QR Code Scanner Security Risks How to Check a QR Code Before You Scan It — and the Malicious Codes Hiding in Public Spaces

You are at a restaurant. The menu is a QR code sticker on the table. You scan it with your phone. The URL preview shows: https://menu-order-pay.com/r/8x7k2 — a domain you have never seen before. You hesitate. The restaurant's actual website is therestaurantname.com. This QR code might be legitimate. Or it might be a malicious sticker placed over the real QR code by someone who wants to steal your payment information.

QR code phishing — sometimes called "quishing" — is growing. In 2024, the FBI reported a 300% increase in QR code-based fraud compared to 2022. The attack is simple: print a malicious QR code on a sticker, place it over a legitimate QR code in a public space, and wait for people to scan it. A QR code scanner that shows the decoded URL before opening it is the first line of defense. Here is how to scan safely.

The Anatomy of a QR Code Phishing Attack

Step 1: The attacker identifies a target. High-traffic locations with trusted QR codes: restaurant menus, parking payment kiosks, event tickets, public transport information boards, charity donation posters. The QR code is expected. The victim scans without thinking.

Step 2: The attacker creates a malicious QR code. The QR code encodes a URL that looks legitimate at a glance: paybyphone-parking.com instead of paybyphone.com, menu-order.co instead of the restaurant's actual domain, or a URL shortener that hides the true destination. The QR code is printed on a sticker the same size as the original.

Step 3: The sticker is placed over the legitimate QR code. The victim scans the sticker, not the original. The malicious website looks identical to the legitimate one — same branding, same layout, same text. The victim enters their payment information. The attacker captures it. The victim is redirected to the real site and never knows their credentials were stolen.

How to Scan QR Codes Safely

Use a QR scanner that shows the URL first. A QR code scanner that decodes the QR code and displays the URL before opening it gives you a moment to inspect the destination. Check the domain. Does it match the expected website? Are there subtle misspellings or extra characters? If anything looks suspicious, do not open the link.

Check for physical tampering. Before scanning a QR code in a public space, look at the sticker. Is it a sticker on top of another sticker? Is the QR code printed directly on the surface, or is it a label that could have been added later? A QR code that looks like a sticker on a sticker is a red flag.

Type the URL manually if you are unsure. If the QR code is supposed to link to a restaurant's menu, type the restaurant's website directly into your browser and find the menu there. The QR code is a convenience. It is not the only way to access the information. When in doubt, do not scan.

Use a dedicated QR scanner app, not your phone camera. Phone cameras automatically open QR code URLs without showing the destination. A dedicated QR scanner app — like our free QR scanner — shows the decoded content first and lets you decide whether to proceed. The preview is the security feature.

What to Do If You Scanned a Malicious QR Code

If you entered payment information on a site that you suspect was fraudulent: contact your bank immediately, freeze the card used, monitor your account for unauthorized transactions, and report the malicious QR code location to the business and local authorities. The faster you act, the less damage the attacker can do.

Scan safely at free QR code scanner — preview the URL before you open it. The one-second pause is the difference between a safe scan and a stolen password.