QR code phishing got me at a coffee shop, here's the 5 second check

Last week I scanned a QR code on a flyer at a local cafe in Denver to see their menu. Phone went straight to a login page for my email. Looked legit but something felt off. I checked the URL and it was some weird domain with 'mail' in it. Then I realized the flyer was just a sticker slapped over the old one. I backed out fast and changed my password. Now I always long-press the QR link first to preview the actual address before opening. Anyone else nearly fall for this? What do you use to scan codes safely?

1 comments

1 Comment

sethmartinez4d ago

Long-press previewing is the only way now. I do the same thing, but I also check if the QR code itself is a sticker with a slightly different shade or texture. Those lookalike domains are getting too good, so I’ll type the cafe’s name into a browser instead if the link looks even a little off. That five second check saved me from handing over my Google login to a phishing page that had the exact same logo and layout.