QR code tampering is when someone sticks a fake QR code over a business's real one, so customers who scan it land on a scam page or pay the wrong account. Shops protect themselves by checking codes regularly, using tamper-evident materials, placing codes where staff can see them and using dynamic links they can monitor and change.
Any printed QR code in a public place can be targeted: payment codes at the counter, menu codes on tables, codes on posters, parking signs or delivery vehicles. The good news is that a few simple habits make tampering much easier to spot and much less effective.
How QR code tampering works
The most common method is low-tech. A criminal prints a fake QR code on a sticker of the right size and places it on top of the genuine one. To a busy customer, it looks normal.
The fake code might:
- Open a copycat website that asks for card details, logins or personal information.
- Show a payment QR for a different account, so money goes to the fraudster instead of the shop.
- Lead to a page that pushes the visitor to download an app or file.
Consumer-protection agencies and banks in several countries have warned about fake QR stickers on parking meters, payment stands and public signs. For a business, the harm is twofold: customers lose money, and they often blame the shop where they scanned.
Signs a code has been tampered with
Train staff to look for these warning signs:
- A sticker with raised edges, bubbles or a slightly different size from the original.
- A code that looks newer, glossier or differently coloured from the rest of the sign.
- A second code placed next to the original with an appealing message such as "scan here for a discount".
- Damage, scratches or glue marks around the code area.
- Customers mentioning a strange page, a login request or an unfamiliar account name when paying.
Scanning is the best test. When you scan your own code, the destination should be exactly your expected link or, for a payment code, your correct receiver name.
A daily QR code check routine
Checking takes less than a minute per code once it becomes routine. Here is a simple checklist:
- Keep a list of every QR code you have on display, with its location and expected destination.
- Look and touch each code at opening time. Run a finger over it to feel for an extra sticker layer.
- Scan a sample with a staff phone, ideally a different one each day, and confirm the destination.
- Check payment codes by confirming that the receiver name shown in the banking app matches your business.
- Remove anything unexpected immediately and keep it as evidence, photographed in place if possible.
- Record the check in a simple log with the date and initials, so gaps are noticed.
An online tool such as our QR code scanner shows the destination before opening it, which makes it easy to confirm a link without visiting a page you do not trust.
Make codes harder to tamper with
Physical choices can make an overlay more obvious or more difficult.
- Print the code directly into the design of your sign or menu card instead of using a separate sticker. An added sticker then stands out.
- Use tamper-evident or destructible label material for codes that must be stickers. These tear or show a pattern if someone tries to peel or cover them.
- Place codes behind clear acrylic or inside a frame so nothing can be stuck directly on top.
- Add your business name and a short line near the code, such as "Pay only to: Your Shop Name". Customers then know what to expect.
- Keep codes in sight of staff. Codes at the counter are much harder to tamper with than those on an unattended outdoor sign.
- Avoid duplicate codes. The more codes you display, the more you have to check.
Use dynamic links you can monitor
A dynamic QR code points to a short link that forwards to your page. This gives you useful control:
- You can change the destination at any time without reprinting, which helps if your website moves or a page is compromised.
- Scan statistics show normal patterns. A sudden fall in scans from one location can mean the code there has been covered by a fake.
- Branded short links are recognisable. Customers can check that the link matches what they expect.
On QR-TH, dynamic codes use a qr-th.com/r/ short link, and every link is checked against Google Safe Browsing and re-checked nightly. Visitors can also see a loading page that shows where a link goes before it opens. These features cannot stop someone sticking a fake sticker on your sign, but they help you notice problems and keep your own links clean.
Payment QR codes need extra care
Payment codes are the most attractive target because a successful swap sends money straight to the criminal.
- Tell customers to check the receiver name in their banking app before confirming, and say so on the sign.
- Where possible, show a dynamic payment QR on a screen or terminal instead of a fixed printed sticker.
- If you use a printed PromptPay QR, check it every day and keep it close to the till.
- If a customer reports paying a different name, stop using that code immediately and contact your bank.
Our guide to QR payment safety explains what customers should check before they pay.
What to do if you find a fake code
- Remove the fake sticker and keep it. Take photos before and after.
- Check all your other codes straight away, as more than one may have been replaced.
- Put a short notice up for customers if they may have scanned it, explaining what to look out for.
- Report the incident to the police and, for payment codes, to your bank.
- Replace the code with a fresh print and review where it is placed.
FAQ
How can I tell if a QR code sticker is fake?
Look for raised edges, a different size or finish, and anything placed over the original. Then scan it and confirm the destination or payment receiver name matches your business.
Does a dynamic QR code prevent tampering?
No. A sticker can be placed over any printed code. A dynamic code helps you monitor scans and change destinations quickly, which makes problems easier to detect and fix.
How often should I check my QR codes?
Codes in public or busy areas are best checked every day, ideally at opening. Codes in staff-only or supervised areas can be checked less often.
What should customers check before paying by QR?
They should confirm that the receiver name and amount in their banking app match the shop before approving the payment.
Protecting printed QR codes is mostly about routine: know where your codes are, check them often and make fakes easy to spot. Create trackable dynamic codes with the free QR code generator on QR-TH, and use the scan statistics to keep an eye on every location.