Before paying with a QR code: check the source, destination and action

On a rainy day in a car park, a QR code can look like the quickest route to payment. You take out your phone, open the camera and immediately face a form. Pause before filling it in. Establish who is asking you to act, where the link leads and what you are about to approve. A page opening quickly says nothing about its authenticity.

A QR code is neither a trust badge nor inherently dangerous. It is a way of conveying information, with a longer address hidden behind a square pattern. Estonia's Information System Authority, RIA, discussed fraudulent QR codes in a blog post dated 5 February 2026. The practical starting point is familiar: an unexpected request arriving through a code deserves the same scrutiny as an unexpected link.

Ask why the code is there

Look at the surroundings before pointing your camera. Is the code printed within an information board, added as a separate sticker or delivered in an unsolicited message? An overlaid sticker or disrupted design warrants checking, but their absence does not prove authenticity. A polished sign can also mislead. What matters is its connection to a service you intended to use.

State your intended action in one sentence: “I want to start parking here” or “I want to view the menu.” Stop if the next screen asks for something different. Viewing a menu and approving a bank transaction are separate activities. A clear starting purpose helps you notice a diversion even when a page uses familiar colours, logos and official-sounding language.

Read the address before the form

If your camera or scanning application offers an address preview, examine it before opening. A truncated address or shortened link does not reveal enough to establish the final destination. Do not complete a form until you understand where the service is hosted. If necessary, open the service through an existing trusted bookmark or familiar official application.

Look at the actual address rather than the page title alone. An organisation's name can appear elsewhere in a link without making the site that organisation's own. If you cannot confidently interpret the address, do not solve a domain-name puzzle in the rain. Use an independent route whose origin you know, or confirm the correct channel with the provider.

Check the parking location separately

Before approving payment, check the parking identifier, selected vehicle and service provider. A genuine payment environment does not prevent you from choosing the wrong zone or registration number. Safe access and accurate parking details are two distinct checks. Complete both before leaving the car and turning your attention elsewhere.

If a sign raises doubts, find the operator's details through another reliable source. Do not rely solely on the telephone number printed on the same sticker you are questioning. The verification channel must be independent of the suspicious request. Do not remove parking signs yourself; inform the operator and use a verified payment method or another permitted arrangement.

A promised refund does not justify rushing

When an email or message promises a refund through a QR code, open the relevant organisation's service independently. An unexpected deadline is not a reason to skip checking. The message's claim and the information in your actual account are separate things. If the promised action is absent from the official environment, ask through contact details found there.

A familiar sender name does not remove the need to check. Consider whether you expected the message and whether it fits your recent activity. Describe the situation to support without disclosing passwords or PINs. A useful question is whether that notification belongs to their service, rather than asking someone to help complete an approval on an unfamiliar page.

Legitimate QR sign-in exists

On 26 February 2026, RIA announced Smart-ID+ in the state authentication service. Official computer-based sign-in can involve a changing QR code scanned through the Smart-ID application. ID.ee guidance still emphasises using the correct e-service and approving only actions you initiated. A blanket rule that every QR-based sign-in is fraudulent is therefore wrong.

Focus on how the process began. Deliberately opening the required e-service and following its official sign-in flow differs from an unexpected email demanding immediate approval through a supplied code. The visual pattern alone cannot distinguish those situations. Read which service and action the phone is asking you to approve, and reject activities you did not initiate.

Distinguish viewing, entering and approving

If you already opened a suspicious page, reconstruct exactly what happened. Did you merely view an address, enter a password, supply card information, download a file or approve an operation? These are different events. Write down the sequence before details become confused. Accurate information helps your bank or support provider respond to the actual situation.

Do not assume that scanning alone means money has been stolen or the device infected. Equally, an absence of visible charges does not prove that entered information remained private. Your next steps depend on what you shared or approved. Preserve useful evidence without repeatedly opening the link simply to see whether the suspicious page still exists.

Respond to the information disclosed

ITVaatlik's phishing guidance advises contacting your bank immediately and closing the card if card details were entered on a fraudulent page. Obtain contact information through the official application or another known channel, not the suspicious site's help number. If you entered a password, change it through the genuine service and address any other accounts using the same password.

Mention downloads or installations separately when seeking support. Preserve the message, address and event time without forwarding secret codes. RIA's official channels provide incident-reporting guidance. Do not delay until you can explain the entire technical scheme yourself. The immediate priorities are limiting possible harm and describing the sequence accurately.

Practise the check without pressure

At home, open a familiar service together and show where its address appears. Practise reaching it without using a message link. Do not use a real suspicious code for the exercise or make test payments to an unknown recipient. The aim is to find information on a phone screen, not create another incident.

Agree that anyone can pause a transaction when unsure. There is no need to feel embarrassed about leaving a process unfinished. Three questions travel well: do I understand the source, have I checked the destination, and is this the action I intended? Use them in car parks, inboxes and electronic services alike.