Find the fake sites behind QR code scams

A fake QR code, on a sticker over your parking sign or menu, or in an email, sends people to a web address like yours, such as yourbrand-pay.com. We cannot remove the sticker or stop the email. We find the site the code points to and get it taken down.

This works when the page behind the code is on a lookalike of your domain or is a copy of your own site.

A fake QR code already in use?

Report a live attack

Free to report. No account needed. One of our team calls you back, usually the same working day. Out of hours, email security@defenddomain.com.

Check for lookalike domains

Prefer to talk first? Book a demo

Out of hours, email security@defenddomain.com.

Who it is for

For anyone whose QR codes lead to a payment or login page, such as car parks, venues and restaurants.

Operations and facilities
Know when your payment page is faked
If your payment page is copied onto a lookalike of your domain, you get an alert with the evidence.
Marketing
Protect the codes on your packaging and posters
We watch lookalikes of the domains your codes point to, so a fake version of the page is found.
IT and security
The evidence is collected for you
Each alert has screenshots, who registered the domain and where it is hosted.
Risk and compliance
A record of what was found and done
Each threat keeps its evidence, status and notes from first alert to offline.

How QR code scams work, and the part we cover

QR code phishing (sometimes called quishing) uses a code instead of a link, so people cannot see where it goes before they scan.

Not covered

Stickers over real QR codes

Fake codes stuck over real ones on parking meters, menus, chargers or posters.

Checking your own codes is the defence here.

Not covered

QR codes in emails

Phishing emails that use a QR code instead of a link, so it opens on a personal phone.

Your email filter and staff training are the first defence.

Where we help

The page the code opens

A fake payment or login page on a lookalike of your domain. Whether the code is on a sticker or in an email, this page is what takes the money or the password.

It is the one part of the scam a registrar or host can switch off. We find it and send them the evidence.

QR code scams we find the sites for

Each of these opens a page on a web address made to look like the real company's.

QR codes
Fake QR codes
yourbrand-pay.com
A code that opens a fake payment or login page on a lookalike of your domain.
Fake logins
Fake login pages
yourbrand-login.com
A copy of your login page on a lookalike of your domain, used to collect passwords.

How we find the fake page and get it taken down

Give us your domains, including the ones your QR codes point to. The website marker is optional.

Step 1

We list lookalikes of your domains

Around 500 per domain, including your name plus words such as -pay, -parking or -menu, and other endings such as .co. Each one is re-checked every hour.

Step 2

We watch new certificates

A phone marks a payment page without a padlock “Not secure”, so a fake payment page needs a certificate too. Each certificate is added to public logs as it is issued, and we watch 100+ of those logs for any name like yours.

Step 3

We hear when the page behind your code is copied

The website marker is a small script or a 1×1 image on your payment or login page. A criminal who copies the page copies it too, and when it loads on another address it tells us which one.

Step 4

You confirm, we report and follow up

When you confirm the page is a live attack, one click sends the evidence to up to 12 places at once, from the registrar and the host to browser warning lists and search engines. We check every hour whether it is still online and tell you when it goes down. After that we keep watching and alert you if it comes back.

How the product works

What an alert shows you

The lookalike, a screenshot of the page behind the code and its certificate. The evidence pack adds who registered the domain and where it is hosted, each with the time it was captured.

Findings are sorted automatically: threats are alerted, doubtful ones go on a watch list and the rest are marked safe. Alerts arrive by email, or in Slack, Microsoft Teams, SMS or a webhook, and IT teams can send them to Splunk, Microsoft Sentinel or Wazuh.

New threat

CriticalExample

yourbrand-pay.com

Impersonating yourbrand.com

Copies your payment page.

Threat signals

Name built to deceive: Your name plus “pay”
Copies your website: Your payment page and logo
Certificate issued: Public certificate logs

Take it downThis is ours

What a copied-website case looked like

Case study, mid-2026

Copied website removed in about a day

There was no QR code in this case, and no lookalike domain either: a full copy of an AI consultancy’s website appeared on a subdomain of a free hosting platform, with a valid padlock. The page a fake code opens is found the same way, whether or not it sits on a lookalike of your domain.

Read the case study

What happened

Offline

A full copy of the site on a free hosting subdomain, with a working padlock
Found by the certificate logs, a search for its wording and the website marker
The day it was confirmedOne report with the evidence to the hosting platform
About 24 hours laterOffline

From the case. Names changed.

What your QR code checks do not cover

Each of these helps, and each leaves a gap.

“We check our QR codes regularly”

Keep checking. A car park or restaurant can have dozens of codes, and a criminal only needs one sticker. Our alerts tell you which of your pages has been copied, so you know which codes to check first.

How we watch lookalikes of your domain

“We use QR codes we can update”

You can change where your own code goes. A sticker over it is a different code that goes where the criminal wants. We send you the address it opens as soon as we find it, so your staff can tell customers that site is not yours.

How fake sites reach people

“Phones show a preview of the link”

A preview only helps if people read it, and yourbrand-pay.com looks right. We flag a name like that when it is registered, before any code points to it.

What the padlock really means

“Our payment provider handles security”

Your provider secures payments on your real page. A fake page takes card details before your provider is ever involved. We get the fake page onto the browser warning lists, which warn the next person who scans.

Fake payment and shop pages

Questions about QR code scams

The sticker is not the only copy of that code, and the same code can be sent in an email, so we deal with the one thing they all share: the page it opens. Once that is offline, every code pointing to it leads nowhere. Our recruitment-scam case was the same problem by text: fake recruiters sent job seekers to copies of a software company’s website by SMS and WhatsApp, and we now build the evidence and send the takedowns for those copies.

If the code opens one of the lookalikes we list, we see the page at our next hourly check. If it opens any other address, the certificate logs or the website marker can still find it, as they did in our consultancy case.

See what we would find for your domains

In a 30-minute demo we show you the lookalikes of your domain that exist today and what happens when you report one.

Which lookalikes of your domain exist now, and which show a website
How the website marker goes on a payment page, if you want it
A clear annual price for your domains

A fake page already live? Report a live attack