QR Sticker Phishing. Verify the Request Before Paying

A QR sticker on a car can lead to a fraudulent payment form. MIRRI’s warning dated 2 April 2026 describes reports from Bratislava involving notices of alleged traffic offences placed on vehicles.

Before paying, contact the institution through a channel found independently of the sticker. A printed notice and a QR code do not establish who issued it.

The indicators in the warning

The Slovak government CSIRT notice identifies platby-mvsr[.]sk and sk-slovensko[.]web[.]app. These addresses are deliberately defanged. The pages impersonated public services and sought personal data, SMS identity confirmation or payment.

Treat those as indicators from this campaign, rather than a complete blocklist. An unfamiliar address can be dangerous even if it has never appeared in a warning.

Verify the request outside the message

Open the institution’s known website yourself. Compare the full address, and use a separately verified phone number if the payment demand is unclear. That is also the practical approach recommended by MIRRI.

HTTPS protects the connection. It does not establish that the operator is the institution shown in the page’s logo. Likewise, a domain suffix or the presence of eID cannot, by itself, settle whether a particular form is legitimate.

Urgency is a reason to pause. It is not evidence that a payment is due.

Make reporting easy for employees

Someone may scan a sticker on a personal phone that also holds work email. Opening the page alone does not prove the work account was compromised. The response team needs to know what happened next, including whether the person entered a password, approved a sign-in or supplied payment details.

Give employees a concrete example and a reporting contact. The procedure should distinguish a page visit from disclosure of credentials and explain who assesses the account, device and any payment. Staff should be able to report uncertainty without having to diagnose the attack first.

Email authentication and filtering remain useful layers. SPF, DKIM and DMARC can reduce abuse of your own mail domain, but do not authenticate a physical sticker or stop an attacker registering a similar-looking domain. DNS filtering may block a known malicious address. It may miss a newly created one.

If details have already been submitted

Stop interacting with the page and report through the company’s incident process. Preserve the URL, message or a photograph of the sticker. Depending on the data exposed, the response may involve a password reset through the real service, session revocation or contacting the bank. The responsible team should choose those steps from the actual incident details.

For related risks, see AI phishing and deepfake attacks and third-party website scripts. To discuss reporting responsibilities inside your company, contact us.