QR codes people can trust: avoiding fake-code scams

4 minute read · updated 2026-11-10

QR codes are convenient, and that is exactly why scammers like them. A code hides where it leads until you scan it, so a fake one can send people to a page that looks real and asks for card details or a login. If you put QR codes in front of customers, a few simple habits make your codes harder to fake and easier to trust.

How QR code scams work

The most common trick is a sticker. Someone prints a code that leads to a fake payment or login page and sticks it over a genuine code: on a parking meter, an electric car charger, a restaurant table or a poster. Customers scan, see a page that looks plausible, and pay or type their details into the wrong place.

Others arrive by post or email: a letter or message with a code claiming to be from a bank, a delivery company or a parking authority, asking you to scan to "settle a fine" or "reschedule a delivery". This is sometimes called "quishing", phishing with QR codes.

In both cases, the code itself isn't harmful. A QR code can't run software on a phone. The danger is the website it opens and what that site asks you to do.

Make your codes hard to cover

Print codes into the material where you can: on the menu, the poster or the sign itself, rather than as separate stickers. A sticker on top of a printed surface is easier to spot than a sticker on top of another sticker.
Put them behind something in public places: inside a window, a frame or a display case.
Check them regularly. Walk past your tables, posters and signs and look for anything stuck over your codes. It takes seconds and is the single most effective step.
Use tamper-evident labels on equipment and signs that are left unattended.

Help people check where it goes

Customers can only judge a code if they know what to expect. Give them something to compare against:

Print your web address next to the code, for example "codeshed.app" or "yourplace.co.uk/menu". Phones show the address before opening it, so people can see if they match.
Use your own domain. A link to yourplace.co.uk is easy to recognise. A long link through an unfamiliar short-link service looks the same as a scammer's.
Say what the code does. "Scan for the menu" sets an expectation. If a code labelled "menu" opens a payment page, people are more likely to stop.
Avoid asking for payment straight from a public code where you can. If you must, use your payment provider's own checkout page, which customers will recognise.

Be careful what you put in a code

Everything inside a static QR code can be read by anyone who scans it. That includes Wi-Fi passwords, phone numbers and contact details. For Wi-Fi, use a separate guest network rather than your main one. For contact codes on public material, use work details rather than personal ones.

Codes made in your browser with a tool that doesn't send your details anywhere, like Codeshed, keep what you type on your own device. That is worth checking with any generator, especially for Wi-Fi passwords and bank details.

Bank transfer codes

Payment codes such as the European EPC (GiroCode) format fill in a bank transfer in the payer's banking app. The payer still sees the name, account number and amount and must confirm the transfer. Tell customers to check that the name matches the business they expect to pay. On invoices, print the IBAN and amount in text next to the code as well, so the details can be compared. Our EPC QR code page explains the format.

Tips to share with customers and staff

Look at the web address your phone shows before you tap it. Does it match the business?
Be wary of any code that leads straight to a login or a card payment page you didn't expect.
Check for stickers on top of codes in public places, especially on parking meters and chargers.
Don't scan codes in unexpected letters or emails that pressure you to act quickly. Go to the company's website or app directly instead.
If something seems off, close the page. You lose nothing by typing the address yourself.

If you find a fake code on your premises

Remove it, keep it if possible, and take a photo of where it was. Check your other codes nearby. If customers may have paid through it, tell your bank or payment provider and consider reporting it to the police or the national fraud reporting service in your country. A short note on your website or social media helps customers who may have been caught out.

QR codes are still one of the simplest ways to share a link, a network or a contact. A little care in how you print and place them keeps that convenience safe for your customers.