Is a QR code at a concert or event venue safe to scan?

QR code sticker attacks ('quishing') occur when fraudsters print and stick fake QR codes over official ones in high-traffic locations such as event venues, museum displays, and public transport. At a venue the fake code may lead to a convincing fake merchandise shop or 'exclusive offer' page that harvests your card details. Warning signs include a QR code that is slightly misaligned, has a sticker texture different from the sign behind it, or leads to a URL that does not match the event's official domain. Before scanning any QR code at an event, check whether it looks physically authentic and preview the URL before opening it fully. If the URL looks unfamiliar, close it and visit the official event website directly.

Events concentrate the conditions quishing needs: crowds of distracted people, an expectation of scanning codes for menus, merchandise, and Wi-Fi, and enough noise and queueing that nobody studies a poster closely. Payment-related placements are the priority targets — codes at parking machines, drink-ordering stations, and merchandise stands sit exactly where people expect to type card details seconds after scanning, so the fake checkout raises no suspicion. The physical attack costs a sheet of sticker paper, and one evening's placement can harvest cards until someone peels it off.

Calibrate trust by what the destination asks for rather than where the code is displayed: a menu or schedule that asks for nothing is low-stakes even if you cannot fully verify it, while anything leading to payment or a login deserves the extra seconds — read the full URL, prefer typing the vendor's address yourself, and pay through the event's official app where one exists. Treat card details entered after a casual scan as the risk moment, and if it has already happened, watch the card's transactions and tell your bank at the first unfamiliar charge. Reporting a suspect sticker to venue staff protects the hundreds scanning after you.