A QR code on your table or flyer: is it actually still safe?

QR codes are everywhere these days: on tables, flyers, parking meters, and invoices. Convenient — but also a favourite tool for scammers. Here's how to spot a dodgy code.

QR codes are everywhere. On the menu card in the lunch café, on the flyer someone pops through your letterbox, on the parking meter outside your door, and even on some invoices. A customer scans, pays, or fills something in — done. Convenient. But that's exactly why QR codes have also become popular with fraudsters in recent years. There's even a name for it: quishing — phishing via a QR code.

The catch: you can't tell with the naked eye where a code is sending you. With a link in an email you can at least hover your mouse over it to see what's underneath. With a square full of dots, you only find out where you end up after you've scanned it — and by then the website is already open.

Where things go wrong in the office

Most business owners think of QR fraud as something that happens to consumers. But it's in the workplace where things actually go wrong. A few situations we come across in SMBs:

• A sticker placed over the original code. On charging points, parking machines, and even menus, fraudsters stick their own label over the real QR code. You scan it, land on a fake payment page, and dutifully send money to the wrong account number.
• A QR code in an email or PDF. "Scan to re-confirm your account." Because the link is hidden inside an image, it often slips past spam and phishing filters. And since people then pick up their phone, the fake site never reaches the company's secured browser.
• A flyer or poster in the waiting room. A neatly designed poster from "the council", "HMRC", or "your energy supplier" with a QR code. Who still checks whether it's genuine?
• A QR code on an invoice. More and more invoices include a payment QR code. Handy, but if the invoice itself is forged, that code won't be right either.

Five simple checks before you scan or pay

You don't need to be a security specialist to spot QR fraud. These five habits make a big difference:

1. Look at the sticker itself first. Is it covering something else? Is there a border around it, or does it stick out by a millimetre? On parking machines and charging points, that's the most common sign.
2. Check the URL before you open it. Most phones show you the link after scanning before it actually opens. Take a moment to actually read it. Does it say gemeente-amsterdam.nl or something like gemeente-amsterdam-betalen.top? Watch out for unusual extensions (.top, .xyz, .click) and subtle typos.
3. Don't trust a QR code in an email you weren't expecting a payment or login from. Banks, HMRC, and parcel couriers will never send you an unsolicited QR code to "confirm your account".
4. Pay via your own banking app instead. If you're unsure about a payment QR code: close it, open your banking app yourself, and manually enter the account number from the original invoice or letter. Two extra seconds, a lot of hassle saved.
5. Quickly check unfamiliar IBANs. Received an invoice with an IBAN you don't recognise? A quick look at who's behind it prevents nasty surprises. Our IBAN check instantly shows whether the number is valid and which bank it belongs to.

What if you use QR codes yourself

Many SMB owners actively use QR codes themselves: on business cards, in-store, at the reception desk, or in a quote. Great idea — but keep it safe for your customer:

• Print the QR code directly onto the material rather than applying a sticker over it. A sticker is exactly what a fraudster would do — and it trains customers to think "sticker" is normal.
• Include the link in readable form underneath. For example: "or visit yourbusiness.co.uk/appointment". That way someone can verify the code is correct, and anyone who doesn't want to scan has an alternative.
• Don't use link shorteners. bit.ly and tinyurl are convenient, but they hide exactly what your customer wants to see: where they're going. Use your own domain.
• Check your own posters and menus regularly. Especially if they're on the street or in a public space. See whether anyone has stuck a sticker over them. Sounds far-fetched — but it does happen.

What if things go wrong anyway?

Paid on a fake site? Call your bank immediately — the sooner you do, the better the chance the amount can be reversed. Entered your login details? Change your password on the real site straight away and enable two-factor authentication if it wasn't already on. And report it to Action Fraud; it helps warn others.

QR codes aren't the problem. They're just convenient. And anything that's convenient for you is equally convenient for someone with bad intentions. Two extra seconds of checking before you scan makes all the difference.

Handy when you encounter an unfamiliar IBAN on an invoice or payment QR code: use our free IBAN check to quickly see whether the account number checks out and which bank it belongs to. Rather have someone take a thorough look at the security of your email and website? Our email security and website security services tackle the most important risks in one go.