How to spot a QR scam

A QR scam (“quishing”) is a fake QR code that sends you to a page that looks like the real one. The goal is almost always your login, your card number or a payment.

Where they are

On parking meters and chargers, stuck on top of the real code. On posters and flyers. In emails and letters saying a parcel is waiting or that you owe a fee.

Five signs of a scam

1. The address is almost right. rnicrosoft.com instead of microsoft.com, postnord-delivery.com instead of postnord.com.
2. The link is shortened. bit.ly and the like hide where you end up.
3. There’s a number instead of a name. For example http://45.13.22.101.
4. It’s urgent. “Pay within 24 hours”, “your parcel will be returned”.
5. It asks for a login or card details on a site you don’t know.

What to do

Look at the code itself: is there a sticker on top of another one? Read the domain before you open it. If in doubt, go to the real site yourself, by typing the address or using the official app.

SikkerQR shows the domain in large type and warns about the known tricks – but no list catches everything.