Safety
QR code scams, and how to not fall for one.
A QR code hides its destination behind a pattern of squares. That is convenient for businesses and extremely convenient for scammers. Here is how the trick works and how to check any code in about five seconds.
What you're actually up against
The code is never the problem
A QR code cannot carry malware. It is text — usually a web address — encoded as squares. Scanning it does not install anything.
What makes it dangerous is that you cannot read it before you tap it. With a normal link you can at least glance at the domain. With a QR code you are trusting a pattern you cannot decode by eye. Scammers rely on exactly that.
The technique has a name: quishing — phishing by QR code.
Where fraudulent codes show up
| Place | The play |
|---|---|
| Parking meters and bays | A sticker over the council’s own code, leading to a fake payment page |
| Café tables | A sticker over the venue’s menu code, harvesting card details at a fake checkout |
| Posters and flyers | A code promising a prize, competition or free product |
| Letters and invoices | A code claiming an unpaid fine, toll or delivery fee |
| Emails | A code instead of a link, specifically to get past filters that scan links |
| EV chargers and vending machines | A sticker replacing the operator’s payment code |
Scamwatch and state police have issued warnings about several of these. The common thread is a physical sticker placed over something legitimate.
The warning signs
- A sticker on top of printed signage. Feel the edge. Legitimate codes are usually printed into the sign, not stuck onto it.
- A domain that is nearly right. Extra hyphens, an added word, an unusual ending, a hyphenated version of a known brand.
- A URL shortener hiding the real destination on a payment-related code.
- Immediate pressure. A fine due today, an account closing, a deal expiring in minutes.
- Asking for too much. Card details, a one-time code, or a login, straight after a scan.
- An app install prompt from anywhere other than the App Store or Google Play.
The five-second check
- Decode without opening. Our scanner shows the address and waits — it never navigates on its own.
- Read the domain from right to left. The part just before the first single slash is the real host.
- If money is involved, stop. Type the organisation’s address in yourself instead.
- Never enter card details, passwords or one-time codes on a page you arrived at by scanning a code in public.
If you already scanned one
- Only loaded the page? Close it. Nothing has happened.
- Entered card details? Call your bank now and have the card stopped.
- Entered a password? Change it there and anywhere you reused it, and turn on two-factor authentication.
- Installed something? Remove it and run a security check on the device.
- Report it to Scamwatch, and contact IDCARE if identity details were exposed.
If you're a business putting codes out
- Print the code into the artwork. A code that is part of the sign cannot be peeled off and replaced.
- Print your domain beside it in plain text so customers can verify the destination.
- Point codes at your own domain, not a shortener — customers can then recognise it.
- Check your public codes regularly for stickers placed over them.
- Laminate or use tamper-evident stock in high-traffic areas.
Codes you make here are static by default: the destination is encoded in the pattern and cannot be altered remotely by anyone, including us.
Straight answers
Safety questions
Can a QR code give you a virus?
Not by itself. A QR code is just encoded text and cannot execute anything. The danger is the destination — a page that phishes your login, harvests card details, or prompts an app install. Treat a code exactly as you would treat a link from a stranger.
What is quishing?
Quishing is phishing delivered by QR code. Because the destination is hidden inside a pattern of squares, people cannot see where they are going before they tap, and codes sail past email filters that would flag a suspicious link.
How do I check a QR code before opening it?
Decode it without navigating. Our scanner shows the full address and never opens it automatically. Read the domain carefully before deciding — and when in doubt, type the organisation's address in yourself.
Are QR codes on parking meters safe?
Treat them with caution. Fraudulent stickers placed over legitimate signage on meters and public infrastructure have been reported in Australia and overseas. Prefer the council's own app or website, and look closely for a sticker sitting on top of printed signage.
What should I do if I scanned a scam QR code?
If you only loaded the page, close it. If you entered card or login details, contact your bank immediately and change the password anywhere you reused it. Report it to Scamwatch, and to IDCARE if you think your identity is exposed.