A parking meter has a payment sticker on it. The sticker is straight, the print is sharp, the logo matches the city's. It was also applied last Tuesday by someone who is not the city, over the original. This is the cheapest attack in existence: a printed square and some adhesive.
The defense is not paranoia. It is a thirty-second habit of reading the destination before you act on it. Here is how to actually do that, including the parts where the preview your phone shows you is misleading.
The camera preview is real, and it is partial
Both major phone platforms show you something before they open anything. Point an iPhone camera at a code and a notification banner appears with the destination. Android does the same through the camera or the built-in code reader, showing the address in a chip you have to tap.
That preview is genuine. It is also truncated, and truncation is the whole game. A banner has room for a few dozen characters, so a long address gets cut off. Attackers know exactly where the cut happens and build addresses whose visible opening looks trustworthy.
The rule that survives this: the part that determines who owns a web address is the end of the hostname, not the beginning. Read backwards from the first single slash. Find the last two labels before that slash. That is the domain in control. Everything to the left of it, no matter how many familiar brand names it contains, was chosen by whoever registered that domain.
So an address whose host ends in a marketing platform you have never heard of is controlled by that platform, regardless of which bank appears earlier in the string.
Why a domain can look right and be wrong
Beyond the ordering trick, three families of lookalikes turn up constantly.
Character substitution swaps something visually close: a zero for the letter o, a lowercase L for a capital I, or the pair r-n where an m belongs. At phone-banner size these are close to invisible.
Hyphenated variants register a real-looking name with a dash inserted, then build a page that copies the original's styling. Nothing about the page will look wrong, because it is a copy.
Mixed-script names use characters from other alphabets that render identically to Latin ones. Browsers defend against this by displaying such addresses in their encoded form, which starts with a distinctive prefix. If you ever see that prefix in an address bar, stop.
Our page on fake QR codes goes through the physical side of the same problem, including how the stickers get placed and where they show up most.
Shorteners hide the last step by design
A shortened link shows you the shortener. That is the entire point of the service. Your preview says one thing, and where you land is decided by a redirect record you cannot see from the outside.
Here is the part people get wrong: a redirect is not evidence of fraud. It is how a large share of legitimate codes work. Every dynamic QR code resolves through a short address on the provider's domain, then forwards to the real destination, which is what lets a printed code be repointed later without reprinting. Restaurants, museums, product packaging, and conference badges all rely on this.
So the presence of a redirect tells you nothing on its own. What tells you something is where the chain ends, and whether the ending fits the context you scanned it in.
Decode without opening
The clean way to see the full payload is to read the code without handing it to a browser. Upload or drop the image into a QR code scanner that prints the decoded text instead of navigating to it. Nothing loads. Nothing runs. You get a string on a page and you decide what happens next.
For a physical code, photograph it first, then feed the photo in. The steps are the same as reading any image-based code, covered in scan a QR code from a picture.
Once you have the full address, follow the chain. Paste it into a link expander or open it in a private window on a device you do not care about, watching each hop. A short link that forwards to a tracking domain and then to a brand's own site is ordinary marketing plumbing. A chain that ends on a domain with no relationship to the poster you scanned is not.
There is also the case where the payload is not a link at all. Plenty of codes hold text, contact details, Wi-Fi credentials, or a phone number, and a decoder shows those in the clear too. Our overview of what a QR code can store explains which prefixes mean what.
Payment and login codes deserve the harder look
Most codes are low stakes. A menu, a Wi-Fi network, a video. The two categories worth slowing down for are payments and authentication, because those are the ones with a direct payoff for the attacker.
Warning signs on a payment code:
- The sticker has a lifted edge, a slight size mismatch with the surface, or a different paper finish from everything around it. Run a fingernail across the border.
- The destination asks for full card details when the context implied a fixed amount through an app you already have.
- The page pushes you to install something, or to accept a configuration profile or certificate. Legitimate parking and transit payments do not need that.
- Urgency appears in the copy: a fine, a deadline, a threatened tow.
- The amount is editable when it should not be, or the payee name is a personal account rather than a business.
For login codes, the pattern to distrust is a code that arrives in an email or a message claiming to set up multi-factor authentication. Enrollment codes belong inside an account settings page you navigated to yourself, not in an inbound message. A code that logs a session in somewhere is a code that can log an attacker in somewhere, which is why the confirmation screen always names the device and location before you approve.
When a code fails your check
Do not just close the tab. On a physical sticker, photograph it in place before touching it, including enough of the surroundings to identify the spot. The business or agency that owns the meter, the table, or the charger usually has no idea it is there, and yours may be the first report. Then peel it, if peeling it is yours to do.
If you already tapped through and typed something in, treat it as a credential exposure: change that password anywhere it was reused, and call the number printed on the back of your card rather than any number the page gave you.