QR-code scams are everywhere — here is how to scan safely
A square of dots can take you anywhere, and you cannot see where until it is too late. Here is how to scan codes on menus, parking signs, and posters without getting caught out.
The parking sticker that stole his card
James parked on a side street, walked up to the meter, and scanned the QR code printed next to the slot. His phone opened a clean-looking page that asked for his car details and his card number. He paid, saved the receipt, and walked off.
Two hours later, his bank texted to flag €400 in charges from a hotel in another country. The QR code he scanned was a sticker, glued on top of the real one — and the real meter was free to use that day anyway. Scams like this are now the fastest-growing kind in cities across Europe.
Why QR codes are easier to fake than links
On a website, you can hover over a link and see where it really goes before you click. With a QR code, you have no idea what address is hidden inside until you scan it. A scammer can print a sticker that takes you anywhere, and the only clue that it is fake is the sticker itself.
The most common places to find fake codes are parking meters, restaurant tables, charging points, public notices on lampposts, and 'package delivery' cards left at your door. Some scammers simply cover the real QR code with a sticker that looks almost identical. Once you scan, the page you land on usually looks completely real, which is exactly what makes this scam work.
The two-second check before you pay
Use your phone's built-in camera or QR app rather than a random scanner from the app store, because the built-in one shows you the web address before opening it. Read that address carefully — a real parking site will have a name you recognise, while a scam will use random letters or an unfamiliar domain. If it looks off, do not tap it; just close the camera and pay another way.
Check the physical code for signs of tampering, such as a sticker stuck over another sticker, an off-centre square, or fresh tape. When in doubt, search for the official app of whatever you are paying for, and use that instead of any printed code. On restaurant menus you can almost always order at the counter, and the saved five seconds is never worth a stolen card.
How Sorinify stops the scam after you scan
Even with every check above, you will eventually scan one that looks fine but is not. Sorinify steps in the moment your browser opens the page hidden inside the code. If the address belongs to a fake parking site, a fake payment form, or any other scam we have seen, you get a warning before the page loads.
Your card details never reach the form, because the form never opens on your screen. This catches the hardest part of the scam — the moment between scanning a sticker and typing in a card number — without you having to think about it. Scan if you must, and let Sorinify check the destination for you.