Find out how to verify a QR code before opening it, and avoid online scams, data theft, and fraudulent payments. With ShopSicuro.it, you can check suspicious links before trusting them.
QR codes are convenient. But they can be a trap
Check a QR code now on ShopSicuro.it
We use them to read restaurant menus, pay for parking, access a promotion, download an app, fill out a form, or complete a payment. The QR code has quietly entered our daily lives, without making a sound. That’s precisely the problem: we often trust it too much.
In fact, a QR code doesn’t immediately reveal where it leads. Behind that little black-and-white square, there may be a legitimate website, but it could also be a fake page designed to steal personal data, bank credentials, OTP codes, or money. This technique is called “quishing,” which is phishing via QR codes.
The risk is very real: scammers can tamper with physical or digital QR codes to direct victims to malicious sites, steal credentials, install malware, or divert payments to unauthorized accounts.
How the QR Code Scam Works
The scam may seem trivial, but that’s precisely why it works. The consumer sees a QR code, scans it with their phone, and clicks on the link without checking it. That’s when the problems begin.
The most common scenarios are:
- Overlaid QR Code sticker: The scammer sticks a fake code over the original one, for example on a parking meter, a flyer, a menu, or a public notice.
- Cloned website: The QR code leads to a page that looks like that of a bank, PagoPA, a shipping company, a municipality, or an online store. Similar graphics, a copied logo, and a formal tone. But the address is fake.
- Redirected payment: The consumer believes they are paying for a legitimate service, but the money ends up with the scammer.
- Credential theft: The page asks for an email address, password, SPID credentials, card number, or security codes.
- Dangerous download: The QR code prompts you to download an app from outside the official app stores. In that case, alarm bells should be ringing loudly.
The golden rule: check first, then click
QR codes shouldn’t be demonized. That would be like saying cars are dangerous and therefore we need to go back to horses. But they should be used with caution.
Before opening a link from a QR code, perform these checks.
1. Examine the QR code visually
If it’s printed on a sticker, make sure it hasn’t been placed over another code. Run your finger along the edge: if you feel any thickness, raised areas, or overlaps, it’s best not to scan it.
2. Read the URL before opening
When you frame the QR code, your phone displays a preview of the link. Don’t click it automatically.
Check if the URL makes sense. Watch out for strange domains, minor errors, letters that have been swapped, added words, or URLs that are too long and confusing.
Example: pagopa.it is one thing. pagopa-secure-online-payment.xyz is a whole different story. And it usually ends badly.
3. Don’t enter personal or banking information right away
If, after scanning the QR code, you’re asked for a password, card information, SPID, ID, or codes received via text message, stop right there.
A legitimate QR code may take you to an informational page. A suspicious QR code puts pressure on you and asks for sensitive information.
4. Don’t download apps from QR codes
Apps should be downloaded from official stores: the Google Play Store and the Apple App Store. If a QR code prompts you to download an APK file or an app from an external site, it’s best to close it immediately.
5. If you need to pay, verify through an official channel
If the QR code is related to a fine, a bill, a package, a subscription, or an urgent payment, don’t rush.
Go to the official website by typing the address yourself, or contact the agency, municipality, bank, or company through verified phone numbers and channels. Do not use the contact information listed on the suspicious page.
ShopSicuro.it: a useful tool to check before trusting
To help consumers avoid online scams, ShopSicuro.it, a free service from the iConsumatori Federation, created as part of the project “Anti-Fraud Team — Get Informed, Be Prepared, Take Action” with support from the Ministry of Enterprise and Made in Italy.
The project also involves A.E.C.I. APS and Konsumer Italia and is designed to offer citizens a practical tool against digital scams.
ShopSicuro.it allows you to verify the reliability of a website by analyzing various elements: domain, SSL certificate, content, legal information, payment methods, and external security databases. The result is presented using a simple traffic-light system: green, yellow, or red.
How to Use ShopSicuro.it to Verify a QR Code
The most interesting feature, when it comes to QR codes, is the “Verify QR Code” function.
This feature lets you scan a QR code with your camera or upload an image—even a screenshot—to find out where the code leads before visiting the site.
Once the web address is detected, you can verify its reliability with ShopSicuro. Simply put: instead of clicking blindly, you can view the link first and then check it. Which, in the world of online scams, is a bit like looking both ways before crossing the street. Trivial, yes. But it saves you a lot of trouble.
Check a QR code now on ShopSicuro.it
When to Use ShopSicuro.it
You can use ShopSicuro.it when:
- you’ve received a QR code via email, text message, or WhatsApp;
- you find a QR code on a flyer, in a parking lot, on a menu, or on a notice;
- you need to make a purchase from an online store you’re not familiar with;
- the website seems suspicious or too good to be true;
- you’re asked to pay immediately;
- you’re asked to enter personal information, login credentials, or credit card details.
The point isn’t to become paranoid. The point is not to trust those who haven’t earned your trust.
Warning signs that should make you stop immediately
There are certain red flags you should watch out for:
- the QR code is pasted over another code;
- the link doesn’t match the name of the company or organization;
- the website lacks clear information about the seller;
- there is no VAT number, address, real contact information, or terms of sale;
- you’re asked to pay using untraceable methods;
- the page uses phrases such as “pay now,” “final notice,” “account blocked,” or “fine will increase within 24 hours”;
- you are asked to enter bank details or SPID credentials;
- the site contains errors, poorly translated text, or pixelated logos.
Haste is a scammer’s best friend. When a message makes you anxious, slow down. Closing a suspicious page costs nothing. Opening it and entering your information can cost you dearly.
What to do if you’ve already scanned a suspicious QR code
If you’ve only scanned the code but haven’t entered any information, the risk is lower. Close the page, don’t download anything, and, if necessary, clear your browsing history.
If, on the other hand, you’ve entered personal data, login credentials, or banking information:
- contact your bank immediately;
- block your card if you entered payment information;
- change any affected passwords;
- enable two-factor authentication where possible;
- report the incident to the Postal Police;
- Save screenshots, links, emails, messages, and receipts;
- verify the website linked to the QR code on ShopSicuro.it;
- ask a consumer protection organization for assistance.
Do you have concerns about a QR code or a suspicious website?
If you’ve received a suspicious QR code, made a payment on an unclear website, or fear you’ve fallen victim to an online scam, you can ask for help.
Open a support ticket and ask for help
Conclusion: QR codes aren’t the enemy—blind trust is
QR codes are useful, fast, and convenient. But precisely because they’re convenient, they’re exploited by scammers. Consumers shouldn’t stop using them—they need to learn how to verify them.
The rule is simple: never scan a QR code without knowing where it leads.
With tools like ShopSicuro.it, you can perform a preliminary check, verify the reliability of the linked site, and reduce the risk of falling for a scam.
Before paying, entering information, or downloading anything, take thirty seconds to check. Losing thirty seconds is annoying. Losing money, data, and peace of mind is a little more so.