Types of QR Code Fraud Affecting Businesses
1. Sticker replacement fraud:
A malicious actor places their QR sticker over your legitimate payment or service QR. Customers scan the fraudster's code instead of yours. The business loses the transaction; the customer's payment goes elsewhere.
2. Coupon and voucher QR fraud:
Screenshots of valid QR discount codes or vouchers are shared beyond their intended recipients. One QR coupon is redeemed hundreds of times.
3. Ticket QR fraud:
Event ticket QR codes are photographed and shared. Multiple people attempt to use the same QR for entry.
4. Loyalty stamp fraud:
Customers share screenshots of unredeemed loyalty QR codes to avoid scanning in-person.
5. Content injection:
In sophisticated attacks, a dynamic QR's redirect destination is compromised, pointing customers to malicious content rather than the intended destination.
Detection Methods
Tamper-evident QR stickers:
Labels that show evidence of removal (leave behind residue, void pattern, or permanent colour change when peeled). Used on parking meter payment QR panels, ATM screens, and high-risk surfaces.
Single-use QR validation:
QR codes for tickets, coupons, and vouchers are validated server-side and marked as used after one scan. Any subsequent scan of the same code triggers a fraud alert.
Geolocation verification:
The scan is validated against the expected geographical location. A parking meter QR scanned from a different city is flagged.
Time-windowed QR:
QR codes valid only for a specific time window (rotating codes, event-day-only tickets). Screenshots taken before the valid window are useless.
Rate limiting:
More than X scans per hour from the same IP address or the same QR code triggers a fraud investigation alert.
Operational Fraud Prevention
Train staff to:
- Inspect QR code surfaces regularly for overlay stickers
- Report any QR code that appears to have been tampered with
- Never allow customers to screenshot a QR and use it later for in-person redemption without real-time validation
Putting this into practice
Start with the smallest real test you can run. Generate the code, print it at the exact size you plan to use, and scan it with two different phones in the lighting where it will live. Check that the destination page loads quickly on a mobile connection and that the call to action next to the code tells people what they will get. If anything feels slow or unclear, fix it before you print a full batch, because reprints cost more than a short test. Keep a note of the size, material, and placement that worked so the next batch starts from a proven setup.
Common mistakes to avoid
The most common mistakes are easy to avoid once you know them. Long payloads make modules tiny, low contrast makes edges hard to read, and text placed too close to the border eats the quiet zone the scanner needs. Covering a corner finder pattern with a logo or a sticker breaks detection entirely, and a code placed behind glare or on a curved surface fails even when the print is perfect. Review each of these points on a proof copy, and treat any failure as a reason to adjust the design rather than a reason to blame the scanner.
Quick checklist
- Keep the payload as short as practical so modules stay large.
- Keep dark modules on a light background with strong contrast.
- Leave a clear quiet zone on all four sides of the symbol.
- Test the printed code at the real viewing distance and lighting.
- Confirm the destination page loads fast on a phone.
- Recheck the code after any change to the link, design, or placement.
Related tools and guides
- Run unfamiliar destinations through the [QR safety checker](/qr-safety-checker) before you share a code widely.
- Test every code with the [QR scanner](/qr-scanner) on more than one phone before you publish or print it.
- Use the [QR size calculator](/qr-size-calculator) to match the printed size to the expected scan distance before you commit to a print run.
- The [error correction simulator](/error-correction-simulator) shows how damage tolerance changes the density of the symbol at each level.
- Create a fresh code with the [URL QR code generator](/url-qr-code-generator) when the destination is a web page.
- The [blog](/blog) collects more guides on sizing, printing, security, and payments for QR codes.
