How to spot a malicious QR code

Why you cannot judge the code itself

A malicious QR code looks exactly like a genuine one. That is the entire basis of the attack: the pattern is opaque to humans, so nothing in the squares tells you whether the destination is your council's payment page or a card-harvesting clone. What you can judge is the code's context and its destination, and in that order, because most documented attacks in public spaces are physical, not technical. The FBI and FTC have both published warnings about criminals tampering with QR codes in public places; the typical method is a printed sticker, which costs pennies and requires no skill.

The physical tells

• A sticker over a printed code. Run a finger across it: an overlay has a raised edge that an integrated print does not. This is the dominant attack on parking meters, EV chargers and payment standees; stickers placed over real ones covers it in detail.
• A code where none belongs. A flyer under a windscreen wiper, a sticker on a lamp post, a printed slip taped near a cash machine. Legitimate deployments sit inside designed signage, not on street furniture.
• A quality or placement mismatch. A crooked paper label on an otherwise professional laminated sign, or a low-resolution print inside polished branding, suggests the code was added after the fact.
• No stated owner or purpose. Genuine codes almost always say who placed them and what scanning does ("View the menu", "Pay for parking"). An anonymous code with a vague promise is not worth your curiosity.

The digital tells

Both iOS and Android show the destination on a preview banner before opening anything. Read it, checking a QR code before opening walks through this in detail. The tells:

Tell	What to look for
Link shortener	bit.ly, tinyurl and similar hide the destination, exactly what an attacker wants; chains of redirects are worse
Look-alike domain	The real domain sits immediately before the first single slash: pay-parking.example.com.evil.co is on evil.co
Character swaps	rn for m, 1 for l, 0 for O, and Unicode look-alikes
Urgency copy	"Pay within 10 minutes to avoid a fine": pressure is a tell in itself
Credential or payment request	Any page reached by scanning that asks you to log in or enter a card

Decode without opening anything

The safest inspection is one that cannot navigate. A decoder that displays the raw text (rather than following it) shows you the exact payload with zero risk. Our scanner does this: point your camera or upload a screenshot, and it prints the string. It runs entirely in your browser, so the image is never uploaded. This is the right tool for a code from an email, a suspicious sticker, or anything you want to examine before committing.

If you already scanned it

Scanning alone has done nothing: a code is inert text, and your phone cannot be compromised by the decode itself. If you opened the page but typed nothing, close it. The point of no return is entering credentials or card details, approving a payment, or installing something the page offered. If you did any of those, change the password or contact your bank now.

FAQ

What does a malicious QR code look like?

Identical to a genuine one, the pattern reveals nothing to the eye. Judge the context instead: a sticker over an original, a code in an odd place, and a destination that does not match the organisation are the reliable signs.

How do I check a QR code without opening the link?

Use a decoder that displays the text instead of following it. Point a camera or upload a screenshot and read the exact URL before deciding. A browser-based scanner that works client-side never uploads your image anywhere.

Are shortened links in QR codes always malicious?

No, many legitimate campaigns use shorteners to keep codes simple. But a shortener hides the destination, so treat it as unverified: do not enter credentials or payment details on the far side of one.

What should I do if I scanned a fake QR code?

If you typed nothing, nothing was taken, close the page. If you entered a password, change it immediately and enable two-factor authentication. If you entered card details, contact your bank and ask them to block the card.