Most quishing guides focus on what to do after you scan a code. But in public places — parking meters, restaurant tables, event posters — a lot of these scams share a physical tell: a fake sticker placed directly over the real code. A 30-second visual check before you ever pull out your phone can catch this.

What to look for

Raised or misaligned

A sticker sitting slightly raised, bubbled, or off-alignment compared to the surface around it — genuine printed codes are usually flush with the material they're printed on.

Mismatched material

A different paper stock, finish, or print quality than the rest of the sign, menu, or meter — attackers rarely match the original material exactly.

Peeling or residue

Peeling edges or adhesive residue around the code, especially if there's a visible edge suggesting something was placed on top of an existing surface.

Odd positioning

Off-center, at a slight angle, or placed somewhere a code wouldn't normally go on that particular sign or object.

No surrounding context

A legitimate code usually sits next to a business name, instructions, or branding. A code with nothing else around it is worth a second look.

Where this matters most

  • Parking meters and pay stations — a very common target, since drivers are often in a hurry and expect to pay quickly. The FTC's own recent consumer alert specifically warns about scammers covering legitimate parking QR codes with fake ones.
  • Restaurant tables — table-tent and menu codes are easy to cover with a matching-looking sticker.
  • Flyers and public posters — especially in high-traffic areas where a fake code can reach many people before anyone notices.
  • Package labels — check that a QR code on a delivered package matches the carrier's normal labeling.
If something feels off

Trust that instinct even if you can't articulate exactly why. It costs nothing to skip a code that looks slightly wrong, use a different payment method, or ask a staff member whether a code is legitimate.

The physical check isn't enough on its own

A well-made fake sticker can look completely convincing, and plenty of quishing attacks don't involve any physical tampering at all — email and PDF-based quishing, for example, has nothing to inspect visually. Physical inspection is a fast first filter, not a substitute for checking the actual destination link.

How a sticker scam works

The attacker prints a malicious code on a cheap adhesive sheet or vinyl label and places it over the genuine one. The victim scans expecting the normal function — pay the meter, open the menu, check in — and lands on a look-alike page instead. Because the sticker sits exactly where the real code belongs, trust transfers automatically: people rarely question a code that appears to belong where it is.

The attack needs almost no technical skill and very little money, which is why it is among the most common forms of quishing. Typical targets are parking meters, EV charging stations, gas pumps, airport kiosks, hotel desks, and retail displays, plus removable codes on flyers in busy places like transit stations and convention centers.

More red flags beyond the sticker itself

  • A URL printed in tiny text that does not match the business you expect.
  • Urgency language such as "scan before time expires".
  • A code that asks for payment, personal data, or a login on a surface that normally would not.
  • A code that is a different size or style from other codes nearby.

If you already scanned and entered something

Act quickly, but calmly:

  • Close the page and do not re-enter anything.
  • Change any password you typed, from a device you trust, and turn on two-factor authentication where you can.
  • If a card or bank detail was involved, call your bank or card issuer and ask about disputing charges.
  • Tell the property owner or transit authority so they can remove the sticker.
  • Report the destination link to Google Safe Browsing and, if money or identity was involved, to the FTC at reportfraud.ftc.gov.

For a fuller walkthrough, see I scanned a malicious QR code — what now?

The missing verification step

Physical signage used to give you something to verify — a flyer at least had a phone number you could call. A QR code has no such anchor. Decoding the destination before your browser opens it restores that step, which is exactly what CheckThisQR does, in your browser, with no account.

Next step

Combine the visual check with a real one

Upload or scan the code with CheckThisQR to see the real destination and a safety verdict before you visit it.

Check a QR code now →