Fake QR Code Scams: How to Check Before You Pay

You walk up to a counter, see the familiar "Scan to Pay" sign, point your phone at the QR code, and pay in three seconds. That speed is exactly what makes one specific scam so effective: someone prints a fake QR code sticker, presses it directly on top of the shop's real one, and walks away. Every customer after that scans the fake code instead of the real one — and every payment goes straight to the scammer's account instead of the shop's, with the shop owner often not finding out until the day's takings don't add up.

This is different from most QR scam stories you've probably read — fake parking tickets, phishing emails, delivery notices. Sticker-swap fraud at a real, physical shop counter is its own distinct scam type, and unlike email-based QR phishing, it has a genuinely reliable, physical way to check for it before you ever tap "confirm." This guide walks through exactly how the scam works and the specific checks that catch it, every time.

How the Sticker-Swap Scam Actually Works

The mechanics are almost embarrassingly simple, which is exactly why the scam spreads so easily. A scammer generates a QR code linked to their own payment account, prints it as a sticker roughly the same size as a typical merchant payment code, and visits a shop — usually somewhere busy, low-supervision, and cash-register-adjacent, like a counter, a table tent, or a payment stand near the door. They press the fake sticker directly over the real QR code, often during a quiet moment when staff aren't watching the exact spot, and leave.

From that point on, every customer who scans the code is actually paying the scammer, not the shop. The shop appears to be running normally — customers scan, customers pay, the shop assumes payment was received — but the money is landing in an account the business has never heard of. This is precisely why the scam can run for hours, sometimes days, before anyone notices: nothing about the customer experience looks broken. The scan works, the app opens, a payment screen appears. The only thing wrong is a name that most people never actually read.

This Scam Type Is Genuinely Widespread

This isn't a rare, isolated trick. Security researchers have documented cases of fake QR code stickers placed over legitimate codes across roughly 200 store locations in a single campaign, causing a measurable drop in successful legitimate scans and significant cleanup costs for the affected businesses. Separately, national consumer-protection agencies have issued specific public warnings about QR codes being covered with fraudulent stickers at parking meters, payment stands, and public notice boards — confirming this is treated as an established, recurring fraud pattern rather than a one-off news story.

Independent research also shows how often people simply don't check at all: a large majority of smartphone users report scanning QR codes without verifying where they lead first, and tens of millions of scans have been documented redirecting people to fraudulent destinations. The pattern holds worldwide — this same sticker-swap method has been documented over parking payment machines, restaurant table QR menus, and small retail counters across multiple countries, because the technique doesn't depend on any particular payment app or country's banking system. It works anywhere a printed QR code sits in a public, physically accessible spot.

Why This Scam Is Different From Other QR Fraud — and Easier to Catch

Most QR code warnings lump every type of scam together: fake parking tickets, phishing emails with embedded codes, malicious app downloads disguised as delivery trackers. Those all rely on digital deception — a fake website, a fake app — that you can't inspect just by looking at your phone screen. Sticker-swap fraud at a real shop is fundamentally different, because it leaves a physical trace. A sticker has edges. A sticker has a slightly different texture, print quality, or alignment than the surface it's stuck to. Unlike a phishing email, you can physically touch and inspect the thing trying to scam you — which means this specific scam type is far more checkable than almost any other form of QR fraud.

The Physical Checks: What to Look at Before You Even Scan

Check the edges first. Run your eye — or your thumbnail, if you're comfortable — around the border of the QR code. A genuine, professionally printed merchant code is usually flush with the surface it's printed or mounted on. A sticker placed on top of it will almost always have a slightly raised edge, a corner that's starting to lift, or a visible rectangular outline where the sticker doesn't quite match the surface underneath.

Look for a mismatch in material or print quality. If the surrounding sign is glossy, laminated, or professionally printed, but the QR code itself looks like a matte sticker with slightly duller colours or a slightly different white background, that mismatch is a strong warning sign. Scammers print these stickers cheaply and quickly — they rarely match the exact paper stock, gloss, or print resolution of the original signage.

Check if it's crooked. A shop's original QR code is typically printed as part of the sign and sits straight, aligned with the rest of the design. A sticker slapped on afterward, often quickly and without much care, is frequently tilted, slightly off-centre, or not quite parallel with the edges of the sign around it.

Look underneath, if you can. If a corner is lifting even slightly, you may be able to see a hint of a different QR code pattern underneath. If you can see any trace of ink or pattern peeking out from under the edge of the sticker, do not scan it — tell staff immediately instead.

The Digital Check: What Your Phone Can Tell You Before You Confirm

Even a well-placed sticker that passes the physical inspection can still be caught at the next step, because every genuine QR payment flow shows you one critical piece of information before you complete the transaction: the recipient's name.

Read the merchant name on the confirmation screen — every single time. When you scan a payment QR code, your banking or wallet app will display who you're about to pay before asking you to confirm the amount. This is the single most reliable check available, because it doesn't depend on the sticker looking convincing at all — it depends only on you actually reading four or five words on your screen before tapping confirm. If the name shown doesn't match the shop you're standing in — a generic-sounding trading name, an individual's personal name, a business name from a different city — stop immediately and do not proceed.

Never trust a name that "sounds close enough." Scammers sometimes register accounts under names deliberately similar to common shop names, hoping a rushed customer glances at the screen without reading closely. If the name isn't an exact, confident match to the shop you're in, treat that as a red flag worth a five-second pause.

If your payment app previews the underlying link or ID before scanning fully commits, use that preview. Many modern payment and camera apps show you the destination — a merchant ID, a payment handle, or a URL — before opening the actual payment screen. Get in the habit of glancing at this preview rather than immediately tapping through it.

The Behavioural Check: Confirm With the Shop Directly

The single most reliable check of all doesn't involve your phone at your first visit to inspect the sticker — it involves the shopkeeper. After paying, most digital wallets and banking apps send an instant notification or SMS confirming a received payment. Before you walk away, especially at a smaller shop or stall where staff might not be actively watching a screen, it costs nothing to ask: "Did that come through?" A shop that isn't receiving a notification for a payment a customer insists they just made is very possibly the victim of exactly this scam — and your question might be the first sign they get that something's wrong.

If You Run a Shop: How to Protect Your Own QR Code

If you're a shop owner rather than a customer, the sticker-swap risk runs in the opposite direction — protecting your own revenue rather than your own payment. A few simple habits meaningfully reduce your exposure. Laminate your QR code sign and check it physically at the start of each business day, specifically looking for the same signs a customer should check: lifted edges, mismatched print quality, or a code that's been nudged out of alignment overnight. Consider placing your QR code somewhere staff can see it during business hours, rather than in a low-visibility corner, since sticker-swap fraud depends heavily on the code being unsupervised long enough for a scammer to tamper with it and leave unnoticed. If your payment provider supports it, periodically cross-check your own QR code by scanning it yourself and confirming your own business name appears correctly — a quick habit that costs seconds and catches tampering immediately rather than days later when your reconciled takings don't match what customers say they paid.

What to Do If You Already Paid the Wrong Account

If you've already confirmed a payment and only afterward suspect the code was tampered with, act immediately rather than waiting. Contact your bank or payment provider's fraud or support line straight away — the sooner a suspicious transaction is reported, the higher the chance of a reversal or freeze before funds move further. Take a photo of the physical QR code sticker exactly as you found it, including its position and any visible tampering, since this evidence helps both your bank's investigation and the shop's own report to their payment provider. Report the incident to the shop itself immediately, since they may have no idea their code has been compromised, and every additional customer who scans it afterward loses money the same way you did.

The One Habit That Matters Most

Every check in this guide compresses down to a single, five-second habit: look at the sticker's edges before you scan, and read the name on the confirmation screen before you tap pay. Sticker-swap QR fraud survives entirely on speed and inattention — it cannot survive a customer who pauses for five seconds and actually looks at what they're about to confirm. That pause costs you nothing. Skipping it can cost you the entire amount you meant to pay someone else.