The short answer
QR code misuse is almost always the same trick: an attacker prints a sticker with their own QR code and lays it over a legitimate one on a real-world surface — a parking meter, a restaurant table tent, a poster, a payment terminal. You scan what looks like the trusted code, but you land on a look-alike phishing page that harvests a card number or a password. The code itself is harmless printed data; the misuse is the swap.
The defense is the same as for any phishing link: verify the destination before you trust it. Read the URL preview banner your phone shows before you tap, check the domain against the brand you expected, and for anything sensitive (payment, login, package tracking) navigate to the official site yourself rather than following a sticker. Honest and non-alarmist: QR codes are not dangerous, they are just a cheap anonymous way to put a link in the physical world, which is exactly what a scammer exploits. See our qr code security guide for the broader safety picture.
The common misuse patterns
Misuse concentrates where a printed code is anonymous, cheap, and trusted-by-context. The recurring patterns below show how each one turns that trust against you — and the one-line defense for each.
Sticker overlays are the classic: a fraudulent QR is physically pasted over the real one, so the surface still looks official but the code underneath is the attacker’s. Phishing-destination codes skip the overlay and just print a fresh code anywhere a scan seems plausible (flyers, kiosks, social media) pointing at credential-harvesting pages. Malicious QRs hidden in PDFs or email attachments work the same way but reach you through a screen instead of a surface — a “document QR” is still just a link, so treat it like one.
Common QR misuse patterns to watch for
The table below collects the recurring misuse patterns, how each one works, and the one-line defense — a quick reference you can scan before you scan a code.
| Misuse pattern | How it works | How to spot or avoid it |
|---|---|---|
| Sticker overlay on a payment terminal | A fake QR is pasted over the real one on a parking meter, parking lot sign, or self-checkout so you pay the attacker instead. | Look for a sticker sitting on top of the printed code; prefer the meter’s printed short code or coin slot; check the domain in the URL banner. |
| Fake restaurant menu or WiFi QR | A sticker over a table tent sends you to a phishing or payment page instead of the menu or guest WiFi. | If the code looks like an added sticker, ask staff for the real URL; check the domain before connecting or paying. |
| Phishing-destination poster or flyer code | A freshly printed public QR points at a look-alike login page harvesting credentials. | Don't enter passwords after scanning a stranger's code; navigate to the brand's official site yourself. |
| Malicious QR in a PDF or email attachment | A “document QR” in an invoice, shipping notice, or attachment opens a malware or phishing page. | Treat an attachment QR like any link in an unexpected email; verify the sender and the destination before tapping. |
| Fake package / delivery QR | A text or door-hanger QR claims to reschedule a delivery and leads to a payment or info form. | Track packages in the carrier’s own app, not via a QR from an unexpected message. |
| Crypto / gift-card / giveaway QR | A social-media or kiosk QR promises a giveaway and drains a connected wallet or account. | Never send funds or enter seed phrases after scanning a code; legitimate giveaways don’t need one. |
How to spot a tampered QR code
A tampered code is usually visible before you scan it, if you know what to look for. The most reliable tell is a sticker sitting on top of a printed surface — a QR that is glossy, slightly raised, misaligned with the art around it, or printed on a different stock than its background is a swapped code until proven otherwise. Genuine codes are usually printed into the design, not stuck on.
Before you tap, read the URL preview banner. Check the domain against the brand you expected (a city parking site, the restaurant’s own domain, the carrier’s site) and watch for look-alikes: misspellings like park1ng-pay.com, extra subdomains, URL shorteners hiding the real destination, and http:// instead of https://. For sensitive actions — payment, login, package tracking, account changes — the safest habit is to skip the code entirely and type the address you already know into the browser.
What to do if you scanned a suspicious QR
If you tapped through before you checked, the rules are the same as for any phishing link. Do not enter credentials, payment details, or personal information on the page that opened, no matter how official it looks. Close the page, and if you already started typing a password, change it from the brand’s official site or app. If you entered a card, flag the charge with your bank.
Then report it. Many cities and venues want to know about swapped parking or payment stickers; reporting a tampered surface protects the next person. There is no need to panic — reading a QR code cannot harm your phone, it is just text — the only thing that matters is what you typed into the page it opened.
Why QR codes get misused (and why it stays rare-ish)
A QR code is anonymous, costs nothing to print, and is trusted-by-context (a code on a parking meter must be the city’s, right?). That combination is exactly what an attacker wants in a physical phishing vector, which is why misuse clusters on payment and login surfaces rather than on menus or posters that lead to plain information.
Two things keep it from being an epidemic: the attack is physical and local (a sticker helps one meter, not a million inboxes), and modern phones show a URL preview banner before opening the link, giving scanners the same pause an email’s visible link would. The risk is real but bounded — sensible habits, not fear, are the right response. Our qr code security guide covers the quishing (QR phishing) name and the device-side defenses in detail.
How QRForge mitigates misuse
Static codes built here are data-only by construction: the payload is encoded directly into the image with no redirect, no lookup, and no server that could be quietly repointed. When you generate a static URL code, the destination is baked into the ink and cannot be changed after printing, so the only thing to vet is the destination you yourself control — there is no middleman for an attacker to compromise.
The planned paid dynamic tier is different by design: a dynamic code stores a short redirect link on a server so the destination can be edited later. That editability is the whole point of dynamic codes, and it is also why the redirect must be hardened against abuse — destination validation that blocks private/IP-literal targets and non-http(s) schemes (an SSRF and open-redirect guard), rate-limits on create and redirect, and a redirect interstitial for untrusted links. See our qr code redirect guide for how that mechanic works and what it defends against. Static stays the safe, free, private default; dynamic is opt-in and guarded.
Frequently asked questions
How are QR codes misused?
The most common misuse is a sticker overlay — an attacker prints their own QR and pastes it over a legitimate one on a parking meter, restaurant table tent, or payment terminal, so you scan what looks official but land on a phishing page. The code itself is harmless; the swap is the attack.
What is QR code fraud?
QR fraud is any scam that uses a QR code to send you to a fake payment, login, or info-harvesting page. It is the same trick as phishing by link, just delivered through a printed square instead of a clickable URL. The defense is the same: check the destination before you enter anything.
How can I tell if a QR code has been tampered with?
Look for a sticker sitting on top of the printed surface — glossy, raised, misaligned, or on different stock. Before tapping, read the URL preview banner and check the domain against the brand you expected; for sensitive actions, type the address you know instead of scanning.
What should I do if I scanned a bad QR code?
Do not enter credentials or payment details on the page that opened, no matter how official it looks. Close the page, change any password you started typing via the brand’s official site, flag any card charge with your bank, and report the tampered surface so the next person is warned. Scanning the code cannot harm your phone — only what you type on the page matters.