How to Tell If a QR Code Is Fake Before You Scan or Pay
QR codes are everywhere: parking meters, restaurant menus, event tickets, flyers, invoices, product labels, and payment signs. Most are legitimate. Some are not.
A fake QR code can send you to a phishing page, fake payment form, malware site, or lookalike website designed to steal information.
Why fake QR codes are hard to spot
A QR code is just a pattern. You cannot look at the square image and know whether it points to the correct website. The destination is hidden until your phone decodes it.
That is why QR codes require extra caution, especially when they involve payments, logins, donations, personal data, or business forms.
Signs a QR code may be fake
- The QR code is a sticker placed over another QR code.
- The printed material looks altered, damaged, or suspicious.
- The destination domain does not match the business name.
- The URL is misspelled or uses a strange domain ending.
- The page asks for payment immediately without context.
- The page asks for sensitive personal information.
- The QR code redirects through several unknown websites.
- The sign gives no official website or phone number for comparison.
Check the physical QR code first
Before scanning, look at the QR code itself. If it is on a sticker, check whether the sticker is covering another code. This is common in public QR scams because attackers can physically place a fake code over a real one.
Be especially careful with QR codes in public places, including parking lots, street signs, transit stations, event venues, hotel lobbies, and public payment areas.
Check the destination before opening
Most phones show a small URL preview before opening a scanned QR code. Do not ignore it. Look at the domain.
Ask yourself:
- Does this domain match the business?
- Is the domain spelled correctly?
- Is this the official website I expected?
- Is it using a random short link?
- Does the page look like a fake version of a real site?
Be careful with short links inside QR codes
Many QR codes use short links. That is not automatically bad. Short links are useful for tracking, updating destinations, and making QR campaigns easier to manage.
But a short link also hides the final destination. For public QR codes, businesses should use short links that provide transparency, monitoring, and a way to report suspicious behavior.
Red flags after scanning
- The website asks for credit card details unexpectedly.
- The page does not show the real business name.
- The page has spelling or formatting errors.
- The browser address bar shows an unfamiliar domain.
- The site pressures you to act quickly.
- The site asks for login credentials that do not make sense.
What to do if a QR code feels suspicious
- Do not enter payment or personal information.
- Close the page.
- Search for the official business website manually.
- Use the official app if available.
- Report the suspicious QR code to the business or property owner.
- If you entered payment information, contact your bank or card provider.
How businesses can help users trust QR codes
Businesses should not expect customers to blindly trust QR codes. They can make QR codes safer and clearer by using checked links.
- Use official branded short links.
- Show the destination domain near the QR code.
- Use a checked preview page before redirecting.
- Monitor destination changes.
- Inspect public QR codes regularly.
- Give users a report suspicious QR option.
Where chked.link fits
chked.link is being built to help people inspect QR destinations and help businesses publish checked short links. The goal is to reduce blind trust by showing where a link goes and monitoring it over time.
A checked QR workflow can help users confirm they are going to the expected destination before they continue.
Bottom line
A QR code should not be trusted just because it is printed on a sign. Always check the destination, especially before paying, logging in, or submitting personal information.
Scan carefully. Preview the destination. Trust verified links.