Fake QR codes

A QR code is unreadable by a human — that is its convenience and its weakness. A sticker over the real code costs almost nothing, looks like part of the sign, and leads wherever the person who stuck it wants.

Where they turn up

• Parking machines and payment terminals. People are in a hurry and pay without looking.
• Café tables. The menu code is replaced with a “pay for your booking” form.
• Delivery and parcel notices. “Pay the storage fee using this code.”
• Utility bills in the letterbox — an entire fake invoice gets printed.
• Charging stations and bike hire. Paying by code is natural there, so nobody expects a swap.

What to check

1. The sticker itself

   Run a finger over it: a code stuck on top can be felt at the edges. A fresh sticker on a faded sign is a sign in its own right.

2. The address before opening

   The camera shows the link before it opens. Look at the end of the address before the first slash — that is the real domain, everything else is forgeable. The techniques are covered in phishing.

3. What the page asks for

   Paying for parking does not require your banking login. A café menu requires nothing at all. Any login form after scanning a code in the street is a reason to close the page.

4. An alternative route

   A real car park has an app and a number for SMS; a café has a paper menu. If a code is the only way, that is also a question.

If you already entered details

1. Block the card

   If you entered its details — immediately, without waiting for a charge.

2. Change the password

   If you entered a login and password, do it on the real site by going there yourself. Then follow the leak procedure.

3. Check what got installed

   If a file downloaded from the link and you opened it, review your app list and remove anything unfamiliar.

4. Tell the owner of the place

   A café or car park usually does not know about the sticker. One message protects everyone after you.

This applies to your own codes too

If you display a QR yourself — on a business card, in a venue, on packaging — a fake sticker damages your reputation, not the reputation of whoever placed it.

• The code is printed, not stuck on top
• The address is written out beside it — it can be typed by hand
• It leads to my own domain, not to a link shortener
• I check periodically that the code is in place and has not been covered

You can make a code here — it is built in the browser and sent nowhere — and for a venue a Wi-Fi connection code is handy.