QR code scams rely on something you would never think twice about: scanning a code that has been sitting in a public place, on a parking meter, a restaurant table, or an EV charger, exactly where you would expect one to be.
Nothing about the code itself looks wrong. It scans instantly, the way every other code you have ever used has scanned.
The difference is that this one was never placed there by the business at all. It was stuck over the genuine code by someone who never had to touch a single wire to pull it off.
This post covers how fake codes are actually deployed, the specific physical locations where they show up most, what happens the moment you scan a malicious one, and exactly how to scan any QR code more safely. It is part of our wider guide to how fake messages, emails and calls deceive people every day.
How Are Fake QR Codes Actually Deployed as Attack Vectors?
A QR code is just an image encoding a web address, which means anyone with a printer and an adhesive sticker can generate and place a working one within minutes, no technical skill required at all.
Quishing, QR code phishing, increased 587 percent through 2024 and kept climbing into 2025, with parking payment and package delivery lures among the most common formats, according to Perception Point’s 2025 Cyber Security Report.
Unlike a phishing email, a QR code is a physical object that can be physically swapped. The code standing on a wall today is not necessarily the one that was there yesterday, and there is rarely any obvious sign of tampering to catch by eye.
Some fraudulent codes link straight to a fake payment page mimicking the real business. Others link to a credential harvesting page instead, built to capture whatever login details you type in next.
Where Do These Codes Show Up Most Often?
Parking meters and EV chargers are two of the most common locations, since drivers are often in a hurry and rarely question a payment step that looks entirely routine.
The FBI’s Internet Crime Complaint Center issued a formal warning in 2025 about exactly this pattern at EV charging stations and parking meters across the US, after criminals placed sticker-over codes directing drivers to fake payment pages, with some losing hundreds of dollars before the fraud was discovered.
QR code scams follow the same physical logic in India too, a fake sticker over a genuine UPI code at a shop counter, a market stall, or a parking gate, redirecting a routine payment straight into a scammer’s account instead of the seller’s.
Restaurant tables carry the same risk now that many venues have switched to QR code menus and payments, a shift that has quietly normalised scanning an unfamiliar code without a second thought.
Public transport stickers and posters extend the same trick into stations and stops, where a fake code promising a discount or a ticket refund can reach hundreds of people in a single day.
When physical spaces like these become digital attack surfaces, the usual caution people apply to suspicious links online simply does not carry over, since a code on a wall still feels inherently more trustworthy than a link in a text.
QR code scams spread fastest wherever payment has become the expected next step after scanning, since that expectation is exactly what a fraudulent code is designed to exploit.
What Actually Happens When You Scan a Malicious Code?
Most scans lead to a fake payment page requesting card details for a small, believable amount, parking, a toll, a delivery fee, small enough that the charge does not immediately raise suspicion.
The small amount matters here more than it might seem. A charge of a few hundred rupees rarely triggers the same alarm a larger, unexpected transfer would, which is exactly why fraudulent codes are so often priced this way.
Some codes instead trigger an app download prompt disguised as a required step to complete payment, installing something considerably more invasive than a simple checkout page, sometimes requesting remote access permissions under the guise of finishing the transaction.
Others route to a cloned login page for a familiar service, the same credential harvesting trick covered in our guide to phishing, smishing and vishing and how to spot every type of fake message, just delivered through a different format.
The curiosity that makes an unfamiliar QR code hard to resist scanning is worth understanding too, a pull covered in more depth in our guide to why curiosity gets people hacked and how to pause before you click.
How Can You Scan Any QR Code More Safely?
Check the code physically for a sticker layered over another one, a slightly raised edge or a different texture from the surrounding surface is often the only visible clue.
Read the web address that appears before the page fully loads, most phones show a preview of the destination link before you tap through to open it, and that preview is worth the extra two seconds it takes to check.
Avoid entering payment or login details immediately after scanning any public code. Where possible, use the business’s own official app or website directly for payment instead.
Confirm the payee name displayed after scanning a UPI code matches the business you expect before authorising anything, since a mismatched or unfamiliar name is one of the clearest signs a code has been swapped.
Review which apps on your phone have camera and QR scanning permissions regularly, a habit covered in more depth in our guide to why an app wants your microphone and what app permissions actually mean, since some scanning apps request more access than the task genuinely needs, sometimes including contacts or storage that a simple scanner never actually requires.
If you have already entered payment details after scanning a fraudulent code, contact your bank immediately and report it through India’s National Cyber Crime Reporting Portal or the 1930 helpline.
Frequently Asked Questions
How can I tell if a QR code has been tampered with?
Look closely for a sticker placed over another code, a slightly raised edge, mismatched paper texture, or crooked alignment compared to the surface around it. When in doubt, use the business’s official app or website instead.
Are QR codes at parking meters and EV chargers actually risky?
Yes, these are among the most commonly targeted locations for QR code scams, since drivers are usually in a hurry and rarely question a routine-looking payment step.
What should I do if I already entered payment details after scanning a fake code?
Contact your bank immediately to flag the transaction, then report it through cybercrime.gov.in or the 1930 helpline with any screenshots you have.
What This Comes Down To
QR code scams work precisely because a code on a wall feels more trustworthy than a link in a message, even though either one can be swapped by anyone with a printer.
The one habit that protects you: check the destination address before you trust the scan, and use the business’s own app or site directly whenever payment is involved.
If this was useful, share it with someone who needs to know.
1 comment
Comments are closed.