The uncomfortable truth first: a fake QR code and a legitimate one are identical as an image. No visual detail in the square of pixels tells you whether it can be trusted. But the attack leaves clues in the surroundings and at the destination. Here are the signs that do help — and, if you are the one issuing codes, how to make your brand verifiable.
The number one sign. INCIBE (Spain's National Cybersecurity Institute) has documented that the most common QR fraud in Spain is a fake sticker overlaid on a legitimate code. If you notice a label stuck over another one, do not scan it.
When the link opens, look at the domain before doing anything else. If you expect the city council or your bank and the domain is odd, shortened or misspelled, close it.
“Pay now or a surcharge applies.” Haste is the classic tool of fraud: it pushes you not to check the domain or your usual payment method.
A menu or an opening-hours page does not need your card or your ID number. If a QR code with an innocent context jumps straight to a form asking for sensitive data, be wary.
Stretched logos, typefaces that do not fit, a QR code printed on a different paper from the rest. Forgeries tend to have small cracks.
If scanning sends you through several redirects before you land anywhere, that is a common pattern to throw you off. A verifier shows you the full chain.
Codes from a careful brand can be verified. If there is no way to confirm the origin, treat it with the same caution as a link from a stranger.
It is worth being frank: research on user behaviour consistently says that most people check nothing before scanning, and that browser warnings are very often ignored. A list of good practices helps, but it does not solve the underlying problem, because it depends on each person stopping to look at the worst possible moment.
That is why the real weight of the defence does not fall on the citizen who scans, but on the organisation that issues the codes. If your QR codes can be verified, you have an objective answer when an incident happens: a journalist, a city technician or a worried customer will check, and you can say “our code can be verified; that one cannot”.
You cannot stop someone from printing a fake QR code. You can make their imitation give itself away.
Have all your codes come from your domain. Users see your brand in the address, not an anonymous shortener.
Each code carries a signature that only your key can generate. A copy without a valid signature fails the check.
With the Qmarque verifier, anyone can check in their browser whether you issued a code, with no app and no account.
You cannot always tell at a glance: a fake QR code and a legitimate one are identical as an image. The most reliable signs are the surroundings (a sticker placed over another code, a tampered poster) and the destination domain: if, when you open the link, the domain does not match the organisation you expect, stop.
Yes. INCIBE, Spain's National Cybersecurity Institute, has documented that the most common vector of QR fraud in Spain is precisely fake stickers placed over legitimate codes on parking meters, café terraces and EV chargers. If you notice an overlaid sticker, do not scan it and tell whoever is responsible for the place.
Sometimes, but you cannot rely on it: many users ignore browser warnings, and recent phishing sites are not yet on blocklists. Checking the domain by hand is still your best tool.
Publish your codes under your own domain and sign them, so that anyone can check with a public verifier that the code was issued by you. It does not stop someone from printing a fake QR code, but it does make their imitation give itself away when verified.
More about quishing and how to respond.
With Qmarque, every code can be signed and live on your own domain. When the next fake QR code story hits the news, you will be able to say: “ours can be verified.”