QR codes removed a useful friction: you can no longer inspect a link before following it. That is the whole basis of the technique. It works best where scanning is normalised — car parks, restaurant tables, delivery notices, and payment terminals.
Where the codes come from
- A sticker placed over a genuine code on a parking meter, charging point, or transit poster.
- A letter or email claiming an unpaid fine, missed delivery, or tax refund requiring a scan.
- A code on a flyer or table card in a venue, replaced or added by someone passing through.
- A code sent during a conversation, framed as verification for a payment or refund.
What happens after scanning
Usually a payment page that mimics a legitimate operator and captures card details, or a credential-harvesting login page. Sometimes an authorisation request that grants a standing payment mandate rather than a single charge. In cryptocurrency contexts, a code may encode a wallet address that is not the one you intended to pay.
The checks that work
Read the URL preview your camera shows before opening it, and read it right to left: the real domain is immediately before the first single slash. Inspect physical codes for stickers over an underlying code, particularly on outdoor equipment. Where an official payment is involved — parking, transit, fines — use the operator's own app or type the address yourself rather than scanning at all.
The one rule with no exceptions
Nobody legitimate asks you to scan a code to verify your identity, release a held payment, or confirm a refund. That specific request is fraud every time, regardless of who appears to be asking or how plausible the context.