5 Ways to Defend Against Fake QR Codes
Where Fake QR Codes Hide
QR code phishing (quishing) has surged since 2023. The method is simple: stick a fake QR code over a real one. Parking meters, restaurant tables, public facility signs, and mailed flyers are common targets. Scanning leads to convincing phishing sites that steal credit card or login credentials. The FBI issued a formal warning in 2022, and incidents have been reported across the UK, US, and Japan.
Defense 1: Always Check the URL After Scanning
Both iPhone and Android preview the URL before opening the browser. Check three things: is the domain correct (paypa1.com vs paypal.com), does it start with HTTPS, and is the URL suspiciously long? If anything feels off, close the browser without tapping.
Defense 2: Spot Sticker Overlays
Most physical fake QR codes are stickers placed over originals. Look for unnatural edges, different print quality, or peeling corners. In public places (parking meters, bus stops, tourist signs), physically touch the QR code to check for overlays. When possible, use the official app instead of scanning.
Defense 3: Never Enter Payment Info via QR Code Links
If a QR-scanned page asks for credit card numbers, bank details, or passwords, suspect fraud. Legitimate payment services process transactions within their dedicated apps. For payments like parking fees, access the service's official site directly rather than through a QR code.
Defense 4: Let Machines Check Where the Link Goes
Defense 4 is to use automatic checks on the destination. Security apps on your phone, and the protection built into browsers and operating systems, compare the URL you are about to open against lists of known scam sites and warn you when there is a match. Confirming once that this kind of protection is switched on puts one more gate in front of a fake site. Keep in mind, though, that such checking assumes the site has already been reported and listed. Scam sites are built and abandoned within days, so a brand-new site slips past detection, and the absence of a warning is not proof of safety. Machine checking is only the last net; it works alongside the visual checks in Defenses 1 to 3.
Defense 5: Report Suspicious Codes to Stop the Next Victim
Defense 5 is to report a suspicious QR code. If you find a code in a public place that was clearly stuck on afterwards, tell the facility manager first: the party displaying the sign holds the authority to remove it, and a single report can stop the next person from losing money even when you are unharmed. A photo showing where the code was placed makes their check faster. In Japan, non-emergency consultations are handled through the nationwide police consultation number (#9110), which connects you to the consultation desk of the police headquarters covering the area you call from, while 110 remains the emergency number for crimes and accidents. Cybercrime consultations themselves are handled by desks at each prefectural police force, and the Council of Anti-Phishing Japan publishes a reporting form for fake sites.
Codes You Cannot Judge by Sight, and the Habit of Calm Checking
What makes a fake QR code troublesome is that genuine and fake cannot be distinguished at all by appearance. From a black-and-white pattern, you cannot know its destination before scanning. With a URL written in text, you can sometimes notice suspicious points, but with a pattern you cannot grasp a clue. That is precisely why the attacking side abuses the property of the code's contents being invisible. Since you cannot judge by appearance, having a habit of checking the information displayed right after scanning becomes more important than anything in preventing harm.
Much of the harm from fake codes is born from operating in a panic. When you encounter guidance that stirs anxiety, such as complete the procedure right now, that is precisely when it is important to stop for a moment. Is the displayed URL really that of the intended organization? Are you suddenly being asked to enter personal or payment information? If you check each one calmly, many dangers can be avoided. If you feel even a little that something is off, recheck on your own from the official app or desk. This caution is an indispensable stance for protecting yourself from clever tactics.