Can I get scammed by scanning a QR code on a flyer or poster?
Yes. QR codes on printed flyers can point to phishing pages, fake payment portals, or malware downloads just like digital QR codes.
Last reviewed: 1 August 2026
Explanation
Physical QR code scams — sometimes called 'quishing' — appear on flyers, fake invoices, posters, and even stickers placed over legitimate codes in public spaces. Scanning takes you to a convincing fake page that may mimic a bank login, a parking payment portal, a prize claim form, or an app download. Since the URL is not visible before scanning, it is harder to check legitimacy. Always preview the URL your scanner shows before tapping through, verify the domain matches the legitimate service, and never enter payment details or passwords on a page you arrived at via an unexpected QR scan.
QR codes shift trust from something readable to something opaque. Printed URLs can be judged at a glance; a QR square gives no hint of its destination, and context does all the persuading — a parking meter, an official-looking flyer, a restaurant table sticker. Criminals exploit exactly that by placing their codes where a code is expected, including directly over genuine ones.
Payment situations deserve the most care. Scanning to pay for parking, charging, or a fine is now routine, and fake payment portals reached by QR are correspondingly common. Where possible, use the operator's official app or type the address printed on signage rather than trusting the square — especially when the page that loads asks for card details.
Common red flags
- QR code on a sticker that appears to cover an original printed code
- Scanned URL domain does not match the expected service
- Page asks for card details, login credentials, or personal data
- Flyer arrived unsolicited by post or was left on your vehicle
What to do now
- Check the URL your scanner shows before opening it
- Do not enter payment or login information on unexpected pages
- Remove and report stickers placed over legitimate public QR codes
- Use a QR scanner app that shows a URL preview before loading
Frequently asked questions
Is it safe to scan a QR code at a legitimate business?
Generally yes, but check that the QR code is original and not covered by a sticker. If the URL shown after scanning does not match the business domain, do not proceed.
Can scanning a QR code hack my phone by itself?
Simply decoding a QR code is harmless — the risk begins with what you do next: opening the link, entering details, or installing something. A scanner that previews the URL before opening gives you a moment to judge the destination.