QR code scams: how to spot one and stay safe
By Jessopradesh John Rose, Founder, QR Studio · Updated November 2026
A QR code is only a picture of an address. Scammers use that: they stick their own code over a real one, or send a code that opens a fake page. Nothing about the picture tells you where it leads, so the check has to be yours. Here is what to look for, and what shops can do.
How the scams work
Most cases fall into three kinds:
- A sticker placed over a real code (a parking meter, a restaurant table, a shop counter) so the money or login goes to someone else.
- A code in a message or poster that opens a copy of a bank, delivery or government page and asks for your details.
- A code that asks you to scan to receive money. Receiving money never needs a PIN or a scan, so this is always a trick.
Check before you scan
Take two seconds to look at these:
- Is the code a sticker on top of another print? Run a finger over the edge.
- After you scan, read the address your phone shows before you open it. A bank or shop name spelled slightly wrong is a warning.
- Never enter a UPI PIN, card number or password to receive money or a refund.
- Be careful with a code that came in a message from someone you do not know, or that promises a prize.
Before you pay with a UPI code
The payment screen shows the name of whoever you are paying. Check it matches the shop before you enter the amount. If it shows a personal name where you expected a business, ask the staff first.
If you run a shop or office
Protect your own code so no one can swap it:
- Print your name and UPI ID in text under the code, so customers can compare.
- Put the code behind a clear cover or inside the counter, where staff can see it.
- Check it every morning, and look at your bank credits during the day.
- Use a code that shows your shop name on the payment screen.