Spot QR‑code scams: When the code doesn’t lead where it should

Why scammers love QR codes

A QR code is just an address in a box-like format. Unlike a link, you can't see where it leads before scanning it. That's exactly what scammers exploit: they replace authentic codes with their own or send new ones – often ending up on a smartphone, where the address bar is small and easy to swipe away. This type of scam is commonly known as "quishing."

Common tactics

• **Parking meters and charging stations:** A sticker with a QR code placed over the real code directs you to a fake payment page designed to steal card details.
• **Letter from your "bank":** A realistic-looking letter asks you to "verify" your account or set up a new process via a QR code.
• **Email with a QR code instead of a link:** This is used to bypass spam filters that scan links. The code typically leads to a fake login page.
• **Restaurants, posters, package slips:** Anywhere codes are posted publicly, someone can stick a fake one over the original.

How to check a QR code

• **Look closely:** Is the code a sticker on a sign or machine? Does it look crooked, doubled, or appear peelable? If so, avoid scanning it.
• **Read the URL before you open it:** Most camera apps display the destination address first. Check if it actually belongs to the official operator – the part right before the extension (.de, .com, etc.) is what matters.
• **Use our QR code check:** Upload a photo of the code to see where it really leads – before you open it. You can then use the link check to further verify the URL.
• **Take the safe route when in doubt:** Pay for parking via the app or website you installed or typed in yourself, or pay directly at the machine.

Never share via a QR code

• Enter bank credentials, TANs (transaction numbers), or card details unless you are absolutely sure who owns the website.
• Install apps that a code "recommends" – only download apps from your phone's official app store.
• Scan bank or government entities never ask you to verify your account via a QR code in a letter. If in doubt, call them at their known official number.

If it’s already happened

• If you entered card details: block your card immediately and notify your bank.
• If you entered a password: change it immediately (also on any other sites where you use it) and enable two-factor authentication.
• Report fake stickers to the machine operator or the city so others don’t fall for the scam. Our first-aid page will guide you through the next steps.

What about the VPN?

A VPN encrypts your connection, for example when using public Wi-Fi at a train station. It doesn’t change where a QR code leads – you verify that with the QR code check and by inspecting the URL.