QR Code Scams: How They Work and How to Stay Safe

Why QR codes are used in scams

Scanning hides the destination. On a phone, the link preview is small and disappears quickly, so a look-alike address such as paytrn-help.com instead of paytm.com is easy to miss.

QR codes also skip the filters that catch bad links in email and chat. A spam filter can read a link in an email, but often cannot read a link drawn as a picture. Security researchers call this “quishing” (QR phishing).

Finally, people trust physical objects. A code on a parking meter, a restaurant table or a shop counter feels official, even if someone stuck it there yesterday.

Scam 1: “Scan this QR code to receive money”

This is the most common UPI scam in India. A “buyer” on an online marketplace, or someone claiming to send a refund, cashback or prize, sends you a QR code and asks you to scan it to receive the payment.

Scanning a UPI QR code and entering your PIN always sends money from your account. There is no such thing as scanning to receive. When you scan, the app shows an amount and asks for your UPI PIN; entering it pays the scammer.

• To receive money, you only share your UPI ID or show your own QR code. You never enter your PIN.
• If an app asks for your UPI PIN, money is leaving your account. Stop and read the screen.
• Real buyers do not insist on a QR code “for verification” or a “small test payment”.

Scam 2: A sticker over the real code

Scammers print their own QR code and stick it over a genuine one on parking meters, EV chargers, shop counters, fuel pumps and restaurant tables. Several US cities, including Austin and San Antonio, found fake codes on parking pay stations in 2022, and similar stickers have been reported at Indian shops on top of the merchant’s UPI standee.

For payments, the fake code sends money to the scammer’s account. For parking or bills, it opens a look-alike payment page that collects your card details.

• Run your finger over the code. A sticker on top of a printed sign is a warning sign.
• When paying a shop by UPI, check that the name shown in your app matches the shop or owner before entering the PIN. Ask if unsure.
• For parking, prefer the official app or the website printed on the meter, typed by hand.

Scam 3: QR codes in emails, letters and parcels

Phishing emails now often contain a QR code instead of a link: “Your account will be locked, scan to verify”, “Scan to re-activate two-factor authentication”, or a fake delivery notice. The page that opens asks you to sign in, and your password goes to the scammer.

Some scammers mail physical letters or leave unexpected parcels with a QR code inside. In 2023 the US Federal Trade Commission warned consumers about exactly this kind of unsolicited QR code.

• Be suspicious of any message that creates urgency and asks you to scan.
• Your bank, email provider or employer’s IT team will not ask you to sign in by scanning a code in an email.
• If you think the message might be real, open the app or type the website address yourself instead of scanning.

Scam 4: Codes that install apps or change settings

A QR code can open an app store page or a direct download link. Scammers use this to push fake “customer support”, “KYC update” or screen-sharing apps. Once installed, a screen-sharing app lets them watch you type OTPs and passwords.

Only install apps from the official Play Store or App Store, check the developer name, and never install an app because a caller or a code told you to.

A 10-second check before you scan

Before you tap the link a code opens, run through these five questions. They take a few seconds and catch nearly every scam above.

• Who put this code here? Is it printed as part of the sign, or stuck on top?
• When the link preview appears, read the domain name slowly: the part just before .com, .in or .org.
• Does the page ask for a password, card number, OTP or UPI PIN? Treat that as a reason to stop, not to continue.
• For UPI, check the payee name and amount on the confirmation screen before you enter your PIN.
• If anything feels rushed or strange, close the page. A genuine business will still be there when you check another way.

Check a code without opening it

If you are unsure, decode the code first and read it. Upload a photo or screenshot to a scanner that only shows the content, such as the QRizeo QR code scam checker. It displays the full link and highlights the domain, shows who a UPI payment really goes to, and flags common tricks such as look-alike bank sites and “scan to receive money” notes. Nothing opens until you choose to open it.

For shop owners: protect your printed QR code

If customers pay you through a QR code, a sticker swap costs you real money: customers pay the scammer and believe they paid you.

• Check your standee or sticker every morning. Make it part of opening the shop.
• Laminate the code or keep it behind clear acrylic so a sticker cannot be placed on top without being obvious.
• Print your shop name next to the code and ask customers to confirm the name in their app.
• Use the soundbox or payment notification from your bank or UPI app. Do not rely on a customer’s screen showing “Payment successful”; screenshots can be faked.
• If you make your own UPI code, scan it with two different apps after printing and confirm the payee name is yours.

What to do if you were scammed

Act quickly. Banks can sometimes stop a transfer if it is reported within hours.

• In India, call the national cyber crime helpline 1930 and file a complaint at cybercrime.gov.in. Keep the transaction ID, the scammer’s UPI ID or phone number, and screenshots.
• Call your bank’s official customer care number (from the back of your card or the bank’s app) and ask them to block the card or raise a dispute.
• If you entered a password on a fake page, change it at once on the real site, and on every other site where you used the same password. Turn on two-factor authentication.
• If you installed an app at someone’s request, uninstall it, and check your phone for screen-sharing or remote-access apps.
• Outside India, report to your bank and the national fraud reporting service, such as reportfraud.ftc.gov in the US or Action Fraud in the UK.

Are QR codes themselves dangerous?

No. A QR code is only a way of writing text that a camera can read. Scanning it does nothing on its own: the danger comes from the page it opens and what you do there. A code you made yourself, from content you typed, is as safe as that content.

Static QR codes, like the ones QRizeo makes, contain the link or payment details directly. There is no redirect service in between that could later be changed to point somewhere else.