What is happening here
A sticker overlay scam happens when someone places a fake QR sticker on top of a genuine printed code. The surface looks normal at a glance, but the scan goes to the attacker instead of the business or service named on the sign.
Overlays show up on parking meters, restaurant tables, posters, donation boxes, and any public sign where a QR code is printed in the open. The attacker only needs a printer and a few seconds alone with the sign.
Red flags to check before you scan
- The QR area feels raised, glossy, or thicker than the surrounding print.
- The edges of the code peel slightly, or a corner lifts when you look closely.
- The code sits off-centre, covers nearby text, or overlaps a border or logo.
- The sign looks tampered with: bubbles, double layers, or a code that does not match the style of the rest of the sign.
- The destination preview, if you scan, names a domain you do not recognise.
Verify before you trust it
1. Look at the code from an angle and run a fingertip lightly near its edge to feel for a second layer.
2. Compare the code with another identical sign nearby, if one exists, and note any difference.
3. Read the URL preview your camera shows before you tap through, and stop if the domain is unfamiliar.
4. Ask staff whether the code is theirs, and use a typed address or the official app instead when in doubt.
Putting this into practice
Build a habit you can use in seconds. Pause before every unexpected scan, read the destination preview, and check the domain against what you already know. If the code is printed in public, look for sticker edges and compare it with nearby signs. If the code arrived in a message, verify it through a separate channel you trust. The pause costs almost nothing, and it is the step that catches most of these scams.
Common mistakes to avoid
The most common mistake is scanning to find out whether a code is safe. A scan that opens a page can already expose you to a fake login or a payment trap. Another mistake is trusting a familiar logo, since logos are easy to copy. A third is acting under urgency, which is exactly what the message is designed to create. Slow down, verify through a channel you control, and treat any request for credentials or payment as a reason to stop.
Quick checklist
- Pause before you scan any unexpected code.
- Read the full destination preview, not just the first hop.
- Compare the domain with the official one you already know.
- Check printed codes for sticker edges and mismatched print.
- Never enter passwords, codes, or card details from a surprise scan.
- Verify through a separate, trusted channel before you act.
Related tools and guides
- Run the destination through the [QR typosquat checker](/qr-typosquat-checker) before you trust a code you did not expect.
- Inspect the code with the [QR tamper evidence planner](/qr-tamper-evidence-planner) before you trust a code you did not expect.
- Check the address with the [QR consent note builder](/qr-consent-note-builder) before you trust a code you did not expect.
- Practise spotting patterns with the [QR placement guide](/qr-placement-guide) before you trust a code you did not expect.
- Review the chain with the [QR safety checker](/qr-safety-checker) before you trust a code you did not expect.
- Keep a record with the [QR size calculator](/qr-size-calculator) before you trust a code you did not expect.
- Plan protection with the [bulk generator](/bulk-generator) before you trust a code you did not expect.
