Check Your QR Code Before a Customer Scans a Fake One Stuck Over It

On September 8, 2026, the US Federal Trade Commission published a consumer alert with a simple title: “See a QR code parked somewhere? Don’t scan it…yet!” The warning describes a scam authorities are now calling “a sticker over a sticker” — criminals printing their own QR code on an adhesive label and pressing it directly on top of a legitimate one on a parking meter. A driver scans it expecting to pay for parking and instead lands on a fake payment page that captures their card details, sometimes along with their license plate number.

It is not a new trick, and it is not only a US problem. Dubai Police and the Dubai Cyber Security Center have separately warned residents about the same technique, which cybersecurity researchers call “quishing” — QR phishing. Their advisories describe fake codes appearing over real ones on parking payment signs, Wi-Fi login notices, and promotional flyers in public places across the UAE, with victims giving up card numbers or personal information on a convincing but fraudulent site.

The part that should worry a business owner

The FTC’s warning is aimed at consumers, but read it again from behind the counter instead of in front of it. A parking meter’s QR code and the “Scan to see our menu” or “Scan to leave us a Google review” sign taped to your table have the same physical weakness: a flat, printed code sitting in a public space, unwatched for most of the day, that anyone can walk up to and cover with their own sticker.

If that happens at your business, the scam that follows does not just hurt the customer who scanned it. It happens at your table, under your logo, and the first person that customer blames is you — not the stranger who pressed a sticker onto your sign five minutes earlier.

What to actually check

You do not need a security budget to close this gap, just a habit. A few things worth doing this week if you have any printed QR code on display:

• Run your finger over the edges. A fraudulent sticker sits on top of the original, so it usually has a slightly raised edge, a mismatched paper texture, or print quality that does not quite match the rest of your sign.
• Never route a review or menu QR code through anything that asks for payment details. A Google review link or a menu page has no legitimate reason to ask for a card number — if a customer ever tells you one did, treat your display as compromised immediately.
• Make the display itself hard to imitate. A generic A4 printout in a plastic sleeve is the easiest possible target: cheap to copy, cheap to cover. A code that is engraved, printed on branded acrylic, or built into a fixed metal stand is a much harder thing to convincingly overlay without it being obvious at a glance.
• Check it like you check your till. Add a five-second glance at your review or menu display to whatever opening routine you already run, the same way you’d notice a till drawer left open.

Where NFC actually helps, honestly

NFC does not make quishing impossible — in principle, someone could still try to tamper with any physical object. But it does remove the single easiest version of this attack. With a product like Smaacaad’s Google Review NFC Stand (AED 39), a customer taps their phone and it opens your actual Google review page directly through the embedded chip — there is no code for a scammer to quietly paste over, because the trust lives in the branded object itself, not in a printable pattern of black squares. The backup QR code most of these stands also carry is printed on the same fixed, branded surface, which is far harder to convincingly cover than a loose paper sign.

The same logic applies to a printed QR code on a restaurant table. A laminated sheet is trivial to swap or overlay unnoticed between sittings; a compact, branded card like the Google Review NFC Card with QR (AED 29) sits in a slot or holder, gets checked when it’s wiped down, and gives staff something specific to look for if it ever looks different from the day before.

None of this replaces basic vigilance — the FTC’s own advice, checking a QR code’s destination preview before tapping through, and not entering financial details on a page you reached by scanning something in public, still applies no matter what the code is printed on. But if the only thing standing between your customers and a copy-paste scam is a sheet of paper anyone can walk past, that is worth fixing before it becomes a story about your business instead of a parking meter.

Photo by Markus Winkler on Unsplash