I was at a parking meter in Melbourne CBD last year when I noticed something odd. The QR code for the parking app had a slightly raised edge, like a sticker placed on top of another sticker. Someone had literally pasted a fraudulent QR code over the council's legitimate one. If I'd scanned it without looking closely, I'd have been entering my credit card details on a scammer's payment page instead of paying for parking.
QR codes are everywhere now. Restaurant menus, parking meters, event tickets, business cards, product packaging. We've been trained to scan them without thinking, and scammers have noticed. "Quishing", QR code phishing, increased by over 400% between 2023 and 2025, and it's still climbing.
Here's how to scan QR codes safely on your phone without leaving yourself open to attack.
How to Safely Scan on iPhone
iPhones have had a built-in QR scanner in the Camera app since iOS 11. Open your camera, point it at the QR code, and a notification banner appears at the top showing you the URL. This is the crucial moment, read the URL before you tap the banner.
If the URL looks legitimate (the correct domain, HTTPS, no strange characters), tap to open it. If anything looks off, unusual domain extension, misspelt company name, unfamiliar domain entirely, don't tap. Our guide on checking if a link is safe covers URL red flags in detail. Instead, take a screenshot of the QR code and upload it to a QR code scanner that checks the destination for threats.
You can also access the QR scanner from Control Centre. Swipe down from the top-right corner, tap the QR code icon, and scan. Same process, always read the URL preview first.
How to Safely Scan on Android
On Android 13 and later, open the Camera app and point it at the QR code. A link preview should appear on screen. On older Android versions, you might need to enable "Google Lens suggestions" in your camera settings, or use Google Lens directly from the search bar widget.
Just like on iPhone, the key step is reading the URL preview before you tap. Android shows you where the link goes, take that half-second to actually look at it. If the parking meter QR code shows a URL like "park-pay-melbourne.xyz" instead of the council's official domain, don't open it.
Samsung phones have a built-in QR scanner in the camera app as well as through Bixby Vision. Either works fine, just preview the URL.
How to Spot a Tampered QR Code
Physical QR code scams rely on placing fake stickers over real ones. Before you scan any QR code in a public place, check for these signs:
- Stickers on top of stickers, Feel the surface. If there's a raised edge or multiple layers, someone may have placed a fraudulent code over the original.
- Different print quality, The fake code might be printed on a different type of paper or have slightly different colours compared to the surrounding signage.
- Misalignment, A sticker placed hurriedly over an existing code often sits at a slight angle or doesn't perfectly cover the original.
- Unexpected locations, QR codes stuck to random surfaces like lamp posts, bus stops, or ATMs with vague instructions like "Scan for a free gift" are almost always scams.
Where QR Code Scams Happen Most
Parking meters and EV chargers. Scammers stick fake QR codes over the legitimate payment codes. You think you're paying for parking or electricity, but you're entering your card details on a phishing site. Always check if the QR code looks like a sticker placed on top.
Restaurant tables. During the pandemic, QR menus became standard. Some scammers have exploited this by replacing restaurant QR codes with ones that lead to fake ordering pages that harvest payment details. If a menu QR code asks for your credit card before you've even ordered, close the page.
Email and text messages. Scammers now embed QR codes in phishing emails because traditional URL filtering doesn't scan images for encoded links. An email showing a QR code asking you to "verify your account" is almost certainly a scam.
Flyers and posters. Fake investment opportunities, cryptocurrency scams, and too-good-to-be-true offers distributed via QR codes on printed materials in public spaces.
What to Do if You Scanned a Dodgy QR Code
If you scanned a QR code and the website looks suspicious, close it immediately. If you entered any login details or payment information, change those passwords straight away and contact your bank to flag the transaction. Run a security scan on your phone and keep an eye on your accounts for unusual activity over the following weeks.
If you haven't entered any information, you're most likely fine. Simply closing the page is usually enough. Modern phones are quite resistant to drive-by malware installations, especially if you keep your operating system updated.
One Habit That Keeps You Safe
Every phone shows you a URL preview when you scan a QR code. Every single one. The habit I'm asking you to build is this: actually read it. That's it. Two seconds of reading the URL before you tap. Not "glancing at it", actually reading the domain name. Is it the company's real domain? Does it end in .com.au or .gov.au like you'd expect? Or is it some variation with extra words, unusual extensions, or an IP address?
That one habit, read before you tap, is the entire defence. Everything else is just detail.