# How to spot a malicious QR code

> Check the physical code first: a sticker over a printed original, or a code where none belongs, is the commonest attack. Then read the preview banner; a shortened link, a domain that does not match the organisation, or urgent wording are the digital tells. Decode suspicious codes without opening them.

Source: https://useqr.app/docs/security/how-to-spot-a-malicious-qr-code · Last reviewed 2026-08-21 · UseQR is free forever, no signup.

---

## Why you cannot judge the code itself

A malicious QR code looks exactly like a genuine one. That is the entire basis of the attack:
the pattern is opaque to humans, so nothing in the squares tells you whether the destination
is your council's payment page or a card-harvesting clone. What you can judge is the code's
**context** and its **destination**, and in that order, because most documented attacks in
public spaces are physical, not technical. The FBI and FTC have both published warnings about
criminals tampering with QR codes in public places; the typical method is a printed sticker,
which costs pennies and requires no skill.

## The physical tells

- **A sticker over a printed code.** Run a finger across it: an overlay has a raised edge
  that an integrated print does not. This is the dominant attack on
  [parking meters](/docs/security/parking-qr-code-scams), EV chargers and payment standees;
  [stickers placed over real ones](/docs/security/qr-code-stickers-placed-over-real-ones)
  covers it in detail.
- **A code where none belongs.** A flyer under a windscreen wiper, a sticker on a lamp post,
  a printed slip taped near a cash machine. Legitimate deployments sit inside designed
  signage, not on street furniture.
- **A quality or placement mismatch.** A crooked paper label on an otherwise professional
  laminated sign, or a low-resolution print inside polished branding, suggests the code was
  added after the fact.
- **No stated owner or purpose.** Genuine codes almost always say who placed them and what
  scanning does ("View the menu", "Pay for parking"). An anonymous code with a vague promise
  is not worth your curiosity.

## The digital tells

Both iOS and Android show the destination on a preview banner before opening anything.
Read it, [checking a QR code before opening](/docs/security/how-to-check-a-qr-code-before-opening)
walks through this in detail. The tells:

| Tell | What to look for |
|---|---|
| Link shortener | `bit.ly`, `tinyurl` and similar hide the destination, exactly what an attacker wants; chains of redirects are worse |
| Look-alike domain | The real domain sits immediately before the first single slash: `pay-parking.example.com.evil.co` is on `evil.co` |
| Character swaps | `rn` for `m`, `1` for `l`, `0` for `O`, and Unicode look-alikes |
| Urgency copy | "Pay within 10 minutes to avoid a fine": pressure is a tell in itself |
| Credential or payment request | Any page reached by scanning that asks you to log in or enter a card |

## Decode without opening anything

The safest inspection is one that cannot navigate. A decoder that displays the raw text
(rather than following it) shows you the exact [payload](/glossary/payload) with zero risk.
Our [scanner](/scan) does this: point your camera or upload a screenshot, and it prints the
string. It runs entirely in your browser, so the image is never uploaded. This is the right
tool for a code from an email, a suspicious sticker, or anything you want to examine before
committing.

## If you already scanned it

Scanning alone has done nothing: a code is inert text, and your phone
[cannot be compromised by the decode itself](/docs/security/what-a-qr-code-can-and-cannot-do-to-your-phone).
If you opened the page but typed nothing, close it. The point of no return is entering
credentials or card details, approving a payment, or installing something the page offered.
If you did any of those, change the password or contact your bank now.

## FAQ

### What does a malicious QR code look like?
Identical to a genuine one, the pattern reveals nothing to the eye. Judge the context instead: a sticker over an original, a code in an odd place, and a destination that does not match the organisation are the reliable signs.

### How do I check a QR code without opening the link?
Use a decoder that displays the text instead of following it. Point a camera or upload a screenshot and read the exact URL before deciding. A browser-based scanner that works client-side never uploads your image anywhere.

### Are shortened links in QR codes always malicious?
No, many legitimate campaigns use shorteners to keep codes simple. But a shortener hides the destination, so treat it as unverified: do not enter credentials or payment details on the far side of one.

### What should I do if I scanned a fake QR code?
If you typed nothing, nothing was taken, close the page. If you entered a password, change it immediately and enable two-factor authentication. If you entered card details, contact your bank and ask them to block the card.

## Try it

- https://useqr.app/scan
- https://useqr.app/validate