FreeurlThe short answer
You usually can't tell a fake QR code by looking at the square itself. The pattern is just dots. What gives a fake away is the sticker around it and the link it opens.
If you want to know how to spot a fake QR code sticker, run two kinds of checks: look at the physical code before you scan, then read the link before you open it. Both take under ten seconds. The rest of this post shows you how.
It is not a theoretical risk. On September 3, 2026, the FTC published a consumer alert warning that scammers are covering real QR codes on parking meters with their own. Scanning one can send you to a fake site that steals money, personal information, or both (FTC consumer alert).
Why a QR code sticker is such an easy trick
Anyone can make a QR code for free in a minute. Printing it on an adhesive label costs almost nothing. A scammer walks up to a parking meter, a restaurant table or a flyer on a bulletin board, and presses the label over the real code.
The fake code works. It opens a page that looks like the real payment or menu page. That is why people don't notice until money has left their account. The National Cybersecurity Alliance describes the same pattern: criminals print fake codes on stickers and swap them for legitimate ones on flyers and other materials (National Cybersecurity Alliance). Using QR codes to phish people even has a name: quishing.
Seven checks before you scan
1. Run a finger over the edges
A sticker over a printed code often has a raised edge. Look for a corner that is lifting, a slight shadow, or a code that sits a little crooked on its background. Real codes are usually printed directly onto the sign or meter, or laminated as part of it.
2. Look for a code on top of a code
If the sign shows a printed code with a second code stuck over part of it, don't scan either one. A business would not normally put two codes in the same place.
3. Check whether the code fits its surroundings
A glossy white sticker on a weathered metal meter looks wrong. So does a code that is a different size or print quality than the text next to it. If the code looks like it does not belong with its background, treat that as a warning.
4. Ask yourself whether you need to scan at all
Many meters and kiosks also take cards or coins, or have an official app you can search for yourself. Restaurants usually have a staff member who can confirm the menu code, or a paper menu. A scam depends on you taking the shortcut.
5. Preview the link before opening it
Most phone cameras show the web address at the top of the screen after you aim at a code. Read it before you tap. The FTC advises checking the link for misspellings or swapped letters before you go further.
Here is a worked example. You scan a code on a downtown parking meter. The city's real parking site is something like cityparking.gov. The preview shows cityparking-pay.com. That is a different domain with extra words added, and it is not the city's site. Close it.
6. Look for pressure
Real payment pages don't threaten you. A page that says your car will be towed in five minutes, or asks for far more information than the task needs, is a red flag. A parking payment needs your plate, location, time and a payment method. It does not need your Social Security number.
7. Expand the link if it is shortened
Some QR codes hide the real destination behind a short link. That is normal for legitimate marketing, but it means the address in the preview tells you nothing. You can paste the short link into an unshortening tool such as the Freeurl unshorten tool to see where it leads before you visit it. We cover the habit in more detail in how to check a Bit.ly link before you click it.
One honest limit: an unshortening tool only helps with shortened links. If the code holds a full address, the preview on your phone is the check, and a look-alike domain can still fool a tired eye. And no tool can promise a destination is safe. It shows you where the link goes. You still make the call.
What a safe QR code usually looks like
Safe is not a guarantee, but some signs point the right way:
- The code is part of the printed sign, not a label on top of it.
- The address shown matches the business or agency name you expect.
- The page starts with https:// and is a clean, simple address, without strange extra words.
- Staff or the official website confirm that the business uses QR codes.
If you aren't sure, type the business's web address into your browser yourself instead. That one habit beats every other check on this list.
What to do if you already scanned a fake code
Don't panic, but move quickly. Follow the steps the FTC gives:
- Don't engage with anyone on the fake site. Close the page.
- Change any password you typed in, and change it everywhere else if you reuse it.
- Check your bank and credit card statements for charges you didn't make. If you entered card details, call your card issuer.
- Report it at ReportFraud.ftc.gov.
Also keep your phone's operating system and apps up to date, and turn on multi-factor authentication for important accounts. These steps limit the damage if something does slip through.
If you print QR codes for your own business
This works in the other direction too. If customers scan your code, you want them to be able to trust it. A few habits help:
- Put the code on a surface that is hard to cover, such as a laminated sign or an engraved plate, and check it regularly.
- Print the web address in plain text under the code so people can verify it or type it.
- Use a short link on your own domain so the preview shows your brand. Our guide to using your own domain for short links explains how.
- Watch your scan numbers. A sudden drop in scans on a code in a busy spot can mean someone has covered it. See how to track QR code scans.
That last point is a trade-off to know about. Scan tracking can hint at tampering, but it can't prove it. A drop might also mean fewer visitors. Treat it as a reason to go and look at the sign.
Frequently asked questions
Can I tell a fake QR code just by looking at it?
Not from the pattern. A fake and a real code look alike. Look at the sticker, its edges and its surroundings, then read the link before you open it.
Is it safe to scan a QR code to see where it goes?
Scanning alone usually only reads the web address. The risk starts when you open the link and enter information. Keep your phone updated and read the address in the preview first.
Should I use a separate QR scanner app?
Usually no. Your phone's built-in camera reads QR codes and shows a link preview. The National Cybersecurity Alliance notes the FBI has warned that QR scanner apps can raise the risk of malware.
What should I do if I paid on a fake parking site?
Contact your bank or card issuer right away, change reused passwords, watch your statements, and report it at ReportFraud.ftc.gov.
Frequently asked questions
Can I tell a fake QR code just by looking at it?
Not from the pattern. A fake and a real code look alike. Look at the sticker, its edges and its surroundings, then read the link before you open it.
Is it safe to scan a QR code to see where it goes?
Scanning alone usually only reads the web address. The risk starts when you open the link and enter information. Keep your phone updated and read the address in the preview first.
Should I use a separate QR scanner app?
Usually no. Your phone's built-in camera reads QR codes and shows a link preview. The National Cybersecurity Alliance notes the FBI has warned that QR scanner apps can raise the risk of malware.
What should I do if I paid on a fake parking site?
Contact your bank or card issuer right away, change reused passwords, watch your statements, and report it at ReportFraud.ftc.gov.