Most quishing guides focus on what to do after you scan a code. But in public places — parking meters, restaurant tables, event posters — a lot of these scams share a physical tell: a fake sticker placed directly over the real code. A 30-second visual check before you ever pull out your phone can catch this.
What to look for
- A sticker that sits slightly raised, bubbled, or off-alignment compared to the surface around it — genuine printed codes are usually flush with the material they're printed on.
- A different paper stock, finish, or print quality than the rest of the sign, menu, or meter — attackers rarely match the original material exactly.
- Peeling edges or adhesive residue around the code, especially if there's a visible edge suggesting something was placed on top of an existing surface.
- A code that's oddly positioned — off-center, at a slight angle, or placed somewhere a code wouldn't normally go on that particular sign or object.
- No surrounding context — a legitimate code usually sits next to a business name, instructions, or branding. A code with nothing else around it, or context that doesn't quite match, is worth a second look.
Where this matters most
- Parking meters and pay stations — a very common target, since drivers are often in a hurry and expect to pay quickly.
- Restaurant tables — table-tent and menu codes are easy to cover with a matching-looking sticker.
- Flyers and public posters — especially in high-traffic areas where a fake code can reach many people before anyone notices.
- Package labels — check that a QR code on a delivered package matches the carrier's normal labeling.
Trust that instinct even if you can't articulate exactly why. It costs nothing to skip a code that looks slightly wrong, use a different payment method, or ask a staff member whether a code is legitimate.
The physical check isn't enough on its own
A well-made fake sticker can look completely convincing, and plenty of quishing attacks don't involve any physical tampering at all — email and PDF-based quishing, for example, has nothing to inspect visually. Physical inspection is a fast first filter, not a substitute for checking the actual destination link.
Combine a visual check with an actual link check. Upload or scan the code with CheckThisQR to see the real destination and a safety verdict before you visit it.
Check a QR code now