QR codes are everywhere now — restaurant tables, parking meters, packages, posters, and yes, tags like ours on a set of lost keys. That convenience has a downside: scammers have started using fake QR codes to trick people, a tactic with the slightly silly name of "quishing" (QR + phishing). It's worth understanding, because a little knowledge makes you basically immune — and it means you can tell the difference between a scam and an honest code you can safely help with.
Here's the plain-English version of how to stay safe, why most scans are completely harmless, and the one habit that stops nearly every QR scam cold.
First, the reassuring truth: scanning is rarely the dangerous part
A QR code is just a shortcut to a web address — scanning one is almost exactly like tapping a link. In the vast majority of cases, scanning simply opens a web page, and that's it. The danger almost never comes from the scan itself. It comes from what the page then asks you to do.
Nearly every QR scam has the same goal: to get you onto a convincing fake page and then persuade you to enter a password, enter card or bank details, or approve a payment. The harm happens when you hand something over — not when the camera reads the square. That's genuinely good news, because it means you're in control at the exact moment that matters.
The single habit that stops almost every QR scam
If you remember nothing else, remember this:
Never enter a password, payment details, or personal information on a page you reached only by scanning a code — especially if it appeared unexpectedly or pressures you to hurry.
If a scanned code takes you somewhere asking you to log in or pay, stop. Don't enter anything on that page. Instead, open your browser or the official app yourself and go to the real website directly. This one habit blocks the overwhelming majority of quishing attacks, because the scam depends entirely on you trusting the page it sent you to.
The warning signs of a dodgy QR code
A few things reliably signal a scam. If you spot any of these, don't proceed:
A sticker over a sticker
The classic physical scam is a fake QR sticker pasted on top of a real one — on parking meters, restaurant tables, EV chargers. If a code looks like a cheap label stuck over something, or the edges are peeling to reveal another code underneath, don't scan it.
It asks for payment or login immediately
A code that jumps straight to "enter your card details" or "log in to continue" on an unfamiliar site is a major red flag. Legitimate services rarely need you to enter sensitive credentials via a scanned poster or sticker.
The web address doesn't match
Most phones show the destination URL before you open it. Read it. If you scanned something for "Mario's Pizza" but the address is mario-pizza-verify.xyz, or it has odd extra words, misspellings, or a switched letter, don't tap through.
It arrived unexpectedly
A QR code in an out-of-the-blue text or email — a "missed delivery," an "unpaid toll," a "problem with your account" — especially with urgency, is a common trick. If you think it might be real, contact the company yourself using a number or website you already trust, not the code.
Odd payment methods
Any page that wants payment by gift card, crypto, or bank transfer to a "safe account" is a scam, full stop, whatever the reason given.
A simple checklist before you scan an unfamiliar code
- Look at it. Is it a permanent-looking printed code, or a cheap sticker that might be covering another? Tampered = don't scan.
- Consider the context. Did you expect this code, or did it arrive unprompted with a sense of urgency? Unexpected + urgent = be suspicious.
- Read the URL preview before opening. Does the web address genuinely match who it claims to be from?
- Never enter a login or payment on a page you only reached by scanning. When in doubt, go to the official site or app directly instead.
So — is it safe to scan a lost-property tag you've found?
This is worth addressing directly, because it's exactly the moment of hesitation an honest person might feel: you've found someone's keys or bag, there's a QR code on a tag, and after reading all of the above you might reasonably pause before scanning a code from a stranger.
Here's the honest reassurance, measured against the very warning signs above. Notice what every QR scam has in common: it wants you to log in, pay, or hand over personal details. A genuine lost-and-found scan asks for none of those things. When you scan a Pingable tag to help return something:
It doesn't ask you to log in
There's no account to sign into, no password to enter.
It doesn't ask you to pay anything
Helping return a lost item is free — any page asking a finder for payment would itself be the red flag.
It doesn't ask for your personal details
The entire design is anonymous — you can reach the owner without giving your name, number, or anything else about yourself.
It doesn't create false urgency
It just gives you a simple, private way to say "I found this."
In other words, a lost-property tag fails to match the pattern of a scam on every single point that matters — because the thing that makes quishing dangerous (a page that wants your credentials or money) is precisely what an honest return tag never does. If you ever scan one of ours and the page asks you to log in, pay, or hand over personal information, that would be exactly the moment to stop — because that's not how it's meant to work.
That's a big part of why we built Pingable the way we did: the same instinct that makes you cautious about scanning a random code is the instinct we wanted to respect. A finder helping return something should never have to expose or risk anything to do a good deed.
The short version
- Scanning a QR code is usually harmless — the risk is in what you do on the page it opens.
- Never enter a password, payment, or personal details on a page you reached only by scanning.
- Watch for stickers-over-stickers, mismatched web addresses, unexpected codes, and urgency.
- An honest lost-and-found tag never asks you to log in, pay, or identify yourself — so helping return something you've found is safe to do.
Sources: consumer guidance from the US Federal Trade Commission (FTC) and FBI Internet Crime Complaint Center (IC3) on QR-code scams, plus security-industry reporting on quishing trends in 2025–2026. This is general safety information, not individual security advice.