A real code replaced or invented. The destination is invisible until you scan, which is exactly what makes the method work.
A QR code is a URL that you cannot read. That single property is what makes it useful for a scam: the code is the only thing you see, and the destination is hidden until your phone opens it.
The most common version is a sticker placed over a genuine code — on a parking meter, a restaurant table, a parcel locker, a poster.
Where it appears
- A sticker on top of another sticker. Look for raised edges, mismatched colour or a code that is slightly crooked.
- Payment requests in places where payment normally happens through a terminal or a dedicated app.
- Letters and parcels: a code on an unpaid-delivery notice that leads to a card form.
- Emails and messages, where the code is a way around link scanning — the text contains no link at all.
- Parking, charging stations and public transport, where a code is the only obvious way to pay.
What makes it work
- The destination is invisible. It can be a lookalike domain, a redirect chain, or a page that loads a second code.
- Previewing is not universal. Many camera applications open the link immediately.
- A PDF or an email with an embedded code bypasses link-checking entirely, because there is no link to check.
- The page it opens usually has no relationship to the place where the code was found.
How to scan safely
- 1Check whether the code is printed or stuck on. Anything stuck on can be somebody's addition.
- 2Use a scanner that shows the URL and waits for you to confirm, rather than one that opens it directly.
- 3Read the domain before you continue — the part immediately before the first single slash.
- 4If a code asks for a card, a password or a payment, use the merchant's own app or a terminal instead.
- 5If you already paid, call your bank today and report the card as compromised.
Frequently asked questions
Can a QR code install something on my phone?
The code itself cannot. It contains a link, and a link can only lead to a page or a file. What that page then asks you to install is the risk — never install anything a scanned code suggests.
The code opened a page that looked exactly like my bank's. How?
Copying a login page takes minutes. The tell is the domain in the address bar, not the design of the page.
I scanned one in a restaurant and it asked for my card for the tip. Was that fake?
Possibly. A code that leads straight to a card form for a bill you already pay elsewhere is the pattern. Ask staff for the terminal, or whether the code is theirs.
Written by The BaitScan team
Last updated September 16, 2026
Results are automated risk estimates based on public indicators and heuristics.