How to protect QR codes from tampering and scams

The most common QR code scam is low-tech: someone prints their own code and sticks it over yours, so scans go to a fake payment or login page. You can’t stop someone from carrying stickers, but you can make tampering obvious, check your codes, and help people spot a fake before they pay.

How QR code tampering works

Sticker over a real code. On parking meters, charging points, restaurant tables, posters and payment counters. The fake code opens a look-alike page that asks for card details or a login.
Swapped printed material. A whole flyer or table card replaced with a copy carrying a different code.
A changed destination. If a dynamic code’s account is taken over, the code itself is untouched but sends scans somewhere else.

Make your codes tamper-evident

Print the code into the material. A code printed on the sign, menu or window is hard to cover neatly; a separate sticker is easy to swap.
Put it behind something. A clear acrylic stand, a laminate or a frame makes a sticker on top stand out.
Show where it goes. Print the destination in words beside the code, such as “maplecafe.ca/pay”, so people can compare it with what their phone shows.
Use a recognisable design. A code in your colours with your logo and a frame is harder to imitate on the spot than a plain black square.
Check them regularly. Make it part of opening up: look for stickers, peeled edges or anything different, and scan one code a day.

Protect your dynamic codes

Secure the way you sign in. On QRfinity that’s your email or Google account, so protect it with a strong password and two-step verification, and sign out on shared computers.
Watch the dashboard. Check now and then that each code still goes where it should, and that scan counts look normal.
Use your own pages. Point codes at your own website or your payment provider’s official pages, so people recognise the address.

Codes that take payments need extra care

Payment codes are the main target, because a fake one pays the scammer directly. For payment links, UPI and Pix:

Print your business name beside the code, and tell customers to check it matches the name on the payment screen.
Keep the code where staff can see it.
After any suspicious report, check every payment code before you open the next day.

Help people scan safely

The same advice protects your customers and you:

Read the address before opening it. Phones show a preview; if it doesn’t match the business, don’t open it.
Be wary of codes that ask for a payment, a login or an app download, especially on stickers.
Type the address yourself when in doubt.

Report a bad code

If you find a QRfinity code (a qrfinity.link address) that leads somewhere harmful, report it and we’ll review it. For other codes, report the page to the brand it imitates and, if money was lost, to the police and your bank.

Questions people ask

What is quishing?

QR code phishing: a code that sends people to a fake page to steal passwords or card details. In public, it’s usually a sticker placed over a real code, on a parking meter, a poster or a restaurant table.

Can someone hack the QR code itself?

Not the printed pattern; it can only be covered or replaced. With a dynamic code, the risk is someone getting into your account and changing the destination, so protect your account and watch for changes.

Does QRfinity check where codes go?

Yes. We check the destination of every dynamic code against threat lists when it’s made and regularly afterwards, and anyone can report a code. A sticker someone places over your code isn’t a QRfinity code, though, so checking your printed codes matters most.

Is it safe to scan QR codes?

Usually, if you check where they go. Read the address your phone shows before opening it, and be wary of any code that asks you to pay, log in or download an app, especially one stuck on top of something else.

What should I do if I find a fake code on my sign?

Remove it, check your other codes, and warn customers who may have scanned it, for example with a sign or a post. If people may have paid a scammer, report it to the police and to your payment provider.