QR code scams: how to spot a fake code and make yours easy to trust
By Online Business Cards Editorial Team | Published | Updated | Leads, privacy and security
Fake QR codes stuck over real ones, often called quishing, are a growing scam. Here is how to check a code before you open it, and how to make your own business QR code easy to trust.
QR codes are everywhere: on menus, posters, parking machines and business cards. That convenience has attracted fraudsters. A fake code can send someone to a website that looks genuine but is built to take their card details or passwords. The scam is often called "quishing", short for QR code phishing.
If you use a QR code for your business, this matters twice over. You want to scan safely yourself, and you want customers to feel confident scanning yours. This guide covers both.
How QR code scams work
A QR code is just a picture of some text, usually a web address. You cannot tell where it goes by looking at it, which is what scammers rely on. The most common tricks reported in the UK are:
- Stickers over real codes, especially on car park payment machines, leading to fake payment pages.
- Codes in emails or letters asking you to "scan to verify your account" or "scan to pay a fine", sometimes pretending to be HMRC, a bank or a delivery company.
- Codes on posters, menus or chargers placed over the genuine ones.
UK fraud reporting services have warned about fake QR codes, especially on parking machines and signs in car parks.
How to check a code before you trust it
These habits are worth passing on to staff and customers as well:
- Look for stickers. If a code is stuck on top of something, peeling, or looks out of place, do not use it.
- Read the web address your phone shows before you open it. Most phone cameras show a preview. Does it match the business you expect?
- Be wary of urgency. A code that pressures you to pay or log in right now is a warning sign.
- Do not scan codes in unexpected emails to log in to a bank or "verify" an account. Go to the company's website or app directly instead.
- Use your phone's built-in camera. You do not need a separate QR scanner app, and some of those are risky.
- For payments, use the official app or website named on official signs, rather than a code you are unsure about.
If something goes wrong
If you think you have entered card or bank details on a fake site:
- call your bank straight away on 159, which connects you to most UK banks safely
- report it to Report Fraud, online or on 0300 123 2040
- forward scam texts to 7726 and scam emails to report@phishing.gov.uk
Making your own business QR code easy to trust
Customers who have heard about QR scams may hesitate before scanning a code. A few simple choices make yours easier to trust.
Say what it does
A bare code gives people no reason to scan. A short line tells them what they will get:
- "Scan to save our contact details"
- "Scan to see today's menu"
- "Scan to book your next appointment"
Print your name and link beside it
Put your name or business name and a short version of your web address next to the code. People can then check that the address their phone shows matches what is printed.
Make it part of the design
A code printed as part of your sign, card or flyer looks deliberate. A code on a sticker looks like the kind of thing people are warned about. If you must use a sticker, use a branded one that matches the rest of your printing.
Never use a card code to take payments
Your digital business card is for sharing details, not taking card payments. If customers pay you, use your normal payment methods and tell them what to expect. Asking people to scan a code and enter card details is exactly the pattern scammers copy.
Check your public signs
If you have a code on a counter, window or table, look at it now and then. Make sure nobody has stuck another code over yours, and replace anything that looks tampered with.
Keep the link stable
Your digital business card link stays the same when you update your details, so you never need to swap codes around, which can confuse people. If you ever do change a code, remove the old one everywhere rather than leaving two in use.
What scanning a digital business card involves
When someone scans your card's code, it opens your profile page in their browser. They see your details and can choose to call you, email you or save your contact. Your card does not ask them for card details or passwords. On the Business Plan, they can choose to share their own details back with you, but that is always their choice.
Our guide to digital business card privacy covers what you should and should not put on your card, and how password protection can keep a profile private.
Warning signs, and what to do
Warning sign | What to do
A sticker stuck over another code | Do not scan it; use the official app or website
The page asks for card details straight away | Close it and pay another way
The address is misspelt or unexpected | Do not enter anything
A code arrives by text or email from a stranger | Treat it like any suspicious link
Which plan you need
Both plans include a QR code for your card. Brand Presence (£45, one-off) covers your details, social links, documents, gallery, password protection and analytics. The Business Plan (£90, one-off) adds bookings, enquiries, contact leads and a CRM. Compare them on our plans, or see the QR code business card.
This article is general information, not security or legal advice.
Read next: QR codes that scan first time and QR code business cards. You can also browse all our guides.
Frequently asked questions
What is quishing?
Quishing is phishing using a QR code. A fake code sends people to a website designed to steal card details, passwords or personal information.
How can I tell if a QR code is safe?
Check that it is not a sticker over another code, read the web address your phone shows before opening it, and be wary of any page that pressures you to pay or log in.
What should I do if I scanned a fake QR code and paid?
Call your bank on 159 straight away, then report it to Report Fraud online or on 0300 123 2040. Tell the car park operator or business whose code was covered as well.
Is it safe to scan a digital business card QR code?
A genuine digital business card code opens a profile page with someone's contact details. It should never ask you for card details or passwords. If it does, close the page.
How can customers check my QR code is genuine?
Print your web address next to the code and say what it opens, such as “Scan for our price list”. Customers can then check the page address matches.