Why QR codes get abused
A QR code is just text drawn as a pattern. You cannot read it by eye, so a harmless link and a harmful one look the same. Fraudsters rely on that, and on the habit of scanning first and thinking later.
Quishing means phishing through a QR code. The code opens a page that looks like your bank, a parcel service or a login screen and asks for a password, an OTP or card details. The code itself does no harm. The page it opens is the danger.
Before you scan
Look at the code and the place it sits in. Is it printed as part of the poster, menu or board, or does it look stuck on top? Do the edges of a sticker lift, or is the print slightly different from the material around it? Did it arrive in an unexpected email, SMS or letter asking you to act quickly? Any yes is a reason to slow down and look again.
Sticker overlays are the classic trick. Someone pastes a new code over a genuine one on a parking meter, restaurant table or shop counter. Run a fingertip over the code. A raised edge or a second layer is a reason to stop.
Urgency is the other warning sign. Messages that say your account will close today, or that a delivery fee is due, want you to move before you think.
Check the preview before you open
Most phone cameras show a small preview of the link under the code. Read it, rather than tapping straight through. A few things to look for:
- The domain is the one you expect. Read it from right to left up to the first slash.
- No odd extra words, such as a bank's name followed by a different domain.
- Shortened links hide the real address. Treat them with extra care.
- A page that asks for a PIN, password or OTP straight away is a red flag.
The QR code scanner on this site decodes the code on your device and shows the full address as text before you open anything. For a WiFi, contact or UPI code it shows what is inside as well. Nothing leaves your device.
UPI QR codes: pay carefully, receive freely
One rule prevents the most common UPI scam: you never need to scan a QR code, or enter your UPI PIN, to receive money. A PIN is only for sending. If a stranger asks you to scan a code to get a refund or a payment, you are about to pay out.
When you do pay by scanning a shop's code:
- Wait for your UPI app to show the payee name.
- Compare that name with the shop you are standing in.
- Check the amount before you type your PIN.
- After paying, look at the confirmation on the shopkeeper's side too.
If the name shows a stranger's personal name at a company counter, ask before you pay. It can be a genuine small business, but it can also be an overlay sticker. A quick question costs nothing.
Make your own codes easy to trust
If you put a code on a menu, a flyer or a counter, you are asking people to scan it. Give them reasons to trust it.
- Print a short line of words beside the code saying what it does, such as Scan to see the menu.
- Print the plain web address in small type under the code, so people can type it in if they prefer.
- Use a link on a domain you control, and avoid chains of redirects.
- Test the printed copy on two different phones before you hand it out.
The QR code generator shows the exact text stored inside the code, so you can confirm it before you download. Its printable card adds a heading and a caption for you. For payments, the UPI QR code generator builds a card with your payee name and UPI ID printed beside the code, so customers can match them against what their app shows.
Printed static codes cannot be edited, so a pasted sticker is the main risk. Put the code inside a frame, behind a clear cover, or on a surface that is hard to peel. Check it on your own phone every few days. To understand when a code can be changed after printing, read static vs dynamic QR codes.
If you already scanned something suspicious
Close the page, and do not type anything into it. If you entered a password, change it now and turn on two-step verification. If you shared card or UPI details, call your bank using the number on your card or in its official app, and report the transaction. Do not use a number printed on the suspicious page.
Questions people ask
Can scanning a QR code alone infect my phone?
Scanning only reads the text. Harm usually comes from what you do next, such as opening a fake page, entering details or installing an app. Preview the link first and be careful at that step.
Do I need to scan a QR code to receive money by UPI?
No. You never need to scan a code or enter your UPI PIN to receive money. If someone asks you to, treat it as a scam.
How can I tell if a QR code on a shop counter was replaced?
Look for a sticker on top of the original, lifted edges or mismatched print. Then check that the payee name in your UPI app matches the shop before you pay.
Should I avoid QR codes that use shortened links?
Be more careful with them, because the real destination is hidden. Preview where they lead, or scan them with a tool that shows the full address first.
What does the scanner on this site show for a link code?
It shows the full decoded address as text before you open it. For other types it shows what is inside, such as the WiFi name or the UPI payee and amount.
Updated 2026-10-14 · Written by the CodingMarble team