QR codes are convenient shortcuts to websites and apps. A fraudulent code can lead to a fake payment, parking, delivery or sign-in page.
Where to be cautious
- A sticker appears to cover the original code on a sign or payment machine.
- A code arrives unexpectedly by email, text or post.
- The page requests sign-in details, card information or an app download.
- The destination address is unrelated to the organisation.
Safer steps
- Inspect physical codes for stickers or tampering.
- Use the organisation’s official app when one is available.
- Check the destination shown by the phone before opening it.
- If payment or sign-in is required, navigate to the known website yourself.
If you entered information
Change exposed passwords and contact the bank immediately if payment information was involved. Keep a photograph of the code and details of its location for reporting.