How QR code scams exploit your trust

23 October 2026Devify

A QR code inherits the trust of wherever it’s placed, whether that’s a restaurant table, a parking meter, or a community bulletin board. But that doesn't mean the link behind it is safe. The real danger isn't scanning the QR code, it’s what happens when you're asked to enter personal details or sign into an account.

The restaurant table trap

Imagine you sit down at a restaurant, open your camera, and scan the QR code on your table to see the menu. What you don't realise is that someone has stuck a fake QR code directly over the original one.

The venue is legitimate, the table is real, and the atmosphere feels completely safe. But the page that loads on your phone isn't associated with the restaurant you're sitting in at all. The website looks convincing, however it asks for your card details before letting you view the menu. You might have just encountered a QR code phishing scam.

These scams work incredibly well because malicious actors don't need to hack a business's actual website, instead they just hijack your trust in the physical environment around you.

A QR code is an address, not a seal of approval

A QR code is simply a visual shortcut to a web address. It doesn't verify who printed the sticker, who stuck it to the table, or whether the site behind it is safe.

As the Australian Signals Directorate (ASD) points out, QR code phishing - often called "quishing" - is just traditional phishing delivered through a physical square instead of an email or text message. The delivery method changes, but the trick remains the same: convincing you to trust where the link leads.

It's also important to remember that design details can be deceptive:

Logos are easy to copy: A familiar brand logo on a sign or website doesn't guarantee it's authentic.
The padlock icon (HTTPS) only means privacy, not safety: HTTPS encrypts your connection to a website, but malicious sites use encryption too.
Destinations can change: Many QR codes use short links or "dynamic" URLs that redirect your browser - meaning the code's target page can be changed at any time after printing.

A QR code sticker peeling back to reveal an older QR code underneath on a wooden restaurant table. — A QR code provides direction, not authentic identity

Where the real damage happens

The good news is simply scanning a QR code doesn't automatically hack your phone. There's a big difference between decoding a URL, visiting a webpage, and actually handing over your information.

The real risk comes from what you do after the page loads:

Credential harvesting: Entering your login details or passwords into a fake form.
Payment fraud: Sending money through a fake checkout or illegitimate payment portal.
Malicious downloads: Installing untrusted apps or software prompts on your device.

That doesn't mean every payment prompt at a table is a scam. The vast majority of venues use legitimate digital ordering systems. The key is watching for mismatches between what you expect to happen and what the QR code link asks for. If a menu site appears and suddenly asks for your credit card upfront before letting you see food prices, stop and reconsider.

If you are unsure, take a look at the web address in your browser bar, or ask a member of staff directly before entering sensitive data.

When the website is real, but the login is a trap

There’s another, more subtle scam to watch out for: QR code login hijacking (sometimes called QRLJacking). In this scenario, you aren't being sent to a fake website - you’re being tricked into approving a login on someone else's device.

Here’s how it works:

An attacker opens a real platform or service (like messages or a video game) on a computer, generating a QR code to log in.
They display that live QR code to you on a separate site, social media stream, or pop-up (for example, pretending it’s a verification check).
You open the official app on your phone and scan the code shown on screen, but it's actually the QR code the attacker generated. Because the code originally came from the service or platform's real servers, your phone app recognises it as legitimate and asks if you want to approve the login.
Once you hit "approve," the real service logs the attacker's computer into your account.

Because you're interacting with the official app or website, checking the domain name doesn't help. The scam requires no fake forms or stolen passwords, it relies entirely on tricking you into approving a login you are unaware of.

Popular platforms like Discord explicitly warn users about this: never scan a QR code on your screen unless you initiated it. Accidentally approving a unknown login can give complete access to your account.

Illustration of a hooded attacker sharing a login QR code from a computer with a person scanning it on their phone, with warning symbols highlighting the scam. — Whose device is being authorised?

How to protect yourself

Staying safe around QR codes doesn't mean avoiding them entirely - it just means knowing what to look out for before and after you scan.

What you can do as a customer

Check the physical code: Before scanning, look closely at the sticker. Does it look peeled, raised, or stuck directly over an old one?
Preview the link: Use your phone’s built-in preview to check the web address before tapping through. If the domain looks strange or unrelated to the venue, don't open it.
Verify unexpected requests: If a restaurant menu suddenly asks for credit card details upfront, ask a staff member. If a site asks to sign into an account, navigate to the service independently through your app or browser bookmark instead.
Double-check login approvals: Only approve QR logins that you personally started on a device you own.

How businesses can help

Businesses using QR codes also have a responsibility to safeguard their customers:

Regularly inspect physical codes on tables, meters, or posters for tamper marks or overlays.
Print the full web address clearly alongside the QR code so users have a secondary reference point.
Give staff a clear process for reporting and replacing suspicious stickers.

Phishing-resistant security

Standard verification codes and basic QR approvals can still be tricked by scammers, but newer standards are fixing this. Developed by the FIDO Alliance (an industry group including Apple, Google, and Microsoft), passkeys allow you to log in using your face, fingerprint, or device PIN instead of a password.

Passkeys are completely phishing-resistant because they refuse to share your credentials with fake websites. Also, when logging in across devices, passkeys perform a quick bluetooth check to confirm your phone is actually in the same room - meaning a remote scammer using a QR code from miles away can't access your account.

What to do if you’ve already entered details

If you realise you’ve interacted with a malicious QR code, act quickly based on what was compromised:

Passwords: Immediately change your password through the official website or app and log out all other active sessions.
Financial Information: Contact your bank or card provider straight away to block unauthorised transactions or freeze the card.
Account Access: Remove any unknown linked devices or active sessions in your app's security settings.

Keep the convenience, question the next step

QR codes are a fantastic convenience, and aren't going anywhere anytime soon. The best defense against QR code phishing is simply taking a minute before money, sensitive information, or account access becomes involved. Always make sure you check where the link actually goes, and make sure what's requested makes sense for what you're trying to do. If anything feels off, skip the QR code entirely and head directly to the official app or website instead.