The QR sticker scam, and the ten seconds that stop it
A printed QR code can be covered by someone else's sticker. Here is how to tell, and what to check before the money leaves your account.
A QR code is a picture of a link
That is the whole of it. There is nothing inside a QR code that proves who made it, where it was printed, or whether it is still the one the shop put there. Anyone with a phone and a label printer can make one, and a sticker costs almost nothing.
So the common trick is not clever at all: print a QR code that pays a different account, and stick it over the real one. The table, the receipt, the parking meter and the poster all still look normal.
What it looks like when it has happened
- the code sits on top of the printed material, with an edge you can catch with a fingernail
- the paper under it is a different white, or the printing is sharper or blurrier than the rest
- the code is crooked when everything else on the sign is straight
- it covers part of the shop's own artwork, which nobody designing a sign would do
None of these is proof. Together they are enough reason to ask someone who works there.
The ten seconds
Scan the code, but do not pay from the scanner app. Read what comes up first:
- if it is a payment code, the name of the account being paid is shown before you confirm — read it, and
check that it is the shop's name and not a person you have never heard of
- if it is a web link, look at the address, not at the page. A page can be copied perfectly; the address
cannot
- if either one is not what you expected, stop. A real shop will not mind you asking
Where we come in
Paste the link, or upload a picture of the code, and we open it for you in a browser that is not yours. You get the real destination, every redirect on the way, what the page turns out to be, and whether anyone has reported the account behind it.
It takes about eight seconds, it is free, and it does not ask you to sign up. That is on purpose: a check you have to log in for is a check nobody runs at the moment it matters.
LOW RISK means the checks we ran found nothing wrong. It is not a promise that a site is safe. Reports are what people told us, not a verdict.
Check a link before you click it
Paste the link or scan the QR code. We open it for you and show the real destination, the redirects on the way, and whether anyone has reported the seller behind it.
Check a linkMore articles
- QR codes Quishing: how QR code scams work, and how to check a code before you scan it Quishing is phishing through a QR code: on a parking meter, in an email, on a flyer or a package you never ordered. How each version works, what the FTC and FBI advise, and how to see where a code goes first.
- Scams Geek Squad scam emails: the fake renewal invoice, and how to check it An email says you will be charged hundreds of dollars to renew Geek Squad and gives a number to call. Here is what happens if you call, how to check the charge safely with Best Buy, the same trick dressed as McAfee or Norton, and what to do if you already called.
- Scams How to report a phishing email in Outlook, Gmail and iPhone Mail The exact buttons to report a phishing email in Outlook, Gmail and Apple Mail, where else to forward it (APWG, the company being faked, the FTC), and what reporting does and does not do.
