How Attackers Sticker Over Legitimate QR Codes

A QR code sticker attack is disarmingly low-tech: a criminal prints a malicious code on a sticker and places it over a genuine one. No hacking required — just a peel and a press. Because the fake looks identical, the only defenses are noticing the tampering and reading the link. Here's how these overlay attacks work and how to shut them down. 🐾

Of all the QR scams, the sticker overlay is the most physical and the most quietly effective. There's no email to filter, no software to exploit — just a small adhesive square placed where people already trust the code beneath it. For scammers it's cheap, fast, and hard to trace. For the rest of us, the good news is that a little awareness goes a long way.

What is a QR code overlay attack?

An overlay attack replaces a legitimate QR code with a malicious one by physically covering it. The attacker prints their own code — one that links to a phishing page, a fake payment site, or a malicious download — onto a sticker, then applies it directly over the real code on a sign, machine, or product. Anyone who scans gets the attacker's destination while believing they're using the official one.

Because the outcome is a hostile link, this is a form of quishing. The distinctive part is the delivery: the trap is placed in the physical world, over something you already trust.

The genius and the weakness of the sticker attack are the same thing: it happens in plain sight. Anyone can place one — and anyone paying attention can spot one.

Where do sticker attacks happen?

Overlay attacks favor codes that are public, unattended, and expected to be scanned:

Target	Why it's chosen
Parking meters & pay stations	Unattended, scan-to-pay is normal, people are rushed
EV charging points	Isolated locations, payment expected
Restaurant tables & menus	Loose codes are easy to swap unnoticed
Posters & flyers	Public walls; a sticker blends into busy artwork
Transit & info signage	Trusted official context lends false credibility
Product packaging on shelves	Fake "register your product" or "discount" codes

Parking is such a frequent target that we gave it its own guide: fake parking meter QR codes and other real scams.

How can I spot a stickered-over code?

Tampering usually leaves subtle traces. Before scanning a code in a public place, take two seconds to look at it physically.

• Is it a sticker at all? A genuine code is often printed directly into the sign, panel, or menu. A separate adhesive label is worth a second thought.
• Peeling or raised edges. A sticker applied over another sticker often has slightly lifted corners.
• Misalignment. The fake may sit crooked, or cover part of the surrounding text or logo.
• Mismatched finish. Different paper, gloss, or color from the rest of the printed material.
• A visible layer underneath. Sometimes you can see the edge of the real code peeking out.

If a code looks added-on and you can peel it to reveal another code beneath, that's near-certain evidence of an attack — leave it in place, don't scan it, and tell the venue.

The decisive defense: read the link

Physical inspection catches many overlays, but the reliable backstop is always the same: preview the destination before you open it. Even a perfectly applied sticker can't hide where its code actually leads once you decode it. When you scan, read the domain and ask whether it belongs to the real operator. A scanner that lets you scan a code safely and shows the true destination first turns the invisible link into one you can judge. For the specifics of reading an address, see QR codes and malicious URLs.

What can businesses do to defend their codes?

If you run a venue or operate machines with codes, you're a target too — and you can make overlays harder and more obvious.

1. Make codes tamper-evident. Laminate them, print them into the surface, or use tamper-evident labels that visibly break if peeled.
2. Integrate the code into the design. A code embedded within logos and branding is harder to cleanly cover than a plain square in a corner.
3. Inspect regularly. Train staff to check high-value codes (payment, parking, tables) for stickers as part of routine.
4. Publish the real domain. Print the official web address next to the code so customers can confirm the destination matches.
5. Offer an alternative. A named app or a short, memorable URL gives customers a way to pay that doesn't depend on the physical code.
6. Prefer static codes with your real link. A directly encoded destination on your own domain is easy for customers to verify. You can create a free QR code that does exactly that.

What should I do if I find one?

If you spot a suspicious overlay:

• Don't scan it, or if you already did, don't enter any details.
• Photograph it in place as evidence, if safe to do so.
• Tell the venue or operator immediately so they can remove it and warn others.
• Report it to the relevant fraud or consumer-protection body. Our guide to reporting a malicious QR code covers who to contact.

Keeping it in perspective

Sticker attacks are real, but they're also among the easiest scams to defeat once you know they exist. A glance at the code's surface and a read of the decoded link handle nearly all of them, and neither takes more than a few seconds. Combine those two habits — captured in our QR code safety checklist — and a stuck-on fake becomes something you notice rather than something you fall for.

Frequently asked questions

How do I know if a QR code has been tampered with?

Look for a sticker sitting on top of the surface, especially with peeling edges, crooked alignment, a mismatched finish, or another code visible underneath. A genuine code is often printed directly into the sign or panel rather than added as a loose label.

Why are sticker attacks so effective?

They require no technical skill and exploit trust in a location people already use — a parking meter, a menu, a poster. The fake code looks identical to the real one, so the scam relies entirely on victims not inspecting the sticker or reading the link.

Can I just peel off a suspicious sticker?

It's better to leave it in place and report it, so the venue can preserve it and warn others, but if you do lift a corner and see another code beneath, that confirms tampering. Either way, don't scan it, and let the operator know.

How can a business protect its QR codes from overlays?

Use tamper-evident or laminated labels, print codes into the surface or branding, inspect high-value codes regularly, and display the official web address beside each code so customers can confirm the destination. Offering an app or known URL as an alternative also helps.

Does previewing the link protect me even if the sticker looks perfect?

Yes. No matter how convincingly a sticker is applied, decoding its code reveals the true destination. Reading that link and checking the domain lets you catch an overlay you couldn't detect by sight alone.