code that seems to sit on top of a different one — a slightly raised edge or mismatched printing is the giveaway.
- Read the URL preview. Most phone cameras show the destination before you tap through — check it matches what you'd expect.
- Be suspicious of urgency. "Scan now or your package will be returned" is a pressure tactic, not a normal delivery notice.
- Never enter payment or login details on a page you reached via an unexpected QR code, especially in a public space.
How to make your own codes trustworthy
If you're the one putting up a QR code, the goal is to look obviously legitimate. Link to your own domain rather than an unfamiliar shortener when possible, and use a styled, branded code rather than a generic black-and-white square — it signals the code was made intentionally, not slapped together. Capy QR's editor lets you match your code's colors and logo to your brand for exactly this reason, free with no signup. Start at the QR code editor.
Build yours in the editor → capyqr.com
A styled, obviously-legitimate code
Here's the kind of branded code that doesn't look like a random sticker:
Frequently asked questions
- What is a QR code scam?
- A QR code scam (sometimes called "quishing") replaces or disguises a legitimate QR code to redirect victims to a phishing site, a fake payment page, or a malicious download — relying on the fact that people can't read a QR code's destination before scanning it.
- How do scammers place fake QR codes in public?
- The most common method is a sticker placed directly over a legitimate code — on a parking meter, a restaurant table tent, or a poster. It looks identical to the real one but points somewhere else entirely.
- How can I tell if a QR code is safe before scanning it?
- Check for a sticker placed over the original, look at the URL preview your phone shows before you tap through, and be suspicious of QR codes asking for payment or login details in unexpected places like a parking sign or unsolicited email.
- Does scanning a QR code alone infect my phone?
- No — a QR code just encodes text, most commonly a URL. Scanning it opens that link the same way tapping a link would; the risk comes from what you do after (entering credentials, downloading a file), not the scan itself.
- How do I make sure my own QR codes aren't mistaken for a scam?
- Use a reputable, transparent QR code destination — link to your own domain or a trusted redirect service, not an unfamiliar shortener. A styled, branded code (like one made with Capy QR) also looks more intentional and trustworthy than a plain black-and-white square.
Bottom line: a QR code is only as trustworthy as the link behind it — check before you tap, and style your own codes so they look intentional. Ready to make one? Open the editor or browse more QR guides.