What are the warning signs that a QR code may have been tampered with?

What tampering looks like in the real world

A tampered QR code is usually trying to redirect you somewhere you did not expect. The most important clue is mismatch: the code’s appearance, placement, or destination does not fit the object, setting, or normal business process around it. In practice, that means treating the QR code itself as part of the trust boundary, not as a harmless printed shortcut.

Physical clues matter first because the attack often starts with an overlay. A sticker, a second label, uneven edges, fresh adhesive, or a code that sits slightly crooked over an existing one can indicate replacement rather than original printing. On terminals, posters, receipts, and signs, look for a code that seems newer than the surrounding material or positioned where the original placement looks disturbed.

Behavioral clues matter just as much. If scanning the code leads to a payment page, login page, or app download that is unrelated to the nearby context, treat that as a warning sign. A QR code in a car park should not unexpectedly send you to an unrelated domain, and a code on a store poster should not silently redirect to a site that has no obvious connection to the business you are standing in front of.

Context mismatch is the strongest detection signal

The safest way to judge a QR code is to compare the code with the environment before you scan. A legitimate code normally has a clear reason to exist where it is placed, such as a ticketing kiosk, menu, Wi-Fi sign-in sheet, or official payment terminal. If the code is isolated, recently added, or used in a place where customers are being pushed to act quickly, the context deserves extra scrutiny.

Watch for signs that the destination is trying to take advantage of urgency or routine behavior. Scams often rely on people scanning without pausing to verify the source. That is why the surrounding context matters: if the code asks for a payment, credential entry, or software install, verify the issuer through a separate trusted path before continuing.

For readers who want a fuller map of how these scams work, the QR Code Phishing (Quishing) Guide covers common quishing patterns, including QR codes on posters, emails, PDFs, and payment touchpoints.

Safer checks before you scan

If the code looks altered, the practical response is to pause, inspect, and avoid scanning until you can confirm the source. The simplest check is to compare the visible branding, the physical attachment, and the expected destination. If any one of those is off, use an official website, app, receipt, or customer service number you already trust instead of the code itself.

It also helps to preview the link before opening it. Many mobile scanners show the destination domain before you commit. A suspicious shortening pattern, a lookalike domain, or a URL that is unrelated to the venue or company should be treated as a stop signal, especially when the code is used for payment, login, or account recovery.

When the QR code is part of a sign-in or approval flow, caution is even more important. Cross-device and QR-based flows can be legitimate, but they also create an opportunity for abuse if the code is swapped or the session context is not what you expected. The Cross-Device Flow Security Guide explains why these flows need careful confirmation of both the device and the destination.

Risk and Threat Considerations

QR tampering is attractive because it exploits trust at the point of action. A successful swap can divert a payment, steal credentials, or place the victim on a phishing site before they have time to question the link. The danger rises in public spaces, shared terminals, and any setting where people expect QR codes to be routine and benign.

Failure mechanism: An attacker overlays or replaces the original code, then relies on the victim to scan first and verify later. If the destination imitates a legitimate service, the user may enter credentials or payment details into an attacker-controlled page.

Impact: The result can be credential theft, fraudulent payment redirection, account compromise, or a broader phishing chain if the same stolen data is reused elsewhere.

Practitioner Guidance

What to verify: Verify that the physical code still matches the source that should own it. On public-facing assets, check for overlay stickers, lifted corners, reprinted labels, and any mismatch between the venue, the branding, and the destination domain.

Decision rule: If the QR code looks altered or the destination does not fit the context, do not scan it. Use a known official channel instead, such as the organisation’s website, app store listing, printed customer-service information, or a bookmarked link.

Practitioner takeaway: The key judgement is not whether the code can be scanned, but whether its physical form and destination still match the trust you are being asked to place in it.

Related resources from NHI Mgmt Group

• What are the signs that a QR code phishing attempt is likely to be malicious?
• What are the signs that a source package has been tampered with even when its library code looks clean?
• What are the signs that QR code authentication is being misapplied?
• What are the signs that a QR code phishing attachment is designed to evade automated scanning?